I will love the light for it shows me the way, yet I will endure the darkness because it shows me the stars.

— Og Mandino

Tomb of Flavia Iulia Helena Augusta, Empress of the first Christian Empire.

Memento, homo, quia pulvis es, et in pulverem reverteris.

“Remember, man, that thou art dust, and to dust thou shalt return.”

In my last blog post, I shared the story on how did I set my server up. I mentioned that I’d be writing about getting SSL certificates, so here you go.

When I started working on a remote server somewhere out there in the globe and letting that come in into my private space, (my home machine) I realised I needed to be much more careful, and secure.

The first step to attain security was to set up a firewall to control unwanted incoming intrusions.
The next step was to create a reverse proxy in nginx :

Let us assume we’re running a docker container, a CentOS 7 host, using the latest ghost image. So first, one has to install docker, nginx and start the docker service:

yum install docker nginx epel-release vim -y

Along with docker and nginx we are also installing epel-release from which we will later get Certbot, for the next part of our project and vim if you prefer to.

systemctl start docker

Next I started the docker container, I am using ghost as an example here.

docker run -d --name xyz -p 127.0.0.1:9786:2368 ghost:1.21.4

Running the docker container in background. I am exposing the container’s port 2368 to the port 9786 of the localhost, (using ghost as an example in this case.)

sudo vim /etc/nginx/conf.d/xyz.anweshadas.in.conf

Now we have to set up nginx for the server name xyz.anweshadas.in, in a configuration file named xyz.anweshadas.in.conf. The configuration looks like this

server {
        listen 80;

        server_name xyz.anweshadas.in;

        location / {
                # proxy commands go here as in your port 80 configuration

                proxy_pass http://127.0.0.1:9786/;
                proxy_redirect off;
                proxy_set_header HOST $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_set_header X-Real-IP $remote_addr;
                    }
}

In the above mentioned configuration we are receiving the http requests
on port 80. We are forwarding all the requests for xyz.anweshadas.in to the port 9786 of our localhost.

Before we can start nginx, we have to set up a SELinux boolean so that the nginx server can connect to any port on localhost.

setsebool httpd_can_network_connect 1 -P

systemctl start nginx

Now you will be able to see the ghost running at http://xyz.anweshadas.in.

To protect one’s security and privacy in the web sphere it is very important to know that the people or objects one is communicating with, are actually who they claim to be.
In such circumstances, TLS certificates is what we rely on. Let’s Encrypt is one such certificate authority, that provides certificates.

It provides certificates for Transport Layer Security (TLS) encryption via an automated process. Certbot is the client side tool (from the EFF) to get a certificate from Let’s Encrypt.

So we need a https (secure) certificate for our server by installing certbot.
Let’s get started

yum install certbot

mkdir -p /var/www/xyz.anweshadas.in/.well-known

We now need to make a directory named .well-known, in /var/www/xyz.anweshadas.in, where we will get the certificate for validation by Let’s Encrypt certificate.

chcon -R -t httpd_sys_content_t /var/www/xyz.anweshadas.in

This SELinux context of the directory, xyz.anweshadas.in.

Now we need to enable the access of the .well-known directory under our domain, that Let’s Encrypt can verify. The configuration of nginx, is as follows

server {
        listen 80;

        server_name xyz.anweshadas.in;

        location /.well-known {
                alias /var/www/xyz.anweshadas.in/.well-known;
        }

        location / {
                  # proxy commands go here as in your port 80 configuration

                  proxy_pass http://127.0.0.1:9786/;
                  proxy_redirect off;
                  proxy_set_header HOST $http_host;
                  proxy_set_header X-NginX-Proxy true;
                  proxy_set_header X-Real-IP $remote_addr;
         }

}

certbot certonly --dry-run --webroot -w /var/www/xyz.anweshadas.in/ -d xyz.anweshadas.in

We are performing a test run of the client, by obtaining the test certificates, through placing files in a webroot, but not actually saving them in the hard drive. To have a dry-run is important because the number of time one can get certificates for a particular domain a limited number of time (20 times in a week). All the subdomains under a particular domain are counted separately. To know more, go to the manual page of Certbot.

certbot certonly --webroot -w /var/www/xyz.anweshadas.in/ -d xyz.anweshadas.in

After running the dry-run successfully, we will rerun the command agian without dry-run to get the actual certificates. In the command we are providing the webroot using -w pointing to /var/www/xyz.anweshadas.in/ directory for the particular domain(-d) named xyz.anweshadas.in.

Let us add some more configuration to nginx, so that we can access the https version of our website.

vim /etc/nginx/conf.d/xyz.anweshadas.in.conf

The configuration looks like:

server {
    listen 443 ssl;

    # if you wish, you can use the below line for listen instead
    # which enables HTTP/2
    # requires nginx version >= 1.9.5
    # listen 443 ssl http2;

    server_name xyz.anweshadas.in;

    ssl_certificate /etc/letsencrypt/live/xyz.anweshadas.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/xyz.anweshadas.in/privkey.pem;

    # Turn on OCSP stapling as recommended at
    # https://community.letsencrypt.org/t/integration-guide/13123
    # requires nginx version >= 1.3.7
    ssl_stapling on;
    ssl_stapling_verify on;

    # modern configuration. tweak to your needs.
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;

    # Uncomment this line only after testing in browsers,
    # as it commits you to continuing to serve your site over HTTPS
    # in future
    # add_header Strict-Transport-Security "max-age=31536000";


    # maintain the .well-known directory alias for renewals
    location /.well-known {

        alias /var/www/xyz.anweshadas.in/.well-known;
    }

    location / {
        # proxy commands go here as in your port 80 configuration

        proxy_pass http://127.0.0.1:9786/;
        proxy_redirect off;
        proxy_set_header HOST $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

To view https://xyz.anweshadas.in, reload nginx.

systemctl reload nginx

In case of any error, go to the nginx logs.

If everything works fine, then follow the below configuration.

server {
        listen 80;

        server_name xyz.anweshadas.in;

        location /.well-known {
            alias /var/www/xyz.anweshadas.in/.well-known;
        }

        rewrite ^ https://$host$request_uri? ;

}
server {
    listen 443 ssl;

    # if you wish, you can use the below line for listen instead
    # which enables HTTP/2
    # requires nginx version >= 1.9.5
    # listen 443 ssl http2;

    server_name xyz.anweshadas.in;

    ssl_certificate /etc/letsencrypt/live/xyz.anweshadas.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/xyz.anweshadas.in/privkey.pem;

    # Turn on OCSP stapling as recommended at
    # https://community.letsencrypt.org/t/integration-guide/13123
    # requires nginx version >= 1.3.7
    ssl_stapling on;
    ssl_stapling_verify on;

    # modern configuration. tweak to your needs.
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;


    # Uncomment this line only after testing in browsers,
    # as it commits you to continuing to serve your site over HTTPS
    # in future
    #add_header Strict-Transport-Security "max-age=31536000";


    # maintain the .well-known directory alias for renewals
    location /.well-known {

        alias /var/www/xyz.anweshadas.in/.well-known;
    }

    location / {
    # proxy commands go here as in your port 80 configuration

    proxy_pass http://127.0.0.1:9786/;
    proxy_redirect off;
    proxy_set_header HOST $http_host;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Real-IP $remote_addr;
    }
}

The final nginx configuration [i.e., the /etc/nginx/conf.d/xyz.anweshadas.in.conf] looks like the following, having the rewrite rule, forwarding all http requests to https. And uncommenting the “Strict-Transport-Security” header.

server {
        listen 80;

        server_name xyz.anweshadas.in;

        location /.well-known {
            alias /var/www/xyz.anweshadas.in/.well-known;
         }

        rewrite ^ https://$host$request_uri? ;

}

server {
        listen 443 ssl;

        # if you wish, you can use the below line for listen instead
        # which enables HTTP/2
        # requires nginx version >= 1.9.5
        # listen 443 ssl http2;

        server_name xyz.anweshadas.in;

        ssl_certificate /etc/letsencrypt/live/xyz.anweshadas.in/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/xyz.anweshadas.in/privkey.pem;

        # Turn on OCSP stapling as recommended at
        # https://community.letsencrypt.org/t/integration-guide/13123
        # requires nginx version >= 1.3.7
        ssl_stapling on;
        ssl_stapling_verify on;

        # modern configuration. tweak to your needs.
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;


        # Uncomment this line only after testing in browsers,
        # as it commits you to continuing to serve your site over HTTPS
        # in future
        add_header Strict-Transport-Security "max-age=31536000";


        # maintain the .well-known directory alias for renewals
        location /.well-known {

            alias /var/www/xyz.anweshadas.in/.well-known;
    }

        location / {
        # proxy commands go here as in your port 80 configuration

        proxy_pass http://127.0.0.1:9786/;
        proxy_redirect off;
        proxy_set_header HOST $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header X-Real-IP $remote_addr;
        }
}

So, now hopefully the website shows the desired content at the correct url now.

For this particular work, I am highly indebted to the Linux for You and Me, book, which actually introduced and made me comfortable with the Linux Command line.

Is PyCon 2018 your first PyCon? Then you must have had a sleepless night. You must be thinking “I will be lost in the gathering of 3500 people.” There should be a lot of mixed emotions and anticipation. Are you the only one who is thinking this way? Do not worry it is same with everyone. How can I assure that? I had my first PyCon US in 2017 and I too like you and everyone else had gone through the same feeling.

Registration:

Once you enter the area the first thing you have to do is to register yourself. The people at the registration desk are really helpful so do not hesitate to ask your heart out. If there is a problem ever helpful Jackie will be there to guide you. (If you meet her please say her “hi” for me :) ). And if you are volunteering please welcome first timers specially, it really makes them feel at home.

The registration is done and you have the schedule now. Mark the talks you want to attend and their respective halls too. You might want to set an alarm for that, as you might tend to miss them being busy in the hallway tracks (trust me I have missed a few!).

So now what to do? What are the interesting things to do in PyCon?

Hallway tracks

Hallway tracks are the best place to find friends. For many people this is the core of the conference. Many people prefer to attend hallway tracks more than actual talks :). People gather on the hallway and discuss not only Python or programming but culture, politics, business, food several non connected topic. Choose a conversation you are comfortable with and join. You might get your next project idea there. The same rule applies to the lunch time also. Do not be shy to talk to the person next to you. You might find the person who wanted to meet. People are welcoming here. Ask them if you can join they would generally love the idea. If you are regular at PyCon please include a new PyCon attendee in your group :)

Booth visit

The sponsors are the people who makes the conference run. So visit them. You might find the new, interesting gig you are looking for. And yes do not forget to collect the cool swags.

5k Fun Run/Walk

If you love to run, you may like to join the 5K run. Ashley, is there at the 5K Fun Run/ Walk booth (turn to the right of registration booth) to help.Please pick up your bib, shirt, and information on getting to the park!

Board game night

Inquire about the board game night, if you are interested.

PyLadies Lunch

It is the lunch by and for the PyLadies. A gathering of women who love to code in Python. If you consider yourself a PyLady do attend it, talk about your local PyLadies chapter, your hardels and success. You never know one of your personal story might inspire another PyLady to grow and face her own struggle. You will find similar minded people over there. And never miss to give shout out for the PyLady who in anyway had inspired you. You may always take names instead of a name. If you are there please raise a toast on my behalf for Naomi, Lorena, Ewa, Carol, Betsy,Katie, Lynn,Jackie and yourself too :). So register now.

No photo please

PyCon gives you the space/right to be anonymous, not to be clicked. If you do not want to be clicked please get out of the frame and convey your wish. You can also ask the person to delete the photo which mistakenly has you.

The pronoun you prefer

While registering take the 'The pronoun I prefer' badge.

PyLadies Auction

Saturday night is the PyLadies auction. Be a part of this fun fair (with a good cause). Read about it here.

Quite room

If you want to work, want to be left alone, need some space in the gathering of 3500 people find the quite room.

First time speaker?

Are you speaking for the first time in PyCon? Nervous? Do not want to leave any room for mistake? Want to rehears your talk? There is a speakers room to practice. Another easy way to rehears is, grab someone (whose opinion you value) and give the talk to her. This will give you a proper third eye view and tentative response of the audience. Last year Naomi helped me to do this. She sat with me for hours and corrected me. Never had a chance to say, “Thank you Naomi”.

Poster Presentation and Open Spaces

Do not forget to visit Poster Presentation and Open Spaces and know what is happening at the current Python world.

Code of Conduct

PyCon as [Peter] says is the “holy gathering of the Python tribe”, we all are the part of a diverse community, please respect that. Follow the Code of Conduct. This is the rule book and at all time, you have to abide by. If you have any issue please do not hesitate to contact the staff. Be rest assured that they will take required measures. Lastly do not hold yourself back form saying “sorry” and “thank you”. These two magically words can solve many problems.

One thing for sure your life after these 3days will be completely different. You will be back wealthy with knowledge, lovely memory and friends.

PS: A huge shout out for the PyCon staff for working relentlessly over the year to put up this great PyCon to you. And thank you for coming a =nd attending PyCon and making it a great event it is.