Pass $ssl_client_s_dn to flask app

[MiaMish]

My nginx.conf file looks like this:

uwsgi_read_timeout 300;

ssl_certificate     /app/cert.pem;
ssl_certificate_key /app/key.pem;
ssl_password_file   /app/password.pass;

ssl_client_certificate  /app/client-ca.crt;
ssl_verify_client optional;
ssl_verify_depth 2;

include uwsgi_params;
uwsgi_param HTTP_X_DN $ssl_client_s_dn;

I want my Flask app to receive the HTTP_X_DN parameter, but cannot find how.

From looking around, I found its expected to reside in request.environ object of flask, but I don't see any such key when printing the environ content.

For reference, request.environ.keys()) returns the following when sending a request via Postman:

dict_keys(['QUERY_STRING', 'REQUEST_METHOD', 'CONTENT_TYPE', 'CONTENT_LENGTH', 'REQUEST_URI', 'PATH_INFO', 'DOCUMENT_ROOT', 'SERVER_PROTOCOL', 'REQUEST_SCHEME', 'HTTPS', 'REMOTE_ADDR', 'REMOTE_PORT', 'SERVER_PORT', 'SERVER_NAME', 'HTTP_CONTENT_TYPE', 'HTTP_CACHE_CONTROL', 'HTTP_POSTMAN_TOKEN', 'HTTP_USER_AGENT', 'HTTP_ACCEPT', 'HTTP_HOST', 'HTTP_ACCEPT_ENCODING', 'HTTP_CONTENT_LENGTH', 'HTTP_CONNECTION', 'wsgi.input', 'wsgi.file_wrapper', 'wsgi.version', 'wsgi.errors', 'wsgi.run_once', 'wsgi.multithread', 'wsgi.multiprocess', 'wsgi.url_scheme', 'uwsgi.version', 'uwsgi.node', 'werkzeug.request'])

[MiaMish]

Apparently for some reason uwsgi_param that are set in app.conf are ignore, while when setting in nginx.conf it works fine. However, since this docker image is generating the nginx.conf on the fly, that's a bit problematic.

[MiaMish]

So what resolves the issue for me is to add the following /app/prestart.sh, but that's a nasty hack.

#!/usr/bin/env bash
ex -sc '%s/include uwsgi_params;/include uwsgi_params; uwsgi_param SSL_CLIENT_S_DN $ssl_client_s_dn;/g|x' /etc/nginx/conf.d/nginx.conf

[tiangolo]

Sorry for the delay! I was busy building FastAPI.

I understand you solved your problem, but anyway...

What are you trying to achieve? If you want to have HTTPS, I recommend using Traefik, it can acquire free Let's Encrypt certificates for your application.

You can deploy a Docker Swarm cluster with an HTTPS handling Traefik following this guide.

And then you can use a project generator to create the basic code structure to connect with Traefik, and add all the rest of your code to it (or add the parts you need to your code).

I just added the relevant info and links to the README: https://github.com/tiangolo/uwsgi-nginx-flask-docker#project-generators

[MiaMish]

Thanks, I'll take a look at Traefik.
Regardless, I think adding the option to add custom uwsgi_param rows to the main nginx.conf would be quite simpler in this case.
I would want some configuration that will add the following line to nginx.conf:
uwsgi_param SSL_CLIENT_S_DN $ssl_client_s_dn
Note it must be added to the main nginx.conf and not to app.conf, I'm not sure why but it seems like an nginx constraint.

[tiangolo]

I just added tests for all the images and configurations to be able to re-factorize knowing that I'm not breaking anything.

I'm planning on:

• By default, generating the nginx.conf entirely in code. But...
• Check if there's a file in /app/nginx.conf first. If that file exists, use it instead.

That would allow you to customize the nginx.conf entirely, in any way you wanted.

Do you think that would support your use case/need?

[MiaMish]

Yes, that would be great.

[tiangolo]

Done! ✔️

I just finished a big refactor to be able to add this feature on top.

You can now add a file /app/nginx.conf and it will be used instead of the generated one.

You can check the docs here: https://github.com/tiangolo/uwsgi-nginx-flask-docker#overriding-nginx-configuration-completely