From 874873e7278f232ebb41a6f267ce7aaf0ab9eddc Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Sun, 7 Apr 2024 20:34:20 +0200
Subject: [PATCH] board/common: add nginx HTTPS server, with dependency on
 mkcert

Refactor setup to automatically redirect http -> https, dropping
the /browse location for now.

Also, log to syslog, which has log rotation.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 board/common/netbrowse.conf                   |  4 ++
 board/common/nginx.conf                       | 43 ++++++-------------
 board/common/post-build.sh                    |  1 +
 board/common/ssl.conf                         | 12 ++++++
 .../skeleton/etc/finit.d/available/nginx.conf |  2 +-
 5 files changed, 31 insertions(+), 31 deletions(-)
 create mode 100644 board/common/ssl.conf

diff --git a/board/common/netbrowse.conf b/board/common/netbrowse.conf
index f6db335a..b7528575 100644
--- a/board/common/netbrowse.conf
+++ b/board/common/netbrowse.conf
@@ -1,5 +1,9 @@
 proxy_pass http://127.0.0.1:8000;
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection 'upgrade';
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
+proxy_redirect off;
diff --git a/board/common/nginx.conf b/board/common/nginx.conf
index 9946f78e..169ad179 100644
--- a/board/common/nginx.conf
+++ b/board/common/nginx.conf
@@ -1,3 +1,4 @@
+user  www-data www-data;
 worker_processes  1;
 
 events {
@@ -20,11 +21,12 @@ http {
         listen       80;
         listen       [::]:80;
         server_name  _;
+	return 301 https://$host$request_uri;
+    }
 
-        location / {
-            root   html;
-            index  index.html index.htm;
-        }
+    server {
+	include      ssl.conf;
+        server_name  _;
 
         #error_page  404              /404.html;
 
@@ -35,40 +37,21 @@ http {
             root   html;
         }
 
-        location /browse {
-	    include netbrowse.conf;
+        location / {
+            root   html;
+            index  index.html index.htm;
         }
     }
 
     server {
-	listen 80;
-	listen [::]:80;
-	server_name network.local;
+	include      ssl.conf;
+	server_name  network.local;
 
         location / {
 	    include netbrowse.conf;
     	}
     }
 
-    #
-    # HTTPS server
-    #
-    # server {
-    #    listen       443 ssl;
-    #    server_name  localhost;
-
-    #    ssl_certificate      cert.pem;
-    #    ssl_certificate_key  cert.key;
-
-    #    ssl_session_cache    shared:SSL:1m;
-    #    ssl_session_timeout  5m;
-
-    #    ssl_ciphers  HIGH:!aNULL:!MD5;
-    #    ssl_prefer_server_ciphers  on;
-
-    #    location / {
-    #        root   html;
-    #        index  index.html index.htm;
-    #    }
-    # }
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
 }
diff --git a/board/common/post-build.sh b/board/common/post-build.sh
index 16994832..b28c377a 100755
--- a/board/common/post-build.sh
+++ b/board/common/post-build.sh
@@ -89,5 +89,6 @@ grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
 if [ -n "$BR2_PACKAGE_NGINX" ]; then
     cp "$common/netbrowse.conf" "$TARGET_DIR/etc/nginx/"
     cp "$common/nginx.conf" "$TARGET_DIR/etc/nginx/"
+    cp "$common/ssl.conf" "$TARGET_DIR/etc/nginx/"
     ln -sf ../available/nginx.conf "$TARGET_DIR/etc/finit.d/enabled/nginx.conf"
 fi
diff --git a/board/common/ssl.conf b/board/common/ssl.conf
new file mode 100644
index 00000000..b518e087
--- /dev/null
+++ b/board/common/ssl.conf
@@ -0,0 +1,12 @@
+listen       443 ssl;
+listen       [::]:443 ssl;
+
+ssl_certificate      /etc/ssl/certs/self-signed.crt;
+ssl_certificate_key  /etc/ssl/private/self-signed.key;
+
+ssl_protocols        TLSv1.3 TLSv1.2;
+ssl_ciphers          HIGH:!aNULL:!MD5;
+ssl_prefer_server_ciphers  on;
+
+ssl_session_cache    shared:SSL:1m;
+ssl_session_timeout  5m;
diff --git a/package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf b/package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf
index 36b85b48..dbf1fdd3 100644
--- a/package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf
+++ b/package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf
@@ -1 +1 @@
-service [2345] env:-/etc/default/nginx nginx -g 'daemon off;' $NGINX_ARGS -- Web server
+service [2345] <usr/mkcert> env:-/etc/default/nginx nginx -g 'daemon off;' $NGINX_ARGS -- Web server