[chef] Re:

[Steffen Gebert < >]

Hi,

> The API calls are all signed and (AFAIK) encrypted
AFAIK (very sure) they're NOT encrypted, that's why you're advised to
setup an HTTPS proxy in front of the chef server.
Chef 11 ships an nginx that does the SSL termination.

Yours
Steffen

On 8/1/13 10:13 AM, Matt Rohrer wrote:
> On 08/01, Andy Gale wrote:
>> Hi all,
>>
>> I've just inherited an old open source Chef server 0.10.8. It's left
>> exposed to the world poor thing and I fear for it's safety. It would be a
>> very good idea to put Nginx in front of it I think.
>>
>> Does anyone have any howtos? I'd like to do it soon rather than later!
> 
> Hi Andy,
> 
> Yes, you definitely want to protect the webui. You can configure nginx
> to proxy to it like any other upstream app.
> 
> There's an example at 
> https://github.com/opscode-cookbooks/chef-server/blob/0.99.12/templates/default/chef_server.nginx.conf.erb
> 
> The API calls are all signed and (AFAIK) encrypted so leaving that
> "exposed" isn't a huge issue, though if you can limit access to certain
> IPs that's of course prefered.
> 
> Regards,
> Matt
> 
> --
> Matt Rohrer // 
> 
 
> http://finitesoup.com
>