CODEWITHSUNDEEP
pythonnginxflask
OWADVL
OWADVL

Reputation: 11134

Serve flask python on https and another port without https

What I'm trying to accomplish. Have a domain on https. Check. it's working ok using the following config. The flask app runs on port 1337 -> nginx takes it -> serves it though https. Everything is working nicely

Now I want to run another app, on port 1338 let's say. But if I do this, the browser (chrome) automatically redirects it to https. I want: http://example.com:1338 .... to run ok I get: https://example.com:1338 ... error certificate

My question is: how can I make the other app (on port 1338) either work with https:// or to work with http://

Here's my config...

server {
        listen 80 default_server;
        listen [::]:80 default_server;


        root /home/cleverbots;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name _;



        # SSL configuration
        #
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;

        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        # Disable preloading HSTS for now.  You can use the commented out header line that includes
        # the "preload" directive if you understand the implications.
        #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        ssl_dhparam /xxxxxx/dhparam.pem;




        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }


        location / {
                try_files $uri @tornado;
        }

        location @tornado {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1337;
        }



}

Upvotes: 0

Views: 3686

Answers (1)

Andrew Grasso
Andrew Grasso

Reputation: 156

The answer to your question depends on what exactly you want the user experience to be.

As I understand your goal, you only have one domain (example.com). Your first app, (I'm going to call it app1337) is running on port 1337 and you can access in a browser at https://example.com/. Now you want to add another app (app1338) that you want to be able to access at https://example.com:1338/. The problem here is that only one service can run on a given port on a given interface. This can work, but means that you have to be really careful to make sure that your flask app only listens on loopback (127.0.0.1) and Nginx only listens on your Ethernet interface. If not, you'll get "socket already in use" errors. I would recommend instead using something else like 8338 in Nginx to avoid this confusion.

The fastest solution I can see would be to leave your existing server block exactly as is. Duplicate the entire thing, and in the new block:

  1. Change the 2 listen 443 lines to the port you want to use in browser (8338).
  2. Remove the listen 80 lines or, if you want to serve the app on both ssl and non-ssl, change the port to the non-ssl port you want to use.
  3. Change your proxy_pass line to point to your second flask app.

Like Keenan, I would recommend you use subdomains to sort your traffic. Something like https://app1337.example.com/ and https://app1338.example.com/ to make for a better user experience. To do this, duplicate the server block as above, but this time leave the ports the same, but change the "server_name" directive in each block to match the domain. Remove all of the "default_server" parts from the listen directives.

As an example:

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name app1337.example.com;

        # SSL configuration 
        # Certificate and key for "app1337.example.com"
        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        # The rest of the ssl stuff is common and can be moved to a shared file and included
        # in whatever blocks it is needed.
        include sslcommon.conf;

        root /home/cleverbots;
        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }

        location / {
                try_files $uri @tornado;
        }

        location @tornado {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1337;
        }
}
server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name app1338.example.com;

        # SSL configuration 
        # Certificate and key for "app1338.example.com"
        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        # The rest of the ssl stuff is common and can be moved to a shared file and included
        # in whatever blocks it is needed.
        include sslcommon.conf;

        ## This might be different for app1338
        root /home/cleverbots;
        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        ## This might be different for app1338
        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }

        location / {
                try_files $uri @app1338;
        }

        location @app1338 {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1338;
        }
}

Upvotes: 2

Related Questions