<div dir="ltr"><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div dir="ltr">On Thu, Oct 22, 2015 at 12:55 PM, Brian E Chapman <span dir="ltr"><<a href="mailto:Brian.Chapman@utah.edu" target="_blank">Brian.Chapman@utah.edu</a>></span> wrote:<br></div></div></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hi Zach,</div>
<div><br>
</div>
<div>I’m trying to increase the volume for your girder-users digest. I’ve got a couple of boneheaded questions, primarily related to my not being too familiar with nginx.</div>
<div><br>
</div>
<div>First, would you run the nginx server within the Girder docker container so that the container is serving up the web data over https or would you run the nginx server on the host machine and have the host redirect what the container is serving?</div></div></blockquote><div><br></div><div>Hm, I suppose either would work, but I would probably have nginx inside the container if this is a fixed deployment rather than something meant to be reusable.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div><br>
</div>
<div>Second, I’m getting an error with nginx when I try to use the snippet you provided me last night. The error is related to the following line (47 in my configuration file):</div>
<div><br>
</div>
<div>root {{ girder_root }}/clients/web;</div>
<div><br>
</div>
<div>
<p style="margin:0px;font-family:'Andale Mono';color:rgb(41,249,20);background-color:rgb(0,0,0)">
nginx: [emerg] directive "root" is not terminated by ";" in /etc/nginx/nginx.conf:47</p>
</div>
<div><br>
</div>
<div>I’m not familiar with the {{girder_root}} syntax in nginx and haven’t found examples of it with web searchers. I assume it is pulling out an environment variable (which is why I wonder if I should be running this on the machine/container running girder).
Also I wonder if this is a version issue; I’m running nbinx 1.4.6 on Ubuntu 14.04; this seems far behind the 1.9.5 latest release.</div></div></blockquote><div><br></div><div>Sorry about that confusion, this isn't valid syntax for the nginx config -- what I pasted is actually from a template file that we use to configure the nginx file, and girder_root is a variable in that template. You should change {{girder_root}} to whatever the actual path to girer is inside your container.</div><div><br></div><div>-Zach</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><span class="HOEnZb"><font color="#888888">
<div><br>
</div>
<div>Brian</div>
<div><br>
</div>
<div><br>
</div>
</font></span><span><span class="">
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Zach Mullen <<a href="mailto:zach.mullen@kitware.com" target="_blank">zach.mullen@kitware.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, October 21, 2015 at 7:20 PM<br>
<span style="font-weight:bold">To: </span>Brian Chapman <<a href="mailto:brian.chapman@utah.edu" target="_blank">brian.chapman@utah.edu</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:girder-users@public.kitware.com" target="_blank">girder-users@public.kitware.com</a>" <<a href="mailto:girder-users@public.kitware.com" target="_blank">girder-users@public.kitware.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Girder-users] Serving Girder over HTTPS from Docker<br>
</div>
<div><br>
</div>
</span><div><div class="h5"><div>
<div>
<div dir="ltr">Hi Brian,
<div><br>
</div>
<div>We typically set this up using a proxy like Nginx or Apache. Here's an example Nginx config for an SSL-only deployment of girder:</div>
<div><br>
</div>
<div>
<pre style="color:rgb(0,0,0)">server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;
# redirect to https
return 307 <a href="https://$host$request_uri" target="_blank">https://$host$request_uri</a>;
}
server {
listen 443 ssl;
ssl_certificate /etc/nginx/ssl/my_cert.pem;
ssl_certificate_key /etc/nginx/ssl/my_cert.key;
add_header Strict-Transport-Security "max-age=15552000";
root {{ girder_root }}/clients/web;
# Make site accessible from <a href="http://localhost/" target="_blank">http://localhost/</a>
server_name localhost;
location / {
proxy_pass <a href="http://localhost:8080" target="_blank">http://localhost:8080</a>;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Server $host;
include /etc/nginx/proxy_params;
# The following settings should allow SSE to work
proxy_buffering off;
proxy_cache off;
proxy_set_header Connection '';
proxy_http_version 1.1;
chunked_transfer_encoding off;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
}
location /static {
try_files $uri $uri/ /index.html;
}
}</pre>
<pre style="color:rgb(0,0,0)"><br></pre>
<pre style="color:rgb(0,0,0)"><font face="arial,helvetica,sans-serif">The only thing you'd need to modify in the above config is the locations of the cert and key files.</font></pre>
<pre style="color:rgb(0,0,0)"><span style="font-family:arial,helvetica,sans-serif">Hope this helps,</span><br></pre>
<pre style="color:rgb(0,0,0)"><font face="arial,helvetica,sans-serif"><br></font></pre>
</div>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div>
<div dir="ltr">
<div>
<div dir="ltr">Zach Mullen<br>
Kitware, Inc.<br>
<a href="tel:919-869-8858" value="+19198698858" target="_blank">919-869-8858</a></div>
</div>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Wed, Oct 21, 2015 at 9:15 PM, Brian E Chapman <span dir="ltr">
<<a href="mailto:Brian.Chapman@utah.edu" target="_blank">Brian.Chapman@utah.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hi everyone,</div>
<div><br>
</div>
<div>We’ve got an instance of Girder running user Docker containers for both MongoDB and Girder. This was nice and painless. However, it is running over http. Curious if there is any easy way with Girder directly to make this run over https or if the assumption
is that this would be done with Apache Redirect (or equivalent).</div>
<div><br>
</div>
<div>Brian</div>
<div>
<div>
<div>— </div>
<div>Brian E. Chapman, Ph.D.</div>
<div>Associate Professor</div>
<div>Department of Radiology</div>
<div>University of Utah</div>
<div><br>
</div>
</div>
</div>
</div>
<br>
_______________________________________________<br>
Girder-users mailing list<br>
<a href="mailto:Girder-users@public.kitware.com" target="_blank">Girder-users@public.kitware.com</a><br>
<a href="http://public.kitware.com/mailman/listinfo/girder-users" rel="noreferrer" target="_blank">http://public.kitware.com/mailman/listinfo/girder-users</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div></div></span>
</div>
</blockquote></div><br></div></div>