Skip to content

Commit 6bbb068

Browse files
martinrebomartinrebo
committed
🐛 fix(aws): Add ssl certificate to EC2 + nginx
1 parent 4f3e04c commit 6bbb068

File tree

7 files changed

+944
-13
lines changed

7 files changed

+944
-13
lines changed

‎.github/workflows/ci-cd.yml‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ jobs:
172172
NODE_ENV: production
173173
EXPO_PUBLIC_SUPABASE_URL: ${{ secrets.EXPO_PUBLIC_SUPABASE_URL }}
174174
EXPO_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.EXPO_PUBLIC_SUPABASE_ANON_KEY }}
175-
EXPO_PUBLIC_API_URL: http://56.228.14.41
175+
EXPO_PUBLIC_API_URL: https://api.lab1.warteamx.com
176176
EXPO_PUBLIC_APP_VERSION: ${{ needs.release.outputs.new-release-version }}
177177
EXPO_PUBLIC_BUILD_NUMBER: ${{ github.run_number }}
178178
EXPO_PUBLIC_BUILD_DATE: ${{ github.event.head_commit.timestamp }}
@@ -306,17 +306,17 @@ jobs:
306306
sudo docker stop lab1-todoapp-server || true
307307
sudo docker rm lab1-todoapp-server || true
308308
309-
# Run new container with versioned tag
309+
# Run new container with versioned tag (Nginx handles port 80/443)
310310
sudo docker run -d \
311311
--name lab1-todoapp-server \
312312
--restart unless-stopped \
313-
-p 80:3000 \
313+
-p 3000:3000 \
314314
-e NODE_ENV=production \
315315
-e PORT=3000 \
316316
-e SUPABASE_DB_URL="${{ secrets.SUPABASE_DB_URL }}" \
317317
-e SUPABASE_KEY="${{ secrets.SUPABASE_KEY }}" \
318318
-e SUPABASE_URL="${{ secrets.SUPABASE_URL }}" \
319-
-e ALLOWED_ORIGINS="http://56.228.14.41,https://lab1.warteamx.com,http://lab1-todoapp.s3-website.eu-north-1.amazonaws.com" \
319+
-e ALLOWED_ORIGINS="https://api.lab1.warteamx.com,https://lab1.warteamx.com,http://lab1-todoapp.s3-website.eu-north-1.amazonaws.com" \
320320
lab1-todoapp-server:${{ needs.release.outputs.new-release-version }}
321321
322322
# Clean up old images (keep latest 3 versions)
@@ -329,22 +329,33 @@ jobs:
329329
echo "📦 Released Version: ${{ needs.release.outputs.new-release-version }}"
330330
echo "🏗️ Build Number: ${{ github.run_number }}"
331331
echo "🌐 Client: http://${{ secrets.S3_BUCKET }}.s3-website.eu-north-1.amazonaws.com"
332-
echo "🖥️ Server: http://${{ secrets.EC2_HOST }}/api"
333-
echo "🔍 Health endpoint: http://${{ secrets.EC2_HOST }}/api/health"
332+
echo "🖥️ Server: https://api.lab1.warteamx.com/api"
333+
echo "🔍 Health endpoint: https://api.lab1.warteamx.com/api/health"
334334
335335
- name: 🔍 Health Check
336336
run: |
337337
echo "⏳ Waiting 30 seconds for server to start..."
338338
sleep 30
339339
340-
echo "🔍 Checking server health..."
341-
if curl -f -s http://${{ secrets.EC2_HOST }}/api/health; then
342-
echo "✅ Server health check passed"
340+
echo "🔍 Checking server health via HTTPS..."
341+
if curl -f -s https://api.lab1.warteamx.com/api/health; then
342+
echo "✅ HTTPS server health check passed"
343343
344344
echo "🔍 Checking version endpoint..."
345-
curl -s http://${{ secrets.EC2_HOST }}/api/version || echo "Version endpoint not available"
345+
curl -s https://api.lab1.warteamx.com/api/version || echo "Version endpoint not available"
346346
else
347-
echo "❌ Server health check failed"
348-
echo "📋 Checking server logs..."
349-
exit 1
347+
echo "❌ HTTPS server health check failed"
348+
echo "🔍 Checking if container is running..."
349+
350+
# Check container status on EC2 using secrets
351+
CONTAINER_STATUS=$(ssh -i ~/.ssh/lab1-todoapp-key.pem -o StrictHostKeyChecking=no [email protected] \
352+
'sudo docker ps --filter name=lab1-todoapp-server --format "{{.Status}}"' 2>/dev/null || echo "failed to connect")
353+
354+
if [[ "$CONTAINER_STATUS" == *"Up"* ]]; then
355+
echo "✅ Container is running: $CONTAINER_STATUS"
356+
echo "⚠️ HTTPS might need a few more seconds to stabilize"
357+
else
358+
echo "❌ Container issue: $CONTAINER_STATUS"
359+
exit 1
360+
fi
350361
fi

‎docs/ai-generated/HTTPS_SETUP_SUMMARY.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# HTTPS Setup Summary
2+
3+
## ✅ Completed Tasks
4+
5+
### 1. Documentation Created
6+
- ✅ **NGINX_HTTPS_SETUP.md** - Comprehensive guide with step-by-step instructions
7+
- ✅ **MANUAL_NGINX_SETUP.md** - Manual command-by-command setup guide
8+
9+
### 2. Security Group Configuration
10+
- ✅ **Verified security group sg-0897516bc7993d832** has required ports:
11+
- Port 80 (HTTP) - for Let's Encrypt validation and redirects
12+
- Port 443 (HTTPS) - for SSL traffic
13+
- Port 22 (SSH) - for remote access
14+
15+
### 3. Setup Scripts Created
16+
- ✅ **setup-nginx-https.sh** - Automated installation script for EC2
17+
- ✅ **deploy-nginx-https.sh** - Local deployment script (needs key path update)
18+
- ✅ **setup-https-security-group.sh** - Security group configuration script
19+
20+
### 4. CI/CD Pipeline Updated
21+
- ✅ **Updated Docker port mapping** from 80:3000 to 3000:3000 (Nginx handles 80/443)
22+
- ✅ **Updated API URL** from http://56.228.14.41 to https://api.lab1.warteamx.com
23+
- ✅ **Updated CORS origins** to include HTTPS domains
24+
- ✅ **Updated health checks** to use HTTPS endpoints with HTTP fallback
25+
26+
## 🚀 Next Steps
27+
28+
### On your EC2 instance (56.228.14.41):
29+
30+
You can choose one of these methods:
31+
32+
#### Option A: Automated Setup (Recommended)
33+
```bash
34+
# SSH into your EC2 instance
35+
ssh -i your-key.pem [email protected]
36+
37+
# Download the setup script
38+
wget https://raw.githubusercontent.com/warteamx/lab1-todoApp/main/scripts/setup-nginx-https.sh
39+
40+
# Make it executable and run
41+
chmod +x setup-nginx-https.sh
42+
./setup-nginx-https.sh
43+
```
44+
45+
#### Option B: Manual Setup
46+
Follow the step-by-step commands in `/docs/ai-generated/MANUAL_NGINX_SETUP.md`
47+
48+
#### Option C: Local Deployment Script
49+
```bash
50+
# Update the key path in deploy-nginx-https.sh
51+
# Then run from your local machine:
52+
./scripts/deploy-nginx-https.sh
53+
```
54+
55+
### Prerequisites Check
56+
Before running the setup, ensure:
57+
58+
1. **Domain DNS**: Make sure `api.lab1.warteamx.com` points to `56.228.14.41`
59+
```bash
60+
nslookup api.lab1.warteamx.com
61+
```
62+
63+
2. **Node.js Server**: Ensure your Node.js server is running on port 3000
64+
```bash
65+
curl http://56.228.14.41:3000/api/health
66+
```
67+
68+
## 🎯 Expected Results
69+
70+
After setup completion, you should have:
71+
72+
- ✅ **HTTPS API**: https://api.lab1.warteamx.com/api/health
73+
- ✅ **Swagger UI**: https://api.lab1.warteamx.com/api-docs/
74+
- ✅ **HTTP Redirect**: http://api.lab1.warteamx.com → https://api.lab1.warteamx.com
75+
- ✅ **Automatic SSL Renewal**: Certificates renew automatically every 90 days
76+
- ✅ **Security Headers**: HSTS, XSS protection, etc.
77+
78+
## 🔧 Troubleshooting
79+
80+
If you encounter issues:
81+
82+
1. **Check domain resolution**:
83+
```bash
84+
dig +short api.lab1.warteamx.com
85+
```
86+
87+
2. **Check Node.js server**:
88+
```bash
89+
sudo docker ps
90+
curl http://localhost:3000/api/health
91+
```
92+
93+
3. **Check Nginx status**:
94+
```bash
95+
sudo systemctl status nginx
96+
sudo nginx -t
97+
```
98+
99+
4. **Check SSL certificate**:
100+
```bash
101+
sudo certbot certificates
102+
```
103+
104+
## 💰 Cost Impact
105+
106+
- **Removed**: AWS ALB (~$16/month)
107+
- **Added**: $0 (Nginx + Let's Encrypt are free)
108+
- **Savings**: ~$16/month (~$192/year)
109+
110+
## 📚 Resources
111+
112+
- **Full Documentation**: `/docs/ai-generated/NGINX_HTTPS_SETUP.md`
113+
- **Manual Commands**: `/docs/ai-generated/MANUAL_NGINX_SETUP.md`
114+
- **Setup Scripts**: `/scripts/`
115+
- **Let's Encrypt Docs**: https://certbot.eff.org/docs/
116+
- **Nginx Docs**: https://nginx.org/en/docs/

‎docs/ai-generated/MANUAL_NGINX_SETUP.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Manual Nginx HTTPS Setup Commands
2+
3+
If you prefer to run the commands manually instead of using the script, here are the step-by-step commands:
4+
5+
## Prerequisites
6+
- Make sure your domain `api.lab1.warteamx.com` points to `56.228.14.41`
7+
- Make sure your Node.js server is running on port 3000
8+
9+
## Step 1: SSH into your EC2 instance
10+
```bash
11+
ssh -i your-key.pem [email protected]
12+
```
13+
14+
## Step 2: Update system and install packages
15+
```bash
16+
sudo apt update && sudo apt upgrade -y
17+
sudo apt install nginx -y
18+
sudo apt install certbot python3-certbot-nginx -y
19+
```
20+
21+
## Step 3: Start Nginx
22+
```bash
23+
sudo systemctl start nginx
24+
sudo systemctl enable nginx
25+
```
26+
27+
## Step 4: Create Nginx configuration
28+
```bash
29+
sudo nano /etc/nginx/sites-available/lab1-api
30+
```
31+
32+
Paste this configuration:
33+
```nginx
34+
server {
35+
listen 80;
36+
server_name api.lab1.warteamx.com;
37+
38+
# Security headers
39+
add_header X-Frame-Options "SAMEORIGIN" always;
40+
add_header X-Content-Type-Options "nosniff" always;
41+
add_header X-XSS-Protection "1; mode=block" always;
42+
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
43+
44+
# Proxy settings
45+
location / {
46+
proxy_pass http://localhost:3000;
47+
proxy_http_version 1.1;
48+
proxy_set_header Upgrade $http_upgrade;
49+
proxy_set_header Connection 'upgrade';
50+
proxy_set_header Host $host;
51+
proxy_set_header X-Real-IP $remote_addr;
52+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
53+
proxy_set_header X-Forwarded-Proto $scheme;
54+
proxy_cache_bypass $http_upgrade;
55+
56+
# Timeouts
57+
proxy_connect_timeout 60s;
58+
proxy_send_timeout 60s;
59+
proxy_read_timeout 60s;
60+
}
61+
62+
# Health check endpoint
63+
location /api/health {
64+
proxy_pass http://localhost:3000/api/health;
65+
access_log off;
66+
}
67+
68+
# Let's Encrypt challenge location
69+
location /.well-known/acme-challenge/ {
70+
root /var/www/html;
71+
}
72+
}
73+
```
74+
75+
## Step 5: Enable the site
76+
```bash
77+
sudo ln -sf /etc/nginx/sites-available/lab1-api /etc/nginx/sites-enabled/
78+
sudo rm -f /etc/nginx/sites-enabled/default
79+
sudo nginx -t
80+
sudo systemctl reload nginx
81+
```
82+
83+
## Step 6: Test HTTP proxy
84+
```bash
85+
curl http://localhost/api/health
86+
```
87+
88+
## Step 7: Obtain SSL certificate
89+
```bash
90+
sudo certbot --nginx -d api.lab1.warteamx.com
91+
```
92+
93+
Follow the prompts:
94+
1. Enter email: [email protected] (or your email)
95+
2. Agree to terms: Y
96+
3. Share email with EFF: Y or N (your choice)
97+
4. Redirect HTTP to HTTPS: 2 (Yes, redirect)
98+
99+
## Step 8: Test HTTPS
100+
```bash
101+
curl https://api.lab1.warteamx.com/api/health
102+
```
103+
104+
## Step 9: Set up automatic renewal
105+
```bash
106+
sudo systemctl enable certbot.timer
107+
sudo systemctl start certbot.timer
108+
sudo certbot renew --dry-run
109+
```
110+
111+
## Verification
112+
Your API should now be available at:
113+
- https://api.lab1.warteamx.com/api/health
114+
- https://api.lab1.warteamx.com/api-docs/
115+
116+
## Troubleshooting Commands
117+
```bash
118+
# Check Nginx status
119+
sudo systemctl status nginx
120+
121+
# Check SSL certificates
122+
sudo certbot certificates
123+
124+
# Test Nginx configuration
125+
sudo nginx -t
126+
127+
# View Nginx logs
128+
sudo tail -f /var/log/nginx/error.log
129+
sudo tail -f /var/log/nginx/access.log
130+
131+
# Restart services
132+
sudo systemctl restart nginx
133+
```

0 commit comments

Comments
 (0)