HTTPS and remote access

phaf listens only on the server itself, over plain HTTP, on the port chosen in the installer (8181 by default). To let users work from their own computers, publish it through a reverse proxy that handles HTTPS with your certificate. This page shows IIS, which is part of Windows Server, and nginx as an alternative.

Why a reverse proxy

• Users' passwords and data travel encrypted (TLS 1.2 or 1.3) between their browser and the server.
• You use your own certificate and your organisation's TLS settings.
• phaf stays unreachable from the network on port 8181.

IIS

1. Install IIS, URL Rewrite and ARR

Install-WindowsFeature Web-Server -IncludeManagementTools

Then install two free Microsoft extensions, in this order: URL Rewrite 2.1 and Application Request Routing (ARR) 3.0, from iis.net.

2. Turn on the proxy

This enables ARR as a proxy, keeps the original host name, passes the user's IP address in X-Forwarded-For and allows requests of up to 5 minutes (database migrations and large uploads).

& "$env:windir\system32\inetsrv\appcmd.exe" set config -section:system.webServer/proxy /enabled:"True" /preserveHostHeader:"True" /reverseRewriteHostInResponseHeaders:"False" /timeout:"00:05:00" /commit:apphost

3. Import the certificate

$pfxPassword = Read-Host 'Certificate password' -AsSecureString
Import-PfxCertificate -FilePath C:\Install\phaf.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $pfxPassword
# Note the Thumbprint shown

4. Create the site

New-Item -ItemType Directory -Force C:\phaf\iis
Import-Module WebAdministration
New-Website -Name 'phaf' -PhysicalPath C:\phaf\iis -Port 443 -Ssl -HostHeader 'phaf.your-company.local' -SslFlags 1

$thumb = '<certificate thumbprint>'
(Get-WebBinding -Name 'phaf' -Protocol https).AddSslCertificate($thumb, 'My')

Create C:\phaf\iis\web.config with the proxy rule:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="phaf" stopProcessing="true">
          <match url="(.*)" />
          <action type="Rewrite" url="http://127.0.0.1:8181/{R:1}" />
        </rule>
      </rules>
    </rewrite>
    <security>
      <requestFiltering allowDoubleEscaping="true">
        <!-- phaf accepts requests of up to 64 MB -->
        <requestLimits maxAllowedContentLength="67108864" />
      </requestFiltering>
    </security>
    <httpProtocol>
      <customHeaders>
        <add name="Strict-Transport-Security" value="max-age=31536000" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

The site has only an HTTPS binding, so nothing is served over plain HTTP.

5. TLS versions

Make sure Windows (Schannel) only accepts TLS 1.2 and TLS 1.3, following your organisation's baseline (for example the CIS benchmark for Windows Server). IIS uses the Windows settings.

nginx (alternative)

If you already run nginx for Windows, or nginx on a separate Linux proxy, use this server block:

server {
    listen 443 ssl;
    server_name phaf.your-company.local;

    ssl_certificate     C:/nginx/certs/phaf.crt;
    ssl_certificate_key C:/nginx/certs/phaf.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    client_max_body_size 64m;
    add_header Strict-Transport-Security "max-age=31536000" always;

    location / {
        proxy_pass http://127.0.0.1:8181;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 300s;
    }
}

On a separate proxy server, replace 127.0.0.1 with the phaf server address, set "host" in config.json to the phaf server's own IP, and allow port 8181 only from the proxy in the Windows firewall.

Tell phaf about the proxy

Sign in through the new address and set two things:

1. Settings › Security › Network access — set the proxy header to X-Forwarded-For. phaf then sees each user's real IP address in the audit log and in IP rules, instead of the proxy's.
2. Settings › Alerts — set the phaf address used in email links to https://phaf.your-company.local.

Firewall

Allow HTTPS only from the networks your users work from:

New-NetFirewallRule -DisplayName 'phaf HTTPS' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -RemoteAddress 10.0.8.0/24

Do not create a rule for port 8181.

Test

• From a user's computer, https://phaf.your-company.local opens the phaf sign-in page without a certificate warning
• http://phaf-server:8181 does not answer from that computer
• After signing in, Settings › Security shows your own computer's IP address, not the server's