SSL Certificate Configuration

# Generate wildcard cert for *.example.com
certbot certonly --manual \
  --preferred-challenges=dns \
  --email admin@example.com \
  --agree-tos \
  -d *.example.com \
  -d example.com

/etc/letsencrypt/live/example.com/
├── fullchain.pem  # Use as friendly.crt
└── privkey.pem    # Use as friendly.key

# Create SSL directory for standalone portals
mkdir -p /usr/local/ui-portals/portals/ssl

# Copy certificates
cp /etc/letsencrypt/live/example.com/fullchain.pem \
   /usr/local/ui-portals/portals/ssl/friendly.crt

cp /etc/letsencrypt/live/example.com/privkey.pem \
   /usr/local/ui-portals/portals/ssl/friendly.key

# Set secure permissions
chmod 644 /usr/local/ui-portals/portals/ssl/friendly.crt
chmod 600 /usr/local/ui-portals/portals/ssl/friendly.key

# Test renewal
certbot renew --dry-run

# Add cron job for auto-renewal
echo "0 3 * * * certbot renew --quiet && cp /etc/letsencrypt/live/example.com/*.pem /usr/local/ui-portals/portals/ssl/ && docker compose restart" >> /etc/crontab

# Create CA directory on the standalone portals host
mkdir -p /usr/local/ui-portals/ca
cd /usr/local/ui-portals/ca

# Generate CA private key
openssl genrsa -out ca.key 4096

# Generate CA certificate (valid 10 years)
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt \
  -subj "/C=US/ST=State/L=City/O=Company/OU=IT/CN=Company Root CA"

# Generate server private key
openssl genrsa -out friendly.key 2048

# Create certificate signing request (CSR)
openssl req -new -key friendly.key -out friendly.csr \
  -subj "/C=US/ST=State/L=City/O=Company/OU=IT/CN=*.example.internal"

# Create SAN configuration file
cat > san.cnf <<EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = State
L = City
O = Company
OU = IT
CN = *.example.internal

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.example.internal
DNS.2 = example.internal
DNS.3 = *.portals.example.internal
DNS.4 = *.ai-agent.example.internal
EOF

# Sign certificate with CA (valid 2 years)
openssl x509 -req -in friendly.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out friendly.crt -days 730 -sha256 -extfile san.cnf -extensions v3_req

# Create SSL directory for standalone portals
mkdir -p /usr/local/ui-portals/portals/ssl

# Copy certificates
cp friendly.crt /usr/local/ui-portals/portals/ssl/
cp friendly.key /usr/local/ui-portals/portals/ssl/

# Set secure permissions
chmod 644 /usr/local/ui-portals/portals/ssl/friendly.crt
chmod 600 /usr/local/ui-portals/portals/ssl/friendly.key

services:
  portals:
    image: hub.friendly-tech.com/ui/portals:latest
    ports:
      - "${FT_UI_HTTP_PORT:-8880}:80"     # HTTP (redirect)
      - "${FT_UI_HTTPS_PORT:-8843}:443"   # HTTPS
    volumes:
      - ${DATA_FOLDER:-.}/portals/ssl:/etc/nginx/ssl:ro
      - ${DATA_FOLDER:-.}/portals/nginx/logs:/var/log/nginx
    # ... rest of config

server {
    listen 443 ssl;

    # SSL Configuration
    ssl_certificate /etc/nginx/ssl/friendly.crt;
    ssl_certificate_key /etc/nginx/ssl/friendly.key;

    # SSL Security Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

    # Proxy all requests to the Python AI agent
    location / {
      proxy_pass http://ui-ai-agent:8080;

      # Proxy headers
      proxy_set_header Host ui-ai-agent:8080;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;  # Always HTTPS
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Port $server_port;

      # Timeouts for long-running requests
      proxy_connect_timeout 60s;
      proxy_send_timeout 60s;
      proxy_read_timeout 60s;

      # WebSocket support (if needed)
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      # Buffering settings for large responses
      proxy_buffering on;
      proxy_buffer_size 4k;
      proxy_buffers 8 4k;
      proxy_busy_buffers_size 8k;
    }

server {
    listen 80;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name _;

    # SSL certificates
    ssl_certificate /etc/nginx/ssl/friendly.crt;
    ssl_certificate_key /etc/nginx/ssl/friendly.key;

    # SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000" always;

    # Proxy to AI Agent
    location / {
        proxy_pass http://ui-ai-agent:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support (if needed)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

services:
  ui-ai-agent:
    # ... existing config

  ai-agent-nginx:
    image: nginx:alpine
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ${DATA_FOLDER:-.}/ui-ai-agent/ssl:/etc/nginx/ssl:ro
      - ./ai-agent-nginx-ssl.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - ui-ai-agent
    restart: unless-stopped