mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Merge pull request #1788 from hjf288/GIT-1682

Просмотр исходного кода 
GIT-1682: Complete the SSL configuration section of the documentation…
Этот коммит содержится в:
Corey Hulen
2016-01-04 08:42:37 -06:00
родитель 8b9f9fb9c1 e419d12e23
Коммит 30ea2585bc
4 изменённых файлов: 174 добавлений и 127 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

78
doc/install/Production-Debian.md
Просмотреть файл

@@ -224,19 +224,20 @@ exit 0
* Below is a sample configuration with the minimum settings required to configure Mattermost * Below is a sample configuration with the minimum settings required to configure Mattermost
``` ```
server { server {
server_name mattermost.example.com; server_name mattermost.example.com;
location / { location / {
client_max_body_size 50M; client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN; proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://localhost:8065; proxy_pass http://10.10.10.2:8065;
} }
} }
``` ```
* Remove the existing file with * Remove the existing file with
* ``` sudo rm /etc/nginx/sites-enabled/default``` * ``` sudo rm /etc/nginx/sites-enabled/default```
@@ -264,32 +265,43 @@ exit 0
Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
Email Address []:admin@mattermost.example.com Email Address []:admin@mattermost.example.com
``` ```
1. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines 1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
* 1. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines:
``` ```
server { server {
listen 80; listen 80;
server_name mattermost.example.com; server_name mattermost.example.com;
return 301 https://$server_name$request_uri; return 301 https://$server_name$request_uri;
} }
server {
listen 443 ssl;
server_name mattermost.example.com;
ssl on;
ssl_certificate /home/mattermost/cert/mattermost.crt;
ssl_certificate_key /home/mattermost/cert/mattermost.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# add to location / above server {
location / { listen 443 ssl;
gzip off; server_name mattermost.example.com;
proxy_set_header X-Forwarded-Ssl on;
ssl on;
ssl_certificate /home/ubuntu/cert/mattermost.crt;
ssl_certificate_key /home/ubuntu/cert/mattermost.key;
ssl_dhparam /home/ubuntu/cert/dhparam.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
location / {
gzip off;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065;
}
}
``` ```

76
doc/install/Production-RHEL6.md
Просмотреть файл

@@ -124,19 +124,20 @@ enabled=1
* Below is a sample configuration with the minimum settings required to configure Mattermost * Below is a sample configuration with the minimum settings required to configure Mattermost
``` ```
server { server {
server_name mattermost.example.com; server_name mattermost.example.com;
location / { location / {
client_max_body_size 50M; client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN; proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065; proxy_pass http://10.10.10.2:8065;
} }
} }
``` ```
* Remove the existing file with: * Remove the existing file with:
* ``` sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak``` * ``` sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak```
@@ -164,32 +165,43 @@ enabled=1
Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
Email Address []:admin@mattermost.example.com Email Address []:admin@mattermost.example.com
``` ```
1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines 1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines
*
``` ```
server { server {
listen 80; listen 80;
server_name mattermost.example.com; server_name mattermost.example.com;
return 301 https://$server_name$request_uri; return 301 https://$server_name$request_uri;
} }
server {
listen 443 ssl;
server_name mattermost.example.com;
ssl on;
ssl_certificate /opt/mattermost/cert/mattermost.crt;
ssl_certificate_key /opt/mattermost/cert/mattermost.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# add to location / above server {
location / { listen 443 ssl;
gzip off; server_name mattermost.example.com;
proxy_set_header X-Forwarded-Ssl on;
ssl on;
ssl_certificate /home/ubuntu/cert/mattermost.crt;
ssl_certificate_key /home/ubuntu/cert/mattermost.key;
ssl_dhparam /home/ubuntu/cert/dhparam.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
location / {
gzip off;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065;
}
}
``` ```
## Finish Mattermost Server setup ## Finish Mattermost Server setup

76
doc/install/Production-RHEL7.md
Просмотреть файл

@@ -131,19 +131,20 @@ enabled=1
* Below is a sample configuration with the minimum settings required to configure Mattermost * Below is a sample configuration with the minimum settings required to configure Mattermost
``` ```
server { server {
server_name mattermost.example.com; server_name mattermost.example.com;
location / { location / {
client_max_body_size 50M; client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN; proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065; proxy_pass http://10.10.10.2:8065;
} }
} }
``` ```
* Remove the existing file with: * Remove the existing file with:
* ``` sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak``` * ``` sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak```
@@ -171,32 +172,43 @@ enabled=1
Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com Common Name (e.g. server FQDN or YOUR name) []:mattermost.example.com
Email Address []:admin@mattermost.example.com Email Address []:admin@mattermost.example.com
``` ```
1. Run `openssl dhparam -out dhparam.pem 4096` (it will take some time).
1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines 1. Modify the file at `/etc/nginx/conf.d/mattermost.conf` and add the following lines
*
``` ```
server { server {
listen 80; listen 80;
server_name mattermost.example.com; server_name mattermost.example.com;
return 301 https://$server_name$request_uri; return 301 https://$server_name$request_uri;
} }
server {
listen 443 ssl;
server_name mattermost.example.com;
ssl on;
ssl_certificate /opt/mattermost/cert/mattermost.crt;
ssl_certificate_key /opt/mattermost/cert/mattermost.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# add to location / above server {
location / { listen 443 ssl;
gzip off; server_name mattermost.example.com;
proxy_set_header X-Forwarded-Ssl on;
ssl on;
ssl_certificate /home/ubuntu/cert/mattermost.crt;
ssl_certificate_key /home/ubuntu/cert/mattermost.key;
ssl_dhparam /home/ubuntu/cert/dhparam.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
location / {
gzip off;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065;
}
}
``` ```
## Finish Mattermost Server setup ## Finish Mattermost Server setup

71
doc/install/Production-Ubuntu.md
Просмотреть файл

@@ -107,19 +107,20 @@ exec bin/platform
* Below is a sample configuration with the minimum settings required to configure Mattermost * Below is a sample configuration with the minimum settings required to configure Mattermost
``` ```
server { server {
server_name mattermost.example.com; server_name mattermost.example.com;
location / { location / {
client_max_body_size 50M; client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN; proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065; proxy_pass http://10.10.10.2:8065;
} }
} }
``` ```
* Remove the existing file with * Remove the existing file with
* ``` sudo rm /etc/nginx/sites-enabled/default``` * ``` sudo rm /etc/nginx/sites-enabled/default```
@@ -151,29 +152,39 @@ exec bin/platform
4. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines: 4. Modify the file at `/etc/nginx/sites-available/mattermost` and add the following lines:
``` ```
server { server {
listen 80; listen 80;
server_name mattermost.example.com; server_name mattermost.example.com;
return 301 https://$server_name$request_uri; return 301 https://$server_name$request_uri;
} }
server { server {
listen 443 ssl; listen 443 ssl;
server_name mattermost.example.com; server_name mattermost.example.com;
ssl on;
ssl_certificate /home/ubuntu/cert/mattermost.crt;
ssl_certificate_key /home/ubuntu/cert/mattermost.key;
ssl_dhparam /home/ubuntu/cert/dhparam.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# add to location / above ssl on;
location / { ssl_certificate /home/ubuntu/cert/mattermost.crt;
gzip off; ssl_certificate_key /home/ubuntu/cert/mattermost.key;
proxy_set_header X-Forwarded-Ssl on; ssl_dhparam /home/ubuntu/cert/dhparam.pem;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
location / {
gzip off;
proxy_set_header X-Forwarded-Ssl on;
client_max_body_size 50M;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_pass http://10.10.10.2:8065;
}
}
``` ```