5cd5332397
This commit adds: - Database migrations for app_delta fingerprints and client certificates - Scripts for certificate generation and fingerprint backfilling - Comprehensive security audit reports and findings tracking - Implementation documentation for certificate authentication - Test utilities for certificate renewal and fingerprinting - GE-ENFORCE collector fix documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
56 lines
1.9 KiB
Nginx Configuration File
56 lines
1.9 KiB
Nginx Configuration File
events {
|
|
worker_connections 2048;
|
|
}
|
|
|
|
http {
|
|
upstream flask_backend {
|
|
server api:5001;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name _;
|
|
|
|
# Server certificate (HTTPS)
|
|
ssl_certificate /etc/nginx/certs/server.crt;
|
|
ssl_certificate_key /etc/nginx/certs/server.key;
|
|
|
|
# Client certificate validation (optional during rollout)
|
|
# optional_no_ca: accept cert but don't validate against CA
|
|
# Flask validates fingerprint against database
|
|
ssl_verify_client optional_no_ca;
|
|
|
|
# Increase timeouts for long-polling agents
|
|
proxy_connect_timeout 90s;
|
|
proxy_send_timeout 90s;
|
|
proxy_read_timeout 90s;
|
|
|
|
# All routes
|
|
location / {
|
|
proxy_pass http://flask_backend;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
|
|
# Pass real client IP (not nginx IP)
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Host $host;
|
|
|
|
# Pass client certificate fingerprint to Flask
|
|
# SECURITY NOTE: $ssl_client_fingerprint outputs SHA1 (40 hex chars),
|
|
# not SHA256. This is a known nginx limitation. SHA1 is acceptable for
|
|
# certificate fingerprinting (not signing) in air-gapped environments
|
|
# with short-lived certs and revocation support.
|
|
# Format: "AB:CD:EF:..." (colon-separated hex, normalized in Flask)
|
|
# Future SHA256: requires custom nginx module or migrate to IIS
|
|
proxy_set_header X-Client-Cert-Fingerprint $ssl_client_fingerprint;
|
|
proxy_set_header X-Client-Cert-S-DN $ssl_client_s_dn;
|
|
}
|
|
|
|
# Access log includes client cert status
|
|
access_log /dev/stdout combined;
|
|
error_log /dev/stderr warn;
|
|
}
|
|
}
|