use letsencrypt

.gitignore

@@ -1,5 +1,8 @@
 *.pyc
 *~
+*.key
+*.pem
+*.crt
 __pychache__
 myvenv
 eoa-venv

config/nginx/mydjango.conf

@@ -11,8 +11,26 @@ server {
     }
 
     location / {
-        proxy_pass http://web/;
+        proxy_pass https://web/;
     }
-    listen 8000;
-    server_name localhost;
+
+    location /.well-known {
+        alias /var/www/c105-187.cloud.gwdg.de/.well-known;
+    }
+
+    listen 443 ssl http2 default_server;
+    listen [::]:443 ssl http2 default_server;
+    server_name  c105-187.cloud.gwdg.de;
+    ssl_certificate /etc/nginx/certs/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/privkey.pem;
+
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    ssl_session_cache shared:le_nginx_SSL:1m;
+    ssl_session_timeout 1440m;
+
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS";
 }

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     environment:
       - DEPLOYHOST
     ports:
-      - "8000:8000"
+      - "443:443"
     volumes:
       - .:/code
       - ./config/nginx:/etc/nginx/conf.d
@@ -23,8 +23,8 @@ services:
     volumes:
       - .:/code
       - ./static:/static
-    expose:
-      - "8000"
+    #expose:
+    #  - "8000"
 
   postgres:
     build: ./scripts/pghstore/.