Advise Lotus node engineers/users put lotus behind an NGINX server.

[laudiacay]

filecoin-project/lotus#7573

This issue was opened on lotus asking for HTTPS support on the API- the real solution is that documentation should make it exceedingly clear that the lotus API needs to go through Nginx for some DoS protection, HTTPS, and various other security features/niceties of a real production webserver.

The python-Django tutorial has good examples of the type of frequent warnings of « do not open ports directly into this service in production » that we might want to add, that was the first thing that came to mind.

we probably also want a tutorial somewhere of what to put in the nginx conf.

[johnnymatthews]

This is fair. Do you happen to have a link to the Python-Django tutorial you're referencing.

we probably also want a tutorial somewhere of what to put in the nginx conf.

This would be great. It'd have to come from the Lotus team initially. Is this something you've got experience with and/or could help out with?

[laudiacay]

Here's the tutorial in question. Basically in every stage up until this, they're really aggressive about saying "don't open up your firewall to the wider internet until you complete this stage and use a real webserver!!" https://developer.mozilla.org/en-US/docs/Learn/Server-side/Django/Deployment

[laudiacay]

I think you could just do this- the example with the "local server" is relevant: https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/
you'd add it to a config that looks kinda like this for the rest of the server including hostname stuff: https://docs.nginx.com/nginx/admin-guide/web-server/app-gateway-uwsgi-django/
and this would add SSL: https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/

[laudiacay]

also apparently we should put lotus-gateway in front of lotus before nginx