#357 Adding SSL pro

curl get.pow.cx | sh
cd ~/.pow
ln -s ~/code/todo .
brew install nginx
cd /usr/local/etc/nginx
openssl req -new -nodes -keyout server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
mate nginx.conf
mate ~/.powconfig
launchctl stop cx.pow.powd
ENABLE_HTTPS=yes rake middleware
touch tmp/restart.txt
cat example.com.crt example.com-intermediate.crt > example.com-chain.crt
chmod 400 *.key *.crt
sudo chown root *.key *.crt

export ENABLE_HTTPS="yes"
export POW_TIMEOUT=3600

server {
  listen       443;
  server_name  *.dev;

  ssl                  on;
  ssl_certificate      server.crt;
  ssl_certificate_key  server.key;

  ssl_session_timeout  5m;

  ssl_protocols  SSLv2 SSLv3 TLSv1;
  ssl_ciphers  HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers   on;

  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    proxy_redirect off;
    proxy_pass http://127.0.0.1;
  }
}

config.force_ssl = (ENV["ENABLE_HTTPS"] == "yes")
config.ssl_options = {hsts: {expires: 3600}}

before_filter :https_redirect

private

def https_redirect
  if ENV["ENABLE_HTTPS"] == "yes"
    if request.ssl? && !use_https? || !request.ssl? && use_https?
      protocol = request.ssl? ? "http" : "https"
      flash.keep
      redirect_to protocol: "#{protocol}://", status: :moved_permanently
    end
  end
end

def use_https?
  true # Override in other controllers
end

private

def use_https?
  false
end

<%= link_to "Log In", login_url(protocol: "https") %>

# Enable mod_ssl: sudo a2enmod ssl
SSLEngine on
SSLCertificateFile /path/to/example.com.crt
SSLCertificateKeyFile /path/to/example.com-private.key
SSLCertificateChainFile /path/to/example.com-intermediate.crt

ssl                  on;
ssl_certificate      /path/to/example.com-chain.crt;
ssl_certificate_key  /path/to/example.com-private.key;