Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added template prototype for endusers using TLS 1.2 & 1.3, multiple domains or Let's Encrypt. #263

Open
wants to merge 3 commits into
base: development
Choose a base branch
from
Open

Added template prototype for endusers using TLS 1.2 & 1.3, multiple domains or Let's Encrypt. #263

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fdecb9f
Added template prototype for endusers using TLS 1.2 & 1.3, multiple d…
Jun 1, 2022
dd733db
Updated note for certs dir
Jun 1, 2022
610eccd
Merge branch 'development' into remove_tls11_add_ciphers
Jul 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions tls.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,19 @@
tls:
# For TLS 1.2+ and multiple domains and ssls
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@DonRichards I would think we would want to use these as the default options for isle-dc, to encourage best practices.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I believe so.... assuming that this won't break existing sites... Also, this would validate any local security audits for TLS. TLS 1.0 was being phased out as early as 2018 and as of last year, no one really supports 1.0 or 1.1 anymore. I think we should drop any reference to 1.0 and imply that 1.2+ is all that should be referenced. Microsoft stopped supporting both across all platforms from I can see.

# options:
# default:
# minVersion: VersionTLS12
# maxVersion: VersionTLS13
# cipherSuites:
# # TLS 1.0 - 1.2 cipher suites
# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
# # only used for multiple domains and ssls
# #sniStrict: true
stores:
default:
defaultCertificate:
Expand All @@ -7,3 +22,15 @@ tls:
certificates:
- certFile: /etc/ssl/traefik/cert.pem
keyFile: /etc/ssl/traefik/privkey.pem
# Uncomment and edit accordingly for remote certs - commercial prod & staging example.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think these are good, so people know this is all they need to change, but probably should put a note that they need to be put into the certs directory.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though, I wonder if this could be set via an environmental variable in .env? The only reason I am thinking this, is this is a file in SCM, so not something that one would expect to have to edit for localized configuration.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call @misilot I updated the comment to direct folks to put files there.

#- certFile: /etc/ssl/traefik/commercial_wildcard.crt
# keyFile: /etc/ssl/traefik/commercial_wildcard.key
# Uncomment and update docker-compose traefik labels accordingly with the resolver name e.g. myresolver
Copy link
Contributor

@misilot misilot Jun 1, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, we already have https://github.com/Islandora-Devops/isle-dc/blob/development/docker-compose.acme.yml that can be turned on and off via the .env file. So not sure if we want to include this here since it would add in the configuration in two different places.

This is in reference to the certificatesResolvers: section (incase line numbers change)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can remove if that is the call.

# certificatesResolvers:
# myresolver:
# acme:
# email: your_email.com
# storage: acme.json
# httpChallenge:
# # used during the challenge
# entryPoint: http