From 67701d10ad12344a71b3c570b79ad45f2ec2a613 Mon Sep 17 00:00:00 2001 From: hobokenchicken Date: Wed, 15 Apr 2026 14:25:35 -0400 Subject: [PATCH] chore: Remove SSL cert handling - use external reverse proxy - Nginx now listens on HTTP only (port 80) - Remove SSL cert volume mounts from docker-compose - Remove SSL troubleshooting sections - Update docs to indicate SSL handled by Caddy/reverse proxy - Simplify nginx.conf to remove HTTPS server block --- README.md | 9 +----- SETUP.md | 11 ++------ docker-compose.yml | 2 -- docker/nginx/nginx.conf | 29 ++----------------- docs/INFRASTRUCTURE.md | 31 +++++---------------- docs/SETUP-INFRASTRUCTURE.md | 54 +++--------------------------------- docs/TROUBLESHOOTING.md | 32 --------------------- 7 files changed, 17 insertions(+), 151 deletions(-) diff --git a/README.md b/README.md index 91bc88c..aaa7587 100644 --- a/README.md +++ b/README.md @@ -37,16 +37,9 @@ cp .env.example .env # Edit .env with your values (see docs/SETUP-INFRASTRUCTURE.md) # 3. Create required directories -mkdir -p docker/nginx/ssl mkdir -p frontend/public -# 4. Generate SSL certificates (self-signed for local dev) -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj "/CN=localhost" - -# 5. Start with Docker Compose +# 4. Start with Docker Compose docker-compose up -d --build # 6. Initialize database (first time only) diff --git a/SETUP.md b/SETUP.md index c1cd7be..6528f88 100644 --- a/SETUP.md +++ b/SETUP.md @@ -104,20 +104,15 @@ npm run dev:frontend # Next.js on port 3000 ### 8. Production Deployment ```bash -# Setup SSL certificates (self-signed for local dev, or use real certs) -mkdir -p docker/nginx/ssl -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj "/CN=coop.hobokenchicken.com" - # Create public directory (required for build) mkdir -p frontend/public -# Deploy +# Deploy (Caddy handles SSL termination) docker-compose up -d --build ``` +**Note:** This setup runs HTTP only on port 80. Place behind Caddy or another reverse proxy for SSL termination. + ## Architecture Overview ``` diff --git a/docker-compose.yml b/docker-compose.yml index 9bdb250..16d1d59 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -96,10 +96,8 @@ services: container_name: coop-nginx ports: - "80:80" - - "443:443" volumes: - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - ./docker/nginx/ssl:/etc/nginx/ssl:ro depends_on: frontend: condition: service_started diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf index 42ef4ac..00699a1 100644 --- a/docker/nginx/nginx.conf +++ b/docker/nginx/nginx.conf @@ -33,35 +33,10 @@ http { server backend:3001; } - # HTTP server - redirect to HTTPS + # HTTP server (Caddy handles SSL termination) server { listen 80; - server_name coop.hobokenchicken.com; - - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - - location / { - return 301 https://$server_name$request_uri; - } - } - - # HTTPS server - server { - listen 443 ssl http2; - server_name coop.hobokenchicken.com; - - # SSL certificates (replace with your actual certificates) - ssl_certificate /etc/nginx/ssl/cert.pem; - ssl_certificate_key /etc/nginx/ssl/key.pem; - - # SSL settings - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers HIGH:!aNULL:!MD5; - ssl_prefer_server_ciphers on; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; + server_name _; # Security headers add_header X-Frame-Options "SAMEORIGIN" always; diff --git a/docs/INFRASTRUCTURE.md b/docs/INFRASTRUCTURE.md index 8017833..77834ab 100644 --- a/docs/INFRASTRUCTURE.md +++ b/docs/INFRASTRUCTURE.md @@ -13,13 +13,13 @@ │ CoopCredits Server │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Nginx │ │ Frontend │ │ Backend │ │ PostgreSQL │ │ -│ │ (80/443) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │ +│ │ (80) │──│ (Next.js) │──│ (Express) │──│ (5432) │ │ │ └──────────────┘ └──────────────┘ └──────┬───────┘ └──────────────┘ │ │ │ │ -│ ┌──────────────┐ ┌──────────────┐ │ ┌──────────────┐ │ -│ │ Certbot │ │ Redis │◀────────┘ │ Anchor CLI │ │ -│ │ (SSL) │ │ (6379) │ │ (Optional) │ │ -│ └──────────────┘ └──────────────┘ └──────────────┘ │ +│ ┌──────────────┐ │ ┌──────────────┐ │ +│ │ Redis │◀────────┘ │ Anchor CLI │ │ +│ │ (6379) │ │ (Optional) │ │ +│ └──────────────┘ └──────────────┘ │ └──────────────────────────────────┬──────────────────────────────────────┘ │ │ Local Network (172.20.1.0/24) @@ -132,26 +132,9 @@ sudo ufw deny 6379/tcp # Redis - Subnet: 172.20.2.0/24 - Used for: backend → Tautulli/Overseer/Plex -## SSL/TLS Setup +## SSL/TLS -### Let's Encrypt (Recommended) -```bash -# Initial certificate -docker-compose -f docker-compose.prod.yml run --rm certbot certonly \ - --webroot -w /var/www/certbot \ - -d coop.hobokenchicken.com \ - --agree-tos --no-eff-email - -# Auto-renewal (configured in docker-compose) -``` - -### Self-Signed (Testing only) -```bash -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj '/CN=coop.hobokenchicken.com' -``` +SSL/TLS is handled by an external reverse proxy (e.g., Caddy). The application stack runs HTTP only on port 80 internally. ## Monitoring and Logging diff --git a/docs/SETUP-INFRASTRUCTURE.md b/docs/SETUP-INFRASTRUCTURE.md index b84056d..a60f125 100644 --- a/docs/SETUP-INFRASTRUCTURE.md +++ b/docs/SETUP-INFRASTRUCTURE.md @@ -47,9 +47,10 @@ cd coop-credits This script will: - Test connectivity to your services (Plex, Tautulli, Overseer) - Generate a secure `.env` file -- Check SSL certificate status - Output configuration instructions +**Note:** SSL/TLS is handled by your external reverse proxy (Caddy). The application runs HTTP on port 80 internally. + ### 3. Configure Environment Edit the generated `.env` file: @@ -96,40 +97,7 @@ anchor deploy Update `SOLANA_PROGRAM_ID` in `.env` with the deployed program ID. -### 6. Setup SSL Certificates - -#### Option A: Let's Encrypt (Recommended) - -```bash -# Obtain certificate -docker-compose -f docker-compose.prod.yml run --rm certbot certonly \ - --webroot -w /var/www/certbot \ - -d coop.hobokenchicken.com \ - --agree-tos --no-eff-email - -# Update nginx config to use Let's Encrypt paths -# Edit docker/nginx/nginx.prod.conf: -# ssl_certificate /etc/letsencrypt/live/coop.hobokenchicken.com/fullchain.pem; -# ssl_certificate_key /etc/letsencrypt/live/coop.hobokenchicken.com/privkey.pem; -``` - -#### Option B: Existing Certificates - -```bash -cp /path/to/your/cert.pem docker/nginx/ssl/cert.pem -cp /path/to/your/key.pem docker/nginx/ssl/key.pem -``` - -#### Option C: Self-Signed (Testing only) - -```bash -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj '/CN=coop.hobokenchicken.com' -``` - -### 7. Deploy +### 6. Deploy ```bash ./deployment/deploy-production.sh @@ -304,20 +272,6 @@ sudo ufw enable docker-compose -f docker-compose.prod.yml exec postgres pg_isready -U coop ``` -### SSL certificate issues - -1. Check certificate: - ```bash - openssl s_client -connect coop.hobokenchicken.com:443 -servername coop.hobokenchicken.com - ``` - -2. Verify certificate paths in nginx config - -3. Check certificate expiry: - ```bash - openssl x509 -in docker/nginx/ssl/cert.pem -noout -dates - ``` - ## Maintenance ### Update Application @@ -354,7 +308,7 @@ docker-compose -f docker-compose.prod.yml restart backend ## Security Checklist - [ ] Changed all default passwords in `.env` -- [ ] SSL certificates installed and valid +- [ ] External reverse proxy (Caddy) configured for SSL - [ ] Firewall rules configured - [ ] Tautulli webhook secret set - [ ] Overseer webhook secret set diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md index 487414d..53a5c2c 100644 --- a/docs/TROUBLESHOOTING.md +++ b/docs/TROUBLESHOOTING.md @@ -123,25 +123,6 @@ solana balance solana airdrop 2 ``` -### SSL Certificate Errors - -**Error:** Browser shows certificate warnings - -**Solution:** -```bash -# Check certificate -openssl s_client -connect coop.hobokenchicken.com:443 - -# Renew Let's Encrypt -docker-compose -f docker-compose.prod.yml run --rm certbot renew - -# Or use self-signed for testing: -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj '/CN=coop.hobokenchicken.com' -``` - ### CORS Errors in Browser **Error:** `Access-Control-Allow-Origin` errors @@ -219,19 +200,6 @@ cd frontend npm install next-themes ``` -### Nginx: SSL Certificate Error - -**Error:** `cannot load certificate "/etc/nginx/ssl/cert.pem"` - -**Solution:** -```bash -mkdir -p docker/nginx/ssl -openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout docker/nginx/ssl/key.pem \ - -out docker/nginx/ssl/cert.pem \ - -subj "/CN=coop.hobokenchicken.com" -``` - ### Docker Compose: Public Directory Not Found **Error:** `failed to calculate checksum: "/app/frontend/public": not found`