Auto HTTPS in CE #4491

ruslandoga · 2024-08-30T06:39:16Z

Changes

This PR starts using https://github.com/sasa1977/site_encrypt in CE to generate (and keep up-to-date) TLS certificates using https://certbot.eff.org.

The goal is to simplify CE deployments by removing the reverse-proxy requirement.

Trying it out locally

Launch a local CA like Pebble:
```
$ docker run --rm --name pebble -d -p 14000:14000 -p 15000:15000 -e "PEBBLE_VA_NOSLEEP=1" ghcr.io/letsencrypt/pebble
```
UPDATE: since Docker Desktop 4.34.0 host networking can be used on non-Linux machines: https://docs.docker.com/engine/network/drivers/host/?uuid=ebc0dd6c-ae8d-43ac-aa17-81671a3a76dd%0A#docker-desktop, that would remove the need for host.docker.internal workaround below.
Install Certbot, e.g. with brew install certbot
Install new CE deps, e.g. with MIX_ENV=ce mix deps.get

Edit config/.env.dev and .iex.exs so as not to interfere with custom ENV used in the next step:

_{config/.env.dev}

- BASE_URL=http://localhost:8000
  SECURE_COOKIE=false
  DATABASE_URL=postgres://postgres:[email protected]:5432/plausible_dev
  CLICKHOUSE_DATABASE_URL=http://127.0.0.1:8123/plausible_events_db
  ...

_.iex.exs

  ...

  import_if_available(Ecto.Query)
  import_if_available(Plausible.Factory)

- Logger.configure(level: :warning)

  ...

Launch Plausible with the following ENV:
_console
```
$ export BASE_URL=https://host.docker.internal:5001
$ export HTTP_PORT=5002
$ export HTTPS_PORT=5001
$ export ACME_DIRECTORY_URL=https://localhost:14000/dir
$ export DATA_DIR=./tmp
$ export MIX_ENV=ce_dev
$ mix phx.server
```
I use host.docker.internal to make Pebble be able to access localhost from its container in "Docker Desktop" for Mac. For Linux machines, I think the host can be localhost with --network host added to docker run flags.

Wait for success:

Successfully received certificate.
Certificate is saved at:   /Users/x/Developer/plausible/analytics/tmp/site_encrypt/certbot/localhost_14000/config/live/host.docker.internal/fullchain.pem
Key is saved at:           /Users/x/Developer/plausible/analytics/tmp/site_encrypt/certbot/localhost_14000/config/live/host.docker.internal/privkey.pem
This certificate expires on 2029-08-30.

Visit https://host.docker.internal:5001 (you might need to add 127.0.0.1 host.docker.internal to /etc/hosts for it to be resolvable)

Tests

This PR does not require tests

Changelog

Entry has been added to changelog

Documentation

This change does not need a documentation update

Dark mode

This PR does not change the UI

config/runtime.exs

ruslandoga · 2024-08-30T08:35:42Z

config/runtime.exs

@@ -61,7 +63,13 @@ listen_ip =
  )

 # System.get_env does not accept a non string default
-port = get_var_from_path_or_env(config_dir, "PORT") || 8000
+http_port =
+  get_int_from_path_or_env(config_dir, "HTTP_PORT") ||


HTTP_PORT is added for consistency with the new HTTPS_PORT.

ruslandoga · 2024-08-30T08:36:17Z

config/runtime.exs

+  get_int_from_path_or_env(config_dir, "HTTP_PORT") ||
+    get_int_from_path_or_env(config_dir, "PORT", 8000)
+
+https_port = get_int_from_path_or_env(config_dir, "HTTPS_PORT")


Setting HTTPS_PORT enables site_encrypt so that auto-TLS is opt-in.

ruslandoga · 2024-09-01T10:57:56Z

lib/plausible_web/endpoint.ex

+        mode: :auto,
+        log_level: :notice,
+        client: :certbot,
+        domains: [domain],


I wonder if it should try to issue "www.#{domain}" as well.

I think it's OK as is for now, and if someone complains I'll add extra logic to check if www should be issued too. Plausible CE is probably mostly served from a subdomain anyway.

ruslandoga · 2024-09-09T10:29:28Z

lib/plausible/application.ex

+      PlausibleWeb.Endpoint.enable_https(https_enabled?)
+
+      if https_enabled? do
+        {SiteEncrypt.Phoenix.Endpoint, endpoint: PlausibleWeb.Endpoint}


Maybe this can be further limited to http_port==80 check since ACME issues challenges only on the default HTTP port.

ruslandoga · 2024-09-10T02:05:51Z

config/runtime.exs

  secret_key_base: secret_key_base,
  websocket_url: websocket_url,
  secure_cookie: secure_cookie

+if https_port do
+  config :plausible, PlausibleWeb.Endpoint,
+    https: [port: https_port, ip: listen_ip, cipher_suite: :compatible] ++ default_http_opts


The Compatible cipher suite supports tlsv1, tlsv1.1 and tlsv1.2.

From https://hexdocs.pm/plug/1.16.1/Plug.SSL.html#configure/1-cipher-suites

The reasoning for using this suite instead of a "strong" one is the same as in #1708 (comment)

github-actions · 2024-09-10T04:52:51Z

Preview environment👷🏼‍♀️🏗️
PR-4491

zoldar

✨

ruslandoga mentioned this pull request Aug 30, 2024

Release v2.1.2 #4483

Merged

4 tasks

ruslandoga commented Aug 30, 2024

View reviewed changes

config/runtime.exs Show resolved Hide resolved

ruslandoga commented Aug 30, 2024

View reviewed changes

ruslandoga force-pushed the auto-https branch 2 times, most recently from c368f0f to a551f4b Compare August 30, 2024 08:56

auto https

4584089

ruslandoga force-pushed the auto-https branch from 653a906 to 4584089 Compare August 30, 2024 10:27

ruslandoga marked this pull request as ready for review August 30, 2024 10:28

changelog

1a98469

ruslandoga requested review from a team August 30, 2024 10:35

ruslandoga added the self-hosting Anything self-hosted label Aug 30, 2024

ruslandoga mentioned this pull request Aug 30, 2024

Add /var/lib/plausible for easier mounts #4275

Merged

4 tasks

ruslandoga commented Sep 1, 2024

View reviewed changes

ruslandoga commented Sep 9, 2024

View reviewed changes

ruslandoga added 2 commits September 10, 2024 08:48

Merge branch 'master' into auto-https

44b5557

enable auto-tls only when http_port is 80

530c0e8

ruslandoga commented Sep 10, 2024

View reviewed changes

ruslandoga added 5 commits September 10, 2024 09:18

make erlang ssl less verbose

dd12354

simplify config

ab953f9

simplify config

fa2dac5

fix ce_dev typo

999655a

fix another typo

94024fa

ruslandoga added the preview label Sep 10, 2024

ruslandoga mentioned this pull request Sep 10, 2024

Support order_by in URL params of breakdown endpoints #4502

Merged

4 tasks

zoldar added 2 commits September 10, 2024 12:57

Merge branch 'master' into auto-https

d12dfc3

Merge branch 'master' into auto-https

9c0dea1

zoldar approved these changes Sep 10, 2024

View reviewed changes

zoldar merged commit 2180ab4 into master Sep 10, 2024
10 checks passed

zoldar deleted the auto-https branch September 10, 2024 12:15

ruslandoga mentioned this pull request Sep 11, 2024

Make CE HTTPS use current Mozilla recommendations #4568

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auto HTTPS in CE #4491

Auto HTTPS in CE #4491

ruslandoga commented Aug 30, 2024 •

edited

Loading

ruslandoga Aug 30, 2024

ruslandoga Aug 30, 2024 •

edited

Loading

ruslandoga Sep 1, 2024 •

edited

Loading

ruslandoga Sep 9, 2024 •

edited

Loading

ruslandoga Sep 10, 2024

ruslandoga Sep 10, 2024 •

edited

Loading

github-actions bot commented Sep 10, 2024

zoldar left a comment

Auto HTTPS in CE #4491

Auto HTTPS in CE #4491

Conversation

ruslandoga commented Aug 30, 2024 • edited Loading

Changes

Trying it out locally

Tests

Changelog

Documentation

Dark mode

ruslandoga Aug 30, 2024

Choose a reason for hiding this comment

ruslandoga Aug 30, 2024 • edited Loading

Choose a reason for hiding this comment

ruslandoga Sep 1, 2024 • edited Loading

Choose a reason for hiding this comment

ruslandoga Sep 9, 2024 • edited Loading

Choose a reason for hiding this comment

ruslandoga Sep 10, 2024

Choose a reason for hiding this comment

ruslandoga Sep 10, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Sep 10, 2024

zoldar left a comment

Choose a reason for hiding this comment

ruslandoga commented Aug 30, 2024 •

edited

Loading

ruslandoga Aug 30, 2024 •

edited

Loading

ruslandoga Sep 1, 2024 •

edited

Loading

ruslandoga Sep 9, 2024 •

edited

Loading

ruslandoga Sep 10, 2024 •

edited

Loading