Merge pull request #557 from MerginMaps/556-include-security-section-https

Added section related to https deployment #556

Author: MarcelGeo

scripts/wordlist.txt

@@ -17,6 +17,7 @@ Benz
 Bing
 boolean
 Boolean
+CertBot
 changesets
 CLI
 Consulting's
@@ -25,6 +26,7 @@ crosshairs
 CSRF
 CSV
 CharlieColleague
+cybersecurity
 DAF
 DateTime
 DOP
@@ -67,6 +69,7 @@ GNSS
 GPL
 HDOP
 HTML
+HTTPS
 Helmert
 HiDPi
 IAM
@@ -98,6 +101,7 @@ MVT
 Mercedes
 Mergin
 merginmaps
+minimalistic
 Multiline
 nginx
 NDK
@@ -250,6 +254,8 @@ shapefiles
 spatialindex
 spatialite
 sqlite
+ssl
+SSL
 subfolder
 subfolders
 subproject

src/.vuepress/sidebar/en.js

@@ -125,6 +125,7 @@ module.exports = {
             children: [
                 '/server/',
                 '/server/install/',
+                '/server/security/',
                 '/server/upgrade/',
                 '/server/administer/',
                 '/server/troubleshoot/',

src/index.md

@@ -105,6 +105,7 @@ The ecosystem consist of various components:
 ## Custom Server
 - [Overview](./server/)
 - [Install](./server/install/)
+- [Security](./server/security/)
 - [Upgrade](./server/upgrade/)
 - [Administer](./server/administer/)
 - [Troubleshoot Custom Servers](./server/troubleshoot/)

src/server/security/index.md

@@ -0,0 +1,65 @@
+# Secure Mergin Maps installation
+
+::: warning
+This sections aims to provide some guidelines and a minimalistic example on how to secure a <MainPlatformName /> deployment.
+
+Further security enhancements should be implemented by experts in accordance to cybersecurity policies in place.
+
+:::
+For security and privacy reasons <MainPlatformName /> deployments should enable HTTPS secured connection via certificate file.
+
+We provide a template configuration file <GitHubRepo id="MerginMaps/server/blob/master/ssl-proxy.conf" desc="ssl-proxy.conf" />as base for your configuration.
+
+Let's have a quick look at the main sections:
+
+``` shell
+    server {
+        listen                  443 ssl;
+        server_name             merginmaps.company.com; # FIXME
+        client_max_body_size    4G;
+        ...
+```
+
+Here we enable SSL via the default `443` port and configure name-based HTTPS server via `server_name`. Here you should change this according to your target server name.
+
+We don't recommend setting a `client_max_body_size` higher than specified, because that might lead to timeouts while uploading your data to Mergin Maps.
+
+Next, you need to point your certificate files to NGINX configuration. This is done on the next lines on the secured configuration:
+
+``` shell
+    ...
+    ssl_certificate_key /etc/letsencrypt/live/merginmaps.company.com/privkey.pem; # FIXME
+    ssl_certificate     /etc/letsencrypt/live/merginmaps.company.com/fullchain.pem; # FIXME
+    ...
+```
+
+The above example uses automated keys generated by CertBot. For more information, visit [CertBot](https://certbot.eff.org/instructions) website and check how you can generate your own keys.
+
+Some extra security settings for HTTP headers are provided. Please review them and update in accordance to your requirements.
+
+```shell
+        # Prevent crawlers from indexing and following links for all content served from the mergin app
+        add_header X-Robots-Tag "none";
+
+        # Protect against clickjacking iframe
+        add_header Content-Security-Policy "frame-ancestors 'self';" always;
+
+        # Add a HSTS policy to prevent plain http from browser
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+        # Set cookies security flags
+        proxy_cookie_flags ~ secure httponly samesite=strict;
+
+        location / {
+            root /var/www/html;
+
+            # The lines below were copied from application proxy
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Host $http_host;
+            # we don't want nginx trying to do something clever with
+            # redirects, we set the Host: header above already.
+            proxy_redirect off;
+            proxy_pass http://app_server;
+        }
+```