Changes between Version 2 and Version 3 of ipmi

Timestamp:

Feb 8, 2019, 1:32:30 PM (7 years ago)

Author:

Jamie McClelland

Comment:

--

ipmi

@@ -26 +26 @@
 [[Image(6.advanced-console-redirection-settings-second.png​)]]
 [[Image(7.ipmi-settings.png)]]
+
+== Enable http redirections ==
+
+On robideau, we have the following nginx configuration to allow web-based proxying:
+
+{{{
+#server {
+#  listen 80;
+#  server_name ipmi.john.mayfirst.org;
+#  root /var/www/html;
+#  location /.well-known/acme-challenge {
+#    try_files $uri $uri/ =404;
+#  }
+#  location / {
+#    return 301 https://$host$request_uri;
+#  }
+#}
+
+server {
+  listen 443;
+  server_name ipmi.john.mayfirst.org;
+  location /.well-known {
+    root /var/www/html;
+  }
+  location / {
+    access_log off;
+    proxy_pass http://192.168.56.3:80;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "Upgrade";
+  }
+
+  ssl on;
+  ssl_certificate_key /etc/letsencrypt/live/ipmi.john.mayfirst.org/privkey.pem;
+  ssl_certificate /etc/letsencrypt/live/ipmi.john.mayfirst.org/fullchain.pem;
+
+  ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL';
+
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_session_cache shared:SSL:10m;
+
+  ssl_prefer_server_ciphers on;
+  ssl_dhparam /etc/ssl/dhparam.pem;
+
+  add_header Strict-Transport-Security max-age=63072000;
+  add_header X-Content-Type-Options nosniff;
+}
+}}}
+
+The commented out section must be un-commented initially to allow lets encrypt to create a proper initial certificate.
+
+Also, you need to create dlparams with:
+
+{{{
+openssl dhparam -out /etc/ssl/dhparam.pem 2048
+}}}