Open Trigger
Search…
Introduction
Overview
Tutorials
Quickstart
Letsencrypt Tutorial
Slack Button Tutorial
Flash Firmware under OSX
Powered By GitBook
Letsencrypt Tutorial

Introduction

At some point you probably want to access your opentrigger setup from outside your firewall. This tutorial will guide you how to setup password protection and encrypt your traffic with Letsencrypt. Please be aware that security is always an investment, and there is no such thing as absolute security. Blindly following this tutorial alone will not protect your data.
Forwarding ports on your firewall and setting up domain names is a very specific task we can not cover in this tutorial. Your Router/Firewall/... usually comes with documentation which should cover the former. Another source of information would be: portforward.com (only read the articles, they also want to sell you software which does it for you - but do you really want to thrust that?). If you need a free subdomain with dyndns service have a look at: freedns.afraid.org​

Requirements

For this tutorial we assume that you are running Raspbian jessie, your opentrigger stack ist already set up and you have a domain name configured. Your domain name resolution has to work from outside (the public internet) and on your local network. The TCP Ports 80 and 443 must be mapped to your device - nothing more, nothing less. Keep away form that DMZ or ExposedHost settings. We will use letutorial.dev.opentrigger.com as domain for this tutorial, please replace that with your hostname.

Installing required Packages

sudo apt-get install nginx apache2-utils haveged
nginx is a resource friendly, but fully featured webserver. apache2-utils contain the htpasswd tool we will use to add basic authentication. haveged helps with entropy problems, its not a hard requirement, but will speed things up a bit.
After that nginx is running on port 80 and if you navigate to http://letutorial.dev.opentrigger.com/ you should see the nginx default page.
We also need certbot which currently is the recomendet way of getting Letsencrypt certificates.
wget https://dl.eff.org/certbot-auto
sudo install certbot-auto /usr/local/bin/
rm certbot-auto

Certificates

Now we start certbot-auto which will download and install its dependencies and performs (self)updates when needed. So the first run will take a little longer.
certbot-auto certonly --webroot -w /var/www/html/ -d letutorial.dev.opentrigger.com
Some dialogs will pop up and asking you to provide an Email address and agree to the 'Terms of Service'.
After the procedure is complete, certbot will tell you where your new certificates are stored:

Configuring nginx

Generating dhparams, even with havegd running, this could take some time.
sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048
If you don't want to wait you could start another terminal session and leave that running in the background. (or use your shell to make that happen).
Setup your credentials. Substitute <username> with your preferred username.
sudo htpasswd -c /etc/nginx/letutorial.dev.opentrigger.com.htpasswd <username>
You will be asked for the password (twice). Please refer to man htpasswd on how to manage users.
Create a new site configuration file.
sudo nano /etc/nginx/sites-available/https
Paste the following content.
## sudo apt-get install nginx apache2-utils haveged
​
server {
​
listen 443 ssl;
server_name letutorial.dev.opentrigger.com; ## hostname
​
ssl on;
ssl_dhparam /etc/nginx/dhparam.pem; ## create with: `sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048`
ssl_certificate /etc/letsencrypt/live/letutorial.dev.opentrigger.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/letutorial.dev.opentrigger.com/privkey.pem;
​
ssl_session_cache shared:SSL:30m;
ssl_session_timeout 30m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
ssl_buffer_size 8k;
ssl_prefer_server_ciphers on;
​
add_header Strict-Transport-Security max-age=31536000;
​
## if you want error or access logs
# access_log /var/log/nginx/letutorial.dev.opentrigger.com.access.log;
# error_log /var/log/nginx/letutorial.dev.opentrigger.com.error.log;
​
## basic authentication - see `man htpasswd`
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/letutorial.dev.opentrigger.com.htpasswd; ## create with: `sudo htpasswd -c /etc/nginx/letutorial.dev.opentrigger.com.htpasswd <username>`
​
## you migt want to serve some static files
# root /var/www/html;
# location / { try_files $uri $uri/ =404; }
# location ~ /\. { return 404; }
​
​
## reverse proxy for node-red
location /node-red/ {
proxy_pass http://127.0.0.1:1880/;
​
proxy_read_timeout 90;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
proxy_pass_request_headers on;
​
}
​
## reverse proxy for mosquitto websockets (if it is configured and listening on port 8080)
location /mosquitto-websockets/ {
proxy_pass http://127.0.0.1:8080/;
​
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
​
}

Testing

Check if openssl dhparam is finished by now, if not you have to wait for it.
Enable the site.
sudo ln -s /etc/nginx/sites-available/https /etc/nginx/sites-enabled/
sudo service nginx restart
Now you should be able to access your device over a password protected and encrypted Link:
Now go to
and run the test. You should not go for less than A:

Renewal

Your certificate is valid for 90 days, but renewal is easy:
certbot renew
It would be best to automate the renewal process, please consult certbot's documentation for that.
Previous
Quickstart
Next
Slack Button Tutorial
Last modified 4yr ago
Copy link
Outline
Introduction
Requirements
Installing required Packages
Certificates
Configuring nginx
Testing
Renewal