j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 12:46:49 +00:00
Code Issues Projects Releases Wiki Activity

feat(settings): WEBVIRTCLOUD_HTTPS enables secure cookies, HTTPS redirect and HSTS

Browse source
This commit is contained in:
catborise 2026-10-07 15:39:52 +03:00
parent 7405217466
commit c1381318f1
4 changed files with 105 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -394,6 +394,12 @@ When the panel is served over HTTPS on a hostname other than localhost, add it t
environment=CSRF_TRUSTED_ORIGINS="https://webvirtcloud.example.com"
```
For a panel served over HTTPS, also set `WEBVIRTCLOUD_HTTPS=1` (same place). It
makes the session and CSRF cookies HTTPS-only, redirects HTTP to HTTPS (except
`/datasource/`, which VMs fetch over HTTP) and sends HSTS for one year. TLS can
end at the bundled nginx or at a proxy in front of it; such a proxy must send
`X-Forwarded-Proto: https`.
## How To Update
Back up `db.sqlite3` before updating (in Docker it lives in the `data` volume).
@ -428,6 +434,14 @@ requirement. If provisioning cannot write a new private password file, it stops
without creating an admin account or printing its password; fix the directory
permissions and rerun migrations.
HTTPS deployments: copy the `SECURE_PROXY_SSL_HEADER` / `WEBVIRTCLOUD_HTTPS` block
of `webvirtcloud/settings.py.template` into your `webvirtcloud/settings.py`, set
`WEBVIRTCLOUD_HTTPS=1` in the service environment, copy the `map` block and the
`X-Forwarded-Proto` line of `conf/nginx/webvirtcloud.conf` into
`/etc/nginx/conf.d/webvirtcloud.conf`, and reload nginx
(`sudo nginx -t && sudo systemctl reload nginx`). Re-running the installer
replaces that file, including any TLS directives you added to it.
```bash
# Go to Installation Directory
cd /srv/webvirtcloud