Securing your Elrond validator + Netdata service behind nginx with self-signed SSL certificate on Ubuntu

instructions.md

Securing your Elrond validator + Netdata service behind nginx with self-signed SSL certificate on Ubuntu

Doing the following will ensure access to your node server is protected behind the firewall with the following URLs available:

• https://<server ip>/node/* - you should see JSON output showing node stats (replace * with status, statistics, etc, see full list)
• https://<server ip>/netdata - you will be prompted for the username and password you setup below, following which you should see your netdata dashboard

How to do it

Setup the firewall:

ufw alllow 22
ufw allow 443
ufw enable

Generate a self-signed SSL certificate (More advanced users are encouraged to use letsencrypt for a proper one!):

openssl req -newkey rsa:4096 \
            -x509 \
            -sha256 \
            -days 3650 \
            -nodes \
            -out elrond.crt \
            -keyout elrond.key
						
mv elrond.crt /etc/ssl/certs
mv elrond.key /etc/ssl/private

Install nginx and some utilities:

apt install nginx apache2-utils

Create auth file (Note: replace <username> with your desired login username. You will be prompted for the password you want to use with this username):

cd /etc/nginx
htpasswd -c ./httpd.auth <username>

Edit /etc/nginx/sites-available/default and enter the following as its contents:

upstream backend {
    server 127.0.0.1:19999;
    keepalive 64;
}

server {
	listen 443 default_server ssl;
	server_name  _;

	ssl_certificate      /etc/ssl/certs/elrond.crt;
	ssl_certificate_key  /etc/ssl/private/elrond.key;
	keepalive_timeout    70;

	location /node {
		proxy_pass http://127.0.0.1:8080/node;
	}
		
       location = /netdata {
                return 301 /netdata/;
        }
				
	location ~ /netdata/(?<ndpath>.*) {
		auth_basic           "Elrond validator";
		auth_basic_user_file /etc/nginx/httpd.auth;

		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Host $host;
		proxy_set_header X-Forwarded-Server $host;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_http_version 1.1;
		proxy_pass_request_headers on;
		proxy_set_header Connection "keep-alive";
		proxy_store off;
		proxy_pass http://backend/$ndpath$is_args$args;

		gzip on;
		gzip_proxied any;
		gzip_types *;
    	}		
}

Now you can visit the URLs shown at the beginning and they should work!

Troubleshooting

The certificate is self-signed so in your browser may warn you when you visit it, e.g:

Your connection is not private
Attackers might be trying to steal your information from ...
NET::ERR_CERT_AUTHORITY_INVALID

Just ignore this and continue onwards.

To avoid this message you will need to obtain an actual CA-signed SSL certificate using letsencrypt.

Thank you so much for putting this together.