NGINX Reverse Proxy & SSL/TLS Configuration¶

Client (HTTPS :443)
    │
    ▼
┌──────────┐
│  NGINX   │  SSL termination, static files, security headers
│  :443    │
└────┬─────┘
     │ HTTP (internal)
     ├──────────────────► Faraday API    (localhost:5985/_api/)
     └──────────────────► Socket.IO      (localhost:5985/socket.io)

sudo apt install nginx

sudo dnf install nginx

sudo systemctl enable nginx
sudo systemctl start nginx

# Generate private key
sudo openssl genrsa -out /etc/ssl/faraday.key 2048

# Create certificate signing request
sudo openssl req -new -key /etc/ssl/faraday.key -out /etc/ssl/faraday.csr

# Generate self-signed certificate (valid 365 days)
sudo openssl x509 -req -days 365 \
  -in /etc/ssl/faraday.csr \
  -signkey /etc/ssl/faraday.key \
  -out /etc/ssl/faraday.crt

# Set permissions
sudo chmod 600 /etc/ssl/faraday.key
sudo chmod 644 /etc/ssl/faraday.crt

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d faraday.example.com

faraday-manage generate-nginx-config \
  --fqdn faraday.example.com \
  --port 5985 \
  --ssl-certificate /etc/ssl/faraday.crt \
  --ssl-key /etc/ssl/faraday.key

# Cache expiry map for static assets
map $sent_http_content_type $expires {
    default                    off;
    text/html                  max;
    text/css                   max;
    application/javascript     max;
    ~image/                    max;
}

server {
    server_name faraday.example.com;
    listen 443 ssl;

    # --- Security Headers ---
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options nosniff;

    # --- Upload Limit ---
    # Maximum file upload size (reports, evidence).
    # Increase if you upload large reports.
    client_max_body_size 500M;

    # --- SSL Configuration ---
    ssl_session_cache shared:SSL:50m;
    ssl_certificate     /etc/ssl/faraday.crt;
    ssl_certificate_key /etc/ssl/faraday.key;

    # --- Compression ---
    gzip on;
    gzip_types application/javascript text/css;
    expires $expires;

    index index.html index.htm;

    # --- Frontend Static Files ---
    # For bare-metal installations, serve the frontend directly.
    # Adjust the path to match your Python installation.
    location / {
        alias /opt/faraday/lib/python3.11/site-packages/faraday/server/www/;
        try_files $uri $uri/ /index.html;
    }

    # --- API Proxy ---
    location /_api {
        proxy_pass http://127.0.0.1:5985/_api;
        proxy_redirect http:// $scheme://;
        proxy_read_timeout 300;
        proxy_cookie_path / "/; secure";

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # --- WebSocket Proxy (Socket.IO) ---
    location /socket.io {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass http://127.0.0.1:5985;
    }
}

# HTTP to HTTPS redirect
server {
    server_name faraday.example.com;
    listen 80;
    listen [::]:80;

    if ($host = faraday.example.com) {
        return 301 https://$host$request_uri;
    }

    return 404;
}

sudo ln -s /etc/nginx/sites-available/faraday /etc/nginx/sites-enabled/faraday
sudo nginx -t          # Test configuration
sudo systemctl reload nginx

sudo nginx -t          # Test configuration
sudo systemctl reload nginx

location / {
    proxy_pass http://127.0.0.1:5985/;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

faraday-manage openapi-swagger --server https://faraday.example.com

proxy_read_timeout 600;  # 10 minutes for large imports

# With multitenant prefix "tenant1":
location /tenant1/ {
    try_files $uri $uri/ /index.html;
}

location /tenant1/_api/ {
    proxy_pass http://localhost:5985/_api/;
    # ... same proxy headers
}

location /tenant1/socket.io {
    # ... same WebSocket proxy
    proxy_pass http://localhost:5985;
}

# Check server status
systemctl status faraday-server

# Check if port is listening
ss -tlnp | grep 5985

client_max_body_size 500M;

127.0.0.1    faraday.local

sudo nginx -t