Update TLS config

[franziskuskiefer]

Fixes https://github.com/zinfra/backend-issues/issues/1628

Note that this also disables TLS versions we don't want and enables TLS 1.3. Le me know when there's a reason why that doesn't work.

[lucendio]

1.15.12 is the nginx version that consumes this configuration. Since the work on backoffice/spar is kinda on hold, would you mind double checking whether the ciphers and TLSv1.3 are supported? (I quick research resulted in yes, but you probably have more knowledge around this)

[franziskuskiefer]

1.15.12 is the nginx version that consumes this configuration. Since the work on backoffice/spar is kinda on hold, would you mind double checking whether the ciphers and TLSv1.3 are supported? (I quick research resulted in yes, but you probably have more knowledge around this)

The openssl version installed (1.1.1g-r0) can do TLS1.3. That's at least the version I get when installing now. Not sure what's installed on the docker image ...
I can also move that 1.3 change to a separate PR if it needs more investigation.

[tiago-loureiro]

The openssl version installed (1.1.1g-r0) can do TLS1.3. That's at least the version I get when installing now. Not sure what's installed on the docker image ...
I can also move that 1.3 change to a separate PR if it needs more investigation.

It runs OpenSSL 1.1.1d 10 Sep 2019 so we should be good

[arianvp]

I don think backoffice serves its own TLS so im not sure if this change does something? isn't it terminated behind nginx-ingress-controller like all other services?

[lucendio]

I don think backoffice serves its own TLS so im not sure if this change does something? isn't it terminated behind nginx-ingress-controller like all other services?

🤔 You make an excellent point. But I guess one could argue that

a) if the image is seen as an atomic and agnostic artifact, it can run anywhere not just on an ingress terminating k8s
b) the change affects the container-global nginx configuration. Of cource, it can be overridden by mounting another 'nginx.conf' into it's very location

I guess @franziskuskiefer was just lacking of some context and instead greping around. Which is an absolute valid approach to start.

[tiago-loureiro]

I don think backoffice serves its own TLS so im not sure if this change does something? isn't it terminated behind nginx-ingress-controller like all other services?

The backoffice is not "fronted" by anything, you can see more details on the README

a) if the image is seen as an atomic and agnostic artifact, it can run anywhere not just on an ingress terminating k8s

Right, it's not running like that.

That being said there's no good reason to have a config where undesirable ciphers/tls versions are used.

[arianvp]

yeh but the backoffice currently doesn't use TLS at all; so i dont see why we even have things for it in the config. that was more my point :)