how to add TLS to hypnotoad web server ? #2214

e-ferrari · 2024-12-02T14:26:42Z

e-ferrari
Dec 2, 2024

Hi guys,
i hope this is the right place for my question. If not, please advice me.
First: i'm not a developer, i'm a system administrator. I don't know much about perl and a little bit of CPAN. I installed already some perl modules with it.
We have a perl application which uses hypnotoad to offer web pages.
Because the page requires a login i like to encrypt it with TLS.
I read that "Another huge advantage is that it supports TLS and WebSockets out of the box" (https://github.com/mojolicious/mojo/blob/main/lib/Mojolicious/Guides/Cookbook.pod", so it should be possible.
I start a script with systemd. This starts the following lines:

/usr/local/bin/hypnotoad /home/crispor/crispr_allele_designer/crispr_designer/script/crispr_designer
/home/crispor/crispr_allele_designer/crispr_designer/script/crispr_designer > \  /home/crispor/crispr_allele_designer/crispr_designer/log/crispr-designer.log 2>&1 &

Our developer has created a conf file:

{
  logs             => '/home/crispor/logs/hypnotoad.log',
  loglevel         => 'verbose',
  debug            => '1',
  secrets          => ['xxxxx'],
  pg               => 'postgresql://xxx:xxx@127.0.0.1:5432/crisprdesigner',
  hypnotoad        => {
  listen           => ['https://*:8443'],
# listen           => ['https://*:8443?cert=/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.crt&key=/home/crispor/certs/private.key__'],
  workers          => '5',
  logs             => '/home/crispor/logs/hypnotoad.log',
  path             => '/home/crispor/logs/hypnotoad.log',
  level         => 'verbose',
  cert => '/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.crt__',
  key  => '/home/crispor/certs/private.key',
  }
}

#
#  input_size_limit:  max length of user input string (textarea)
#  loglevel        :  server log (available log levels are: debug, info, warn, error and fatal in that order)
#  debug           :  for debugging set to 1 (default 0)
#  worker_jobs     :  max number of jobs of a worker in the job queue default: 12 (should be larger than lock_limit)
#  retry_delay     :  time delay (sec) for a job retry (during named lock) default: 60 sec (should be below lock_time), see Analyze.pm
#  lock_limit      :  max number of active jobs in the job queue (other jobs are delayed) default: 3 (1 for testing), see Analyze.pm
#  lock_time       :  duration for a named lock default: 300 sec (could be increased), see Analyze.pm
#  secrets
#  hypnotoad
#

#  retry_delay      => '60',
#  lock_limit       => '1',
#  lock_time        => '300',
#  worker_jobs      => '8',

# Short scheme, username, password, host and database
#          postgresql://sri:s3cret@localhost:port/databasename
# PSQL database: crisprdesigner
# user: xxx
# PWD : xxx

# Mojolicious v9.22

What is strange if i change the port the webserver listens to, and restart the application it listens immediately on the new port.
But when i change anything by cert or key, it seems that it does not care about these entries.
I entered already a wrong path in cert, but nothing complained.
As you see i played around with listen (i found that on the net), but that didn't help.

Thanks for ayn advice.

Bernd

kraih · 2024-12-02T15:04:18Z

kraih
Dec 2, 2024
Maintainer

All you need is to install IO::Socket::SSL and Mojolicious supports TLS. But we recommend using a reverse proxy for TLS termination.

4 replies

e-ferrari Dec 2, 2024
Author

Hi,
it is installed:
root@crispor-server:/home/crispor/scripts# cpan -l|grep -i ssl

...
IO::Socket::SSL 2.067

Bernd

guest20 Dec 2, 2024

You have two "listen" entries in your config, but the one that points at keys is commented out with a #...

Is the problem that the server starts, but with a self signed cert, or does it just serve plain http?

I'm not a big systemd enjoyer, but I found that some log/errors get lost I don't run hypnotoad with --foreground, though this might just be a superstition from older versions of mojo.

Edit: you likely want all your logging to go to STDERR, so systemd puts them all into journald instead of doing redirecting, and you want to run hypnotoad without backgrounding so any other misc output ends up there too

e-ferrari Dec 2, 2024
Author

I changed it:

{
  logs             => '/home/crispor/logs/hypnotoad.log',
  loglevel         => 'verbose',
  debug            => '1',
  secrets          => ['xxxxx'],
  pg               => 'postgresql://xxxxx:cccccc@127.0.0.1:5432/crisprdesigner',
  hypnotoad        => {
#  listen           => ['https://*:8443'],
  listen           => ['https://*:8443?cert=/home/crispor/certs/crispr-designer_helmholtz-muenchen_de_chain.cer&key=/home/crispor/certs/private.key'],
  workers          => '5',
  logs             => '/home/crispor/logs/hypnotoad.log',
  path             => '/home/crispor/logs/hypnotoad.log',
  level            => 'verbose',
#  tls              => {
#    cert             => '/home/crispor/certs/crispr-designer_helmholtz-munich_de_chain.cer',
#    key              => '/home/crispor/certs/private.key',
#  };
 }
}

The problem is that it still uses a self-signed certificate (i assume a default).
The server starts.
It does not care about my certificate.

Bernd

kraih Dec 3, 2024
Maintainer

Is the cert file really a. .cer, or is that a typo? Maybe give the cert a shorter name for testing to avoid possible typos.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

how to add TLS to hypnotoad web server ? #2214

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

how to add TLS to hypnotoad web server ? #2214

Uh oh!

e-ferrari Dec 2, 2024

Replies: 1 comment · 4 replies

Uh oh!

kraih Dec 2, 2024 Maintainer

Uh oh!

e-ferrari Dec 2, 2024 Author

Uh oh!

Uh oh!

guest20 Dec 2, 2024

Uh oh!

e-ferrari Dec 2, 2024 Author

Uh oh!

kraih Dec 3, 2024 Maintainer

e-ferrari
Dec 2, 2024

Replies: 1 comment 4 replies

kraih
Dec 2, 2024
Maintainer

e-ferrari Dec 2, 2024
Author

e-ferrari Dec 2, 2024
Author

kraih Dec 3, 2024
Maintainer