5

Like the title suggests, I am trying to configure my server to serve traffic with HTTPS. I am already able to expose the server and receive information from it, just simply without HTTPS.

There are a few interesting details that I will get into, but this is the main goal.

  1. I have a Go server running on a Raspberry Pi on my home network that I am using as a personal API.
  2. I port-forwarded port 80 and 443 of my home network and pointed it to my Raspberry Pi's static ip address
  3. I own a domain that I am pointing to my home network IP.
  4. My go server is running on port 8088, so I use Nginx to forward requests from the base IP to my server's port.

So far this is all working perfectly, except I would like to allow my server to utilize HTTPS.

My question is I have a lot of moving parts in this setup, so what would be responsible for ensuring HTTPS:

  • The domain?
  • My Nginx config?
  • The server itself?
  • A combination of all of the above.

I am unsure.

Just looking for some direction in enabling HTTPS for this server, thanks!

2
  • 1
    Do you have certificates? May 18, 2019 at 8:39
  • You need a certificate that is connected to the domain name. Once you get a certificate, you can then add it to your Nginx config. And that is it. You can either create a self-signed certificate, buy one or just use a free certificate service. The “server” is basically just the OS in your case. May 19, 2019 at 4:23

2 Answers 2

7

Your Nginx can handle the a http and https request.

  1. Set your nginx to listen on port 80 and redirect 80 request to 443.

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name example.com www.example.com;
        return 301 https://$server_name$request_uri;
    }
    
  2. Add you certificate in your nginx and proxy the request coming from 443 to GO server.

    server {
       listen 443;
       ssl on;
       ssl_certificate /etc/ssl/ssl-bundle.crt;
       ssl_certificate_key /etc/ssl/ssl-tutorials.key;
       server_name ssl-tutorials.com;
       access_log /var/log/nginx/nginx.vhost.access.log;
       error_log /var/log/nginx/nginx.vhost.error.log;
    
       location / {
           proxy_redirect          off;
           proxy_set_header        Host            $host;
           proxy_set_header        X-Real-IP       $remote_addr;
           proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
           client_body_buffer_size 512k;
           proxy_connect_timeout   180;
           proxy_send_timeout      180;
           proxy_read_timeout      360;
           proxy_buffering         off
    
           #Proxy request to your GO app
           proxy_pass http://<ip_server>:<port>;
        }
     }
    
2
  • 6
    Maybe this answer could also elaborate on how to generate said certificates (LetsEncrypt / self-signed) as from the question, the OP seems to be ignorant of the same. May 18, 2019 at 8:48
  • Thanks for the response, utilizing certbot to generate my nginx config for me I was able to enable HTTPS. Thanks May 20, 2019 at 5:12
4

HTTPS should be handled by the nginx server, which should be listening on port 443. It can listen on port 80 as well, but it's best that either serve HTTP or redirect to HTTPS (port 443) as this is normal behavior. You do not need any DNS configuration. Applications will typically recognize default ports 80 as HTTP and 443 as HTTPS.

It's best that an application like nginx handle the difficulties of properly handling high performance HTTP and HTTPS so you don't need to think about those things for your web app (I.e. your Go API). Note that the connection between your Nginx and Go application shouldn't need to be HTTPS since they are both on the sample machine.

Check out this Linode guide on setting up an Nginx config for HTTPS and reverse proxy for a web application.

Also, with HTTPS, you need to have a keypair that's been signed by a proper authority (i.e. a certificate chain). Since this is something your just using for your own uses, you could be the proper authority and generate your own self signed certificate. But it also might be easiest to just use Let's Encrypt, which will leverage the fact you own the domain and issue you a valid certificate to use for your site (also explained in Linode guide).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .