add ssl config

This commit is contained in:
virusdefender 2017-06-14 16:26:06 +08:00
parent 4054dfa41c
commit fc635a3696
2 changed files with 37 additions and 1 deletions

View File

@ -52,5 +52,34 @@ http {
proxy_set_header Host $host;
}
}
server {
listen 443 ssl http2 default_server;
server_name _;
ssl_certificate /code/ssl/server.crt;
ssl_certificate_key /code/ssl/server.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
client_max_body_size 200M;
location /static/upload {
expires max;
alias /code/upload;
}
location /static {
etag off;
expires max;
alias /code/static/release;
}
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
}
}
}

View File

@ -3,9 +3,16 @@ if [ ! -f "/code/oj/custom_settings.py" ]; then
cp /code/oj/custom_settings.example.py /code/oj/custom_settings.py
echo "SECRET_KEY=\"`cat /dev/urandom | head -1 | md5sum | head -c 32`\"" >> /code/oj/custom_settings.py
fi
ca_base_dir="/code/ssl"
if [ ! -f "$ca_base_dir/server.key" ]; then
openssl req -x509 -newkey rsa:2048 -keyout "$ca_base_dir/server.key" -out "$ca_base_dir/server.crt" -days 1000 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=Beijing OnlineJudge Technology Co., Ltd./OU=Service Infrastructure Department/CN=`hostname`" -nodes
fi
find /code -name "*.pyc" -delete
# python -m compileall /code
chown -R nobody:nogroup /code/log /code/test_case /code/upload
chown -R nobody:nogroup /code/log /code/test_case /code/upload /code/ssl
cd /code
n=0
until [ $n -ge 5 ]