Merge pull request #483 from azavea/feature/hmc/http-to-https

Add support for redirecting HTTP to HTTPS

Author: hectcastro

Vagrantfile

@@ -37,15 +37,16 @@ end
 # if any dependencies are missing
 def install_dependent_roles
   ansible_directory = File.join("deployment", "ansible")
-  ansible_roles_txt = File.join(ansible_directory, "roles.txt")
+  ansible_roles_spec = File.join(ansible_directory, "roles.yml")
 
-  File.foreach(ansible_roles_txt) do |line|
-    role_name, role_version = line.split(",")
+  YAML.load_file(ansible_roles_spec).each do |role|
+    role_name = role["src"]
+    role_version = role["version"]
     role_path = File.join(ansible_directory, "roles", role_name)
     galaxy_metadata = galaxy_install_info(role_name)
 
     if galaxy_metadata["version"] != role_version.strip
-      unless system("ansible-galaxy install -f -r #{ansible_roles_txt} -p #{File.dirname(role_path)}")
+      unless system("ansible-galaxy install -f -r #{ansible_roles_spec} -p #{File.dirname(role_path)}")
         $stderr.puts "\nERROR: An attempt to install Ansible role dependencies failed."
         exit(1)
       end
@@ -125,7 +126,7 @@ Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
     end
 
     # Web
-    app.vm.network "forwarded_port", guest: 80, host: 8024
+    app.vm.network "forwarded_port", guest: 443, host: 8024
 
     # Django Dev
     app.vm.network "forwarded_port", guest: 8026, host: 8026

deployment/ansible/app.yml

@@ -1,6 +1,6 @@
 ---
 - hosts: app
-  sudo: True
+  become: True
 
   pre_tasks:
     - name: Update APT cache

deployment/ansible/database.yml

@@ -1,6 +1,6 @@
 ---
 - hosts: database
-  sudo: True
+  become: True
 
   pre_tasks:
     - name: Update APT cache

deployment/ansible/otp.yml

@@ -1,6 +1,6 @@
 ---
 - hosts: otp
-  sudo: True
+  become: True
 
   pre_tasks:
     - name: Update APT cache

deployment/ansible/roles.txt

@@ -0,0 +1,32 @@
+- src: azavea.git
+  version: 0.1.0
+
+- src: azavea.java
+  version: 0.2.6
+
+- src: azavea.opentripplanner
+  version: 1.0.1
+
+- src: azavea.nginx
+  version: 0.2.2
+
+- src: azavea.nodejs
+  version: 0.4.0
+
+- src: azavea.packer
+  version: 0.2.0
+
+- src: azavea.papertrail
+  version: 1.1.1
+
+- src: azavea.pip
+  version: 0.1.1
+
+- src: azavea.python
+  version: 0.1.0
+
+- src: azavea.virtualenv
+  version: 0.1.0
+
+- src: azavea.postgresql-support
+  version: 0.3.0

deployment/ansible/roles.yml

@@ -1,33 +1,33 @@
 ---
 - name: Clear out the NPM artifacts when in production (want a fresh set)
   file: path="{{ root_src_dir }}/node_modules" state=absent
-  sudo: yes
+  become: yes
   when: production
 
 - name: Install NPM dependencies
   command: npm install chdir="{{ root_src_dir }}"
-  sudo: no
+  become: no
 
 - name: Create Static Directory
   file: path="{{ root_static_dir }}" state=directory mode=0755 owner="{{ app_username }}"
-  sudo: yes
+  become: yes
 
 - name: Install application javascript dependencies with bower
   command: npm run bower-install
-  sudo: no
+  become: no
   args:
     chdir: "{{ root_src_dir }}"
 
 - name: Create static files -- development
   command: npm run gulp-development
-  sudo: no
+  become: no
   args:
     chdir: "{{ root_src_dir }}"
   when: not production and not test
 
 - name: Create static files -- production
   command: npm run gulp-production
-  sudo: no
+  become: no
   args:
     chdir: "{{ root_src_dir }}"
   when: production or test

deployment/ansible/roles/cac-tripplanner.app/tasks/jslibs.yml

@@ -67,8 +67,7 @@
   notify: Restart nginx
 
 - name: Touch cron job log file if it does not exist
-  command: touch {{ app_cron_event_feed_log }}
-           creates={{ app_cron_event_feed_log }}
+  copy: content="" dest="{{ app_cron_event_feed_log }}" force=no
 
 - name: Touch cron job log file if it does not exist, and set permissions
   file: path={{ app_cron_event_feed_log}} state=touch

deployment/ansible/roles/cac-tripplanner.app/tasks/main.yml

@@ -1,18 +1,53 @@
+# Public VPC subnet CIDRs
+set_real_ip_from 10.0.0.0/24;
+set_real_ip_from 10.0.2.0/24;
+set_real_ip_from 10.0.4.0/24;
+set_real_ip_from 10.0.6.0/24;
+
+real_ip_header X-Forwarded-For;
+
+server {
+    listen 80;
+    server_name gophillygo.org www.gophillygo.org;
+    return 301 https://$host$request_uri;
+}
+
+map $http_x_forwarded_proto $policy {
+    default "";
+    https   "default-src https: data: blob: 'unsafe-inline' 'unsafe-eval'";
+}
+
 server {
-    listen 80 default_server;
+    listen 443 default_server;
+    server_name gophillygo.org www.gophillygo.org localhost;
 
-    server_name _;
+    # A set of recommended security headers:
+    #
+    #   https://scotthelme.co.uk/hardening-your-http-response-headers/
+    #
+    add_header Strict-Transport-Security "max-age=15552000; preload" always;
+    add_header Content-Security-Policy $policy always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-XSS-Protection "1; mode=block" always;
 
     location / {
         proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header X-Forwarded-For $remote_addr;
         proxy_read_timeout {{ otp_session_timeout_s }}s;
+        proxy_redirect off;
+
+        proxy_pass http://127.0.0.1:8000;
     }
 
     location /admin/destinations/destination/add/ {
         proxy_set_header Host $http_host;
-        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_redirect off;
+
         client_max_body_size 10M;
+
+        proxy_pass http://127.0.0.1:8000;
     }
 
     location /static/ {

deployment/ansible/roles/cac-tripplanner.app/templates/nginx-default.j2

@@ -7,17 +7,17 @@
 
 - name: Create postgres database
   postgresql_db: name={{ postgres_db }}
-  sudo_user: postgres
+  become_user: postgres
 
 - name: Create postgres user
   postgresql_user: db={{ postgres_db }}
                    name={{ postgres_user }}
                    password={{ postgres_password }}
                    role_attr_flags=SUPERUSER
-  sudo_user: postgres
+  become_user: postgres
 
 - name: Add PostGIS extension
-  sudo_user: postgres
+  become_user: postgres
   command: psql {{ postgres_db }} -c "CREATE EXTENSION postgis"
   register: psql_result
   failed_when: >
@@ -36,4 +36,3 @@
               regexp='host\s+all\s+all\s+(127\.0\.0\.1\/32|0\.0\.0\.0\/0)\s+md5'
               line="host all all 0.0.0.0/0 md5"
   notify: Restart Postgres
-