Secure Database Lab Engine

To make your work with Database Lab API secure, install and configure NGINX with a self-signed SSL certicate.

Define ${IP_OR_HOSTNAME} of your instance, using either hostname or IP address:

export IP_OR_HOSTNAME="123.45.67.89"

Install NGINX:

sudo apt-get install -y nginx openssl

Define ${YOUR_OWN_PASS} environment variable for certificate generation.

Generate SSL certificate request:

mkdir -p ~/ssl

cd ~/ssl

# TODO: Use https://github.com/suyashkumar/ssl-proxy instead.

# To generate certificates, use, for instance, Let's Encrypt

# (e.g. https://zerossl.com/free-ssl/#crt).

# Here we are generating a self-signed certificate.

openssl genrsa -des3 -passout pass:${YOUR_OWN_PASS} -out server.pass.key 2048

openssl rsa -passin pass:${YOUR_OWN_PASS} -in server.pass.key -out server.key

rm server.pass.key

# Will ask a bunch of questions which should be filled with answers.

openssl req -new -key server.key -out server.csr

Finish SSL certificate generation and configure NGINX (do not forget to set $IP_OR_HOSTNAME as described above!). Website https://nginxconfig.io/ may be also helpful when you prepare NGINX config file. Here is a basic example:

openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key \

-out server.crt

sudo mkdir -p /etc/nginx/ssl

sudo cp server.crt /etc/nginx/ssl

sudo cp server.key /etc/nginx/ssl

cat <<CONFIG > default

server {

listen 443 ssl;

ssl on;

ssl_certificate /etc/nginx/ssl/server.crt;

ssl_certificate_key /etc/nginx/ssl/server.key;

server_name ${IP_OR_HOSTNAME};

access_log /var/log/nginx/database_lab.access.log;

error_log /var/log/nginx/database_lab.error.log;

location / {

proxy_set_header X-Forwarded-For \$remote_addr;

proxy_set_header Host \$http_host;

proxy_pass "http://127.0.0.1:2345";

}

}

CONFIG

sudo cp default /etc/nginx/sites-available/default

sudo systemctl restart nginx

# See also (though here it was not used, it might be helpful):

# https://nginxconfig.io/

Now we can check the status using HTTPS connection (here we use --insecure flag to allow working with the self-signed certificate we have generated above):

curl \

--insecure \

--include \

--request GET \

--header 'Verification-Token: secret_token' \

https://${IP_OR_HOSTNAME}/status