Enable and configure SSL post installation#
Enabling SSL#
Because Anaconda Server does not require SSL certificates to operate, you’ll need to perform some additional steps in order to enable SSL on an existing HTTP based instance.
Log into your instanace of Anaconda Server as a user with root access.
Open your Anaconda Server installer directory. This directory contains both the
docker-compose.yml
and.env
files.Tip
You can find your installer directory by running the
ls -la
command to view the contents of your current working directory.# Replace <INSTALLER_DIRECTORY> with your base installer directory cd <INSTALLER_DIRECTORY>
Edit your
docker-compose.yml
file.Find the
Services:
section near the top of the file. Then, under thenginx_proxy:
portion, add the following lines:secrets: - source: nginx_key target: /etc/nginx/certs/tls.key - source: nginx_cert target: /etc/nginx/certs/tls.crt
Find the
Keycloak:
section further down in the file. Then, under theenvironment:
portion, add this line:- PROXY_ADDRESS_FORWARDING=true
Edit your
.env
file.Change
DOMAIN
to new FQDN, if applicable.Change
NGINX_PROXY_PORT
to443
.Change
PROTOCOL
tohttps
Edit your
/opt/anaconda/repo/config/nginx/conf.d/repo.conf
file.Near the top of the file, change
listen 8080;
tolisten 8080 ssl;
.Add the following lines after the
listen 8080 ssl;
line:ssl_certificate /etc/nginx/certs/tls.crt; ssl_certificate_key /etc/nginx/certs/tls.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5;
Here is an example of what your
repo.conf
file will look like when correctly configured:
Add your certificate and private key, named
tls.crt
andtls.key
, to the following directory:/opt/anaconda/repo/config/nginx/certs
Run the following commands from the directory containing
docker-compose.yml
to apply the changes:docker-compose stop nginx_proxy docker-compose up -d
Configuring SSL#
The following steps will allow you to configure the SSL:
Add or remove the following lines relating to the SSL in
<BASE_INSTALL_DIR>/config/nginx/conf.d/repo.conf
, where<BASE_INSTALL_DIR>
is the installation directory:listen 8080 ssl; ssl_certificate /etc/nginx/certs/tls.crt; ssl_certificate_key /etc/nginx/certs/tls.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers HIGH:!aNULL:!MD5;
Add or remove certificates from the following directory:
# Replace <INSTALLER_DIRECTORY> with your base install directory <INSTALLER_DIRECTORY>/config/nginx/certs
Run the following commands:
docker-compose stop nginx_proxy docker-compose up -d
Refer to nginx’s documentation for the standard SSL configuration procedure.
Updating URL/URIs in Keycloak#
Once your SSL cert and key are in place, you will need to update Keycloak to point to your new root URL and any valid URI redirects to your domain.
Navigate to your Keycloak instance at <FQDN>/auth/admin and log in.
Select Clients from the left-hand navigation.
Select repo-service from the list of available clients.
On the Settings tab, update your root URL and any necessary valid redirect URI’s.
Click Save at the bottom of the page.
Select Clients from the left-hand navigation.
Select repo-account-sync from the list of available clients.
On the Settings tab, update your root URL.
Click Save at the bottom of the page.
Rebuilding your channel index#
Migrating from HTTP
to HTTPS
or updating your FQDN
will alter the file path to your channel’s packages. You must rebuild your channel index to correct the file path. If you do not, you will be unable to successfully download packages after migrating.