Setup behind Nginx reverse proxy

Packages

Install Nginx and Let’s Encrypt Certbot:

apt install nginx certbot

Nginx

/etc/nginx/snippets/ssl/common.conf:

# A universal location overlay for the Let's Encrypt ACME challenge protocol
location /.well-known {
    alias /var/www/html/.well-known;
}

# Enable session resumption to improve https performance
# http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 5m;

# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
# openssl dhparam -out /etc/nginx/dhparam.pem 2048
ssl_dhparam /etc/nginx/dhparam.pem;

# Enable server-side protection from BEAST attacks
# http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
ssl_prefer_server_ciphers on;

# Disable SSLv3 (enabled by default since nginx 0.8.19) since it's less secure than TLS
# http://en.wikipedia.org/wiki/Secure_Sockets_Layer
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

# Chrome says "obsolete cipher suite" [system default]
#ssl_ciphers AES:HIGH:!ADH:!MD5;

# Chrome says "obsolete" to both cipher suites [janosch]
#ssl_ciphers TLSv1.2+HIGH+AES256:TLSv1+HIGH+AES256:@STRENGTH:!kECDHe:!aECDSA:!aNULL:!eNULL:!PSK:!SRP:!DSS;
#ssl_ciphers TLSv1.2+HIGH+AES256:TLSv1.2+HIGH+AES128:TLSv1+HIGH+AES256:TLSv1+HIGH+AES128:@STRENGTH:!kECDHe:!aECDSA:!aNULL:!eNULL:!PSK:!SRP:!DSS;

# Ciphers chosen for forward secrecy and compatibility, Chrome says "modern cipher suite"
# http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
#ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
# Without RC4:
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';

# These are very agressive rules
# https://www.scalescale.com/tips/nginx/hardening-nginx-ssl-tsl-configuration/
#ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';

# Communicate with encryption only
#add_header Strict-Transport-Security max-age=15768000;
#add_header Strict-Transport-Security max-age=5;

/etc/nginx/snippets/ssl/kotori.example.org.conf:

# SSL certificate and key file
ssl_certificate     /etc/letsencrypt/live/kotori.example.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/kotori.example.org/privkey.pem;

# Redirect all requests to https
if ($server_port = 80) {
    #rewrite ^ https://$host$request_uri;
    rewrite (.*) https://$http_host$1;
}

/etc/nginx/sites-available/kotori.example.org.conf:

server {

    # Your server name
    server_name kotori.example.org;

    # Listen on regular webserver port
    listen 80;

    # Enable SSL
    listen 443 ssl;
    # Best-practice SSL configuration
    include snippets/ssl/common.conf;
    #include snippets/ssl/kotori.example.org.conf;

    # Configure Kotori and friends
    include snippets/kotori-daq.conf;

    # Redirect "/" to Grafana
    location = / {
        rewrite ^ /grafana/ redirect;
    }

    # Log files
    access_log /var/log/nginx/kotori.example.org.access.log combined;
    error_log /var/log/nginx/kotori.example.org.error.log;

    # Performance parameters
    # Relax "414 Request-URI Too Large"
    large_client_header_buffers 6 16k;

}

/etc/nginx/snippets/kotori-daq.conf:

# Serve Grafana
location /grafana/ {
    proxy_set_header   Host $host;

    rewrite  ^/grafana/(.*)  /$1 break;
    proxy_pass http://localhost:3000;


    # Performance parameters

    # Relax "413 Request Entity Too Large"
    client_max_body_size 20M;

    # If upstream is slow
    proxy_send_timeout          5m;
    proxy_read_timeout          5m;

    # If downstream is slow
    #client_header_timeout 3m;
    client_body_timeout 5m;
    send_timeout 5m;
}

# Serve Kotori HTTP API
location /api {
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP          $remote_addr;
    proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto  $scheme;

    #rewrite  ^//(.*)  /$1 break;
    proxy_pass http://localhost:24642/api;


    # Performance parameters

    # Relax "413 Request Entity Too Large"
    client_max_body_size 20M;

    # Relax "414 Request-URI Too Large"
    large_client_header_buffers 6 16k;

    # If upstream is slow
    proxy_send_timeout          5m;
    proxy_read_timeout          5m;

    # If downstream is slow
    #client_header_timeout 3m;
    client_body_timeout 5m;
    send_timeout 5m;
}

Grafana

/etc/grafana/grafana.ini:

[server]

# Protocol (http or https)
protocol = http

# The ip address to bind to, empty will bind to all interfaces
http_addr = localhost

# The public facing domain name used to access grafana from a browser
domain = kotori.example.org

# The full public facing url
root_url = %(protocol)s://%(domain)s/grafana/

systemctl restart grafana-server

Let’s Encrypt

ln -sr /etc/nginx/sites-available/weather.hiveeyes.org.conf /etc/nginx/sites-enabled/

openssl dhparam -out /etc/nginx/dhparam.pem 2048

nginx -t
systemctl reload nginx

certbot register --email 'operations@example.org'
certbot certonly --webroot --domains weather.e-habit.at --webroot-path /var/www/html