Optionally enable https

flipside_platform/templates/app_templates/django_site/salt/pillar/django_site.sls

@@ -2,11 +2,22 @@
 {%- for param, value in extra.items() %}
 {{ '{% set ' ~  param ~ ' = "' ~ value ~ '" -%}' }}
 {%- endfor %}
+# set to True to enable ssl (needs secrets in django_site_secrets state)
+{{ '{% set enable_ssl = False %}' }}
+
 # END configurable section
 
 {% raw -%}
 {% set home = "/home/" ~ app_name %}
 {% set uwsgi_socket = home ~ "/uwsgi.sock" %}
+{% set ssl_cert_path = "/etc/nginx/ssl/" ~ app_name ~ "/server.crt" %}
+{% set ssl_key_path = "/etc/nginx/ssl/" ~ app_name ~ "/server.key" %}
+
+django_site:
+  app_name: {{ app_name }}
+  ssl_cert_path: {{ ssl_cert_path }}
+  ssl_key_path: {{ ssl_key_path }}
+  enable_ssl: {{ enable_ssl }}
 
 nginx:
   ng:
@@ -31,17 +42,28 @@ nginx:
               - server_name: {{ server_name }}
               - listen:
                 - 80
+              {%- if enable_ssl %}
+              - listen 443 ssl
+              - ssl_certificate: {{ ssl_cert_path }}
+              - ssl_certificate_key: {{ ssl_key_path }}
+              {%- endif %}
               - location /:
                 - uwsgi_pass: unix://{{ uwsgi_socket }}
                 - include: uwsgi_params
-                - uwsgi_param:  UWSGI_SCHEME $http_x_forwarded_proto  {# $scheme #}
+                {#- uncomment if behind load balancer - uwsgi_param:  UWSGI_SCHEME $http_x_forwarded_proto #}
                 - uwsgi_param: SERVER_SOFTWARE nginx/$nginx_version
                 - location ~ ^/favicon\.(ico|png)$:
                   - rewrite: (.*) /static/images$1
                 - location ~ ^/robots\.txt$:
                   - rewrite: (.*) /static$1
                 - location /static:
                   - alias: {{ home }}/static
+                - location /media:
+                  - alias: {{ home }}/media
+                {%- if enable_ssl %}
+                - if ($https = ""):
+                    - rewrite: ^/[a-zA-Z\-]*/admin https://$host$request_uri? permanent
+                {%- endif %}
 
 users:
   {{ app_name }}:

flipside_platform/templates/app_templates/django_site/salt/pillar/django_site_secrets.sls

@@ -0,0 +1,8 @@
+# Put your secrets here like
+
+# django_site:
+#   ssl_key: |
+#     MYKEY
+#   ssl_cert: |
+#     MYCERT
+

flipside_platform/templates/app_templates/django_site/salt/pillar/top.sls

@@ -1,3 +1,4 @@
 base:
   '*':
+    - django_site_secrets
     - django_site

flipside_platform/templates/app_templates/django_site/salt/state/django_site.sls

@@ -1,3 +1,5 @@
+{% raw -%}
+{% from "nginx/ng/map.jinja" import nginx with context -%}
 include:
   - memcached
   - nginx.ng
@@ -13,3 +15,24 @@ python3-pip:
 
 python-virtualenv:
   pkg.installed
+
+{% if pillar.django_site.get('ssl_cert') -%}
+app-{{ pillar.django_site.app_name }}-nginx-cert:
+  file.managed:
+    - name: {{ pillar.django_site.ssl_cert_path }}
+    - makedirs: True
+    - mode: 660
+    - user: {{ nginx.lookup.webuser }}
+    - group: root
+    - contents_pillar: django_site:ssl_cert
+
+app-{{ pillar.django_site.app_name }}-nginx-key:
+  file.managed:
+    - name: {{ pillar.django_site.ssl_key_path }}
+    - makedirs: True
+    - mode: 660
+    - user: {{ nginx.lookup.webuser }}
+    - group: root
+    - contents_pillar: django_site:ssl_key
+{% endif -%}
+{% endraw -%}