Petals Cockpit 0.22.0-SNAPSHOT

Key
This line was removed.
This word was removed. This word was added.
This line was added.

Changes (1)

View Page History
Petals cockpit is not designed to be able to switch LDAP authentication on and off with a same installation. Users added through LDAP are not available without it, and vice versa. If you want to activate or deactivate LDAP authentication, it is advised to wipe the database in the meantime.

h3. SSL/TLS encryption (https)

The [Secure Socket Layer protocol|http://en.tldp.org/HOWTO/SSL-Certificates-HOWTO/x64.html] ensures secure transactions between web servers and browsers. The protocol uses a third party, a Certificate Authority (CA), to identify one end or both end of the transactions.
Cockpit is supposed to be running within your infrastructure. Which means in will be running in clear, and encryption should be handled elsewhere (with a proxy for instance). Anyway, Cockpit is based upon Dropwizard which handles natively SSL; so configuring encryption in cockpit backend remains an option; should you desire so.

h4. Example of a reverse proxy setup

Here's an example of a [nginx|https://www.nginx.com/] reverse proxy setup (which we use for our testing). With such a setup, there is no need to configure anything in cockpit, as you can see below Cockpit in accessed in clear by the proxy:

{code}
server {
# Exposed name (for our testing its localhost, but it should not be)
server_name localhost;
location / {
# address to reach cockpit backend instance
proxy_pass http://127.0.0.1:8484;

# this configuration ensure SSE will reach through
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_cache off;
chunked_transfer_encoding off;
}
# ipv6 and ipv4 listener
listen [::]:443 ssl ipv6only=on;
listen 443 ssl;

# Certificate and key pair
ssl_certificate /mkcert/localhost+2.pem;
ssl_certificate_key /mkcert/localhost+2-key.pem;

# Avoid SSE timeouts
# Nginx will close connections periodically (timeout), the connection will be restored right after.
# The whole workspace will be send each time, inscreasing the timeout reduces traffic load.
# Value is in seconds. Default value is 60s, there it's configured for 600s so 10 minutes.
proxy_connect_timeout 600;
proxy_send_timeout 600;
proxy_read_timeout 600;
send_timeout 600;
keepalive_timeout 600;

}
{code}

h4. Configuring SSL in cockpit

If you want to handle SSL in cockpit, here's the configuration to add (from [Dropwizard documentation|https://www.dropwizard.io/en/latest/manual/core.html#ssl])
{quote}
SSL support is built into Dropwizard. You will need to provide your own java keystore, which is outside the scope of this document (keytool is the command you need, and [Jetty’s documentation|http://www.eclipse.org/jetty/documentation/current/configuring-ssl.html] can get you started). There is a test keystore you can use in the [Dropwizard example project|https://github.com/dropwizard/dropwizard/tree/master/dropwizard-example].
{quote}
{code}
server:
applicationConnectors:
- type: https
port: 8443
keyStorePath: example.keystore
keyStorePassword: example
validateCerts: false
{code}


h2. Launching Petals Cockpit