6591: Add ssl_certificate lines to sample install nginx configs.

[arvados.git] / doc / install / install-api-server.html.textile.liquid

diff --git a/doc/install/install-api-server.html.textile.liquid b/doc/install/install-api-server.html.textile.liquid
index 090f7ffafd375ddad6ed7323c37fe89b86747cfa..3c188e3828f3145ca59717c425526378149586d9 100644 (file)
--- a/doc/install/install-api-server.html.textile.liquid
+++ b/doc/install/install-api-server.html.textile.liquid
@@ -262,17 +262,31 @@ upstream websockets {
 
 proxy_http_version 1.1;
 
+# When Keep clients request a list of Keep services from the API server, the
+# server will automatically return the list of available proxies if
+# the request headers include X-External-Client: 1.  Following the example
+# here, at the end of this section, add a line for each netmask that has
+# direct access to Keep storage daemons to set this header value to 0.
+geo $external_client {
+  default        1;
+  <span class="userinput">10.20.30.0/24</span>  0;
+}
+
 server {
   listen       <span class="userinput">[your public IP address]</span>:443 ssl;
   server_name  <span class="userinput">uuid_prefix.your.domain</span>;
 
   ssl on;
+  ssl_certificate     <span class="userinput">/YOUR/PATH/TO/cert.pem</span>;
+  ssl_certificate_key <span class="userinput">/YOUR/PATH/TO/cert.key</span>;
 
   index  index.html index.htm index.php;
 
   location / {
     proxy_pass            http://api;
     proxy_redirect        off;
+    proxy_connect_timeout 90s;
+    proxy_read_timeout    300s;
 
     proxy_set_header      X-Forwarded-Proto https;
     proxy_set_header      Host $http_host;
@@ -287,12 +301,16 @@ server {
   server_name  ws.<span class="userinput">uuid_prefix.your.domain</span>;
 
   ssl on;
+  ssl_certificate     <span class="userinput">/YOUR/PATH/TO/cert.pem</span>;
+  ssl_certificate_key <span class="userinput">/YOUR/PATH/TO/cert.key</span>;
 
   index  index.html index.htm index.php;
 
   location / {
     proxy_pass            http://websockets;
     proxy_redirect        off;
+    proxy_connect_timeout 90s;
+    proxy_read_timeout    300s;
 
     proxy_set_header      Upgrade $http_upgrade;
     proxy_set_header      Connection "upgrade";