How do I serve Kinto via https from a docker container?

Question

As written in the Kinto docs, I can specify a custom configuration this way:

docker run --env-file ./kinto.env -p 8888:8888 kinto/kinto-server.

Also, it seems I can suggest an http scheme using the http_scheme property.

Now, if I:

1. Put KINTO_HTTP_SCHEME=https in the kinto.env file;
2. Run Kinto via the command above, and;
3. Go to https://example.com:8888/v1/;

I get a blank page.

Additional Info

If I navigate to http://example.com:8888/v1/ instead, I get the usual JSON config stamped on the page. This JSON also contains a url property which is https://example.com:8888/v1/ (and not http://example.com:8888/v1/), so something seems to be happening: the .env file is read. The link is clickable, but if I click it I still get a blank page.

Is this a bug? How do I fix this?

---

Notes

It is important because Chrome won't allow me to serve http content if the page is served via https. It completely blocks out the request, showing an appropriate error in the console: d Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure resource 'http://example.com:8888/v1/'. This request has been blocked; the content must be served over HTTPS.

Kinto says: Fetch API cannot load http://example.com:8888/v1/. Failed to start. Error: HTTP 0; TypeError: Failed to fetch(…)

Answer 1

It depends how you run Kinto. pserve uses the waitress server by default, which doesn't have any HTTPS suppport.

Alternative servers can be used as a replacement (gunicorn or uwsgi for instance) as a replacement for pserve, by specifying it in the .ini file.

Here are pointers to the proper documentation:

• gunicorn: http://docs.gunicorn.org/en/latest/settings.html?highlight=ssl#ssl
• uwsgi: http://uwsgi-docs.readthedocs.org/en/latest/HTTPS.html

For instance, with unicorn it would look like this:

[server:main]
use = egg:gunicorn
host = 0.0.0.0
port = 5900
workers = 1
worker_class = gevent

And then configure gevent to do the SSL:

certfile=~/ssl/server.crt
keyfile=~/ssl/server.key
ssl_version=3

For uwsgi, you have a default configuration in the documentation, seehttp://kinto.readthedocs.org/en/latest/configuration/production.html?highlight=uwsgi#running-with-uwsgi

Hope that helps.

Or, you can use NGINX or haproxy to do the SSL termination for you.

Answer 2

Never used Kinto, but from the documentation:

The environment variables are exactly the same as the settings, but they > are capitalised and . are replaced by _.

For example, kinto.storage_backend is read from environment variable KINTO_STORAGE_BACKEND if defined.

So, the environment variable you want to set in your kinto.env file is KINTO_HTTP_SCHEME, rather than HTTP_SCHEME.