Go to the /etc/ssl directory.

Generate a private key and the self-signed certificate.

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /etc/ssl/private/progate.key \
-out /etc/ssl/certs/progate.crt

Place the progate.crt file in the /etc/ssl/certs/ directory.

Place the progate.key file in the /etc/ssl/private/ directory.

The progate.crt and progate.key files must be owned by the administrator (root) with 644 rw-r--r-- and 600 rw------- access rights, respectively. To change access rights, execute the following command:

chown root:root /etc/ssl/certs/progate.crt /etc/ssl/private/progate.key
chmod 600 /etc/ssl/private/progate.key
chmod 644 /etc/ssl/certs/progate.crt

Create the /etc/nginx/conf.d/progate.example.com.conf configuration file of the virtual server with the following content:

 server {
     listen 80 default_server;
     server_name _;

     return 301 https://progate.example.com$request_uri;
 }

 server {
     listen 443 ssl default_server;
     server_name progate.example.com;

     ssl_certificate /etc/ssl/certs/progate.crt;
     ssl_certificate_key /etc/ssl/private/progate.key;

     ssl_protocols TLSv1.3;
     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
     ssl_prefer_server_ciphers off;
     sub_filter_once off;
     sub_filter **CSP_NONCE** $request_id;
     add_header X-Frame-Options "SAMEORIGIN";
     add_header X-Content-Type-Options "nosniff";
     add_header X-XSS-Protection "1; mode=block";
     add_header Strict-Transport-Security "max-age=31536000";
     add_header Content-Security-Policy "
         default-src 'none';
         script-src 'self' 'nonce-$request_id';
         style-src 'self' 'nonce-$request_id';
         img-src 'self' data:;
         font-src 'self';
         connect-src 'self';
         form-action 'self';
         base-uri 'self';
         frame-ancestors 'none';
         frame-src 'none';
         object-src 'none';
     " always;

     root /opt/pgpro/progate/ui;

     location = /docs {
         try_files /index.html =404;
     }

     location = /docs/ {
         try_files /index.html =404;
     }

     location ~ ^/docs/(ru|en)/ {
         try_files $uri =404;
     }

     location / {
         index index.html;
         try_files $uri $uri/ /index.html;
     }

     location /api {
         try_files $uri @api;
     }

     location @api {
         proxy_pass http://127.0.0.1:8081;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_read_timeout 180s;

     }

     location ~ /\.(ht|git|svn|env) {
         deny all;
     }

     location ~ /\. {
         deny all;
     }
 }

For the documentation section in the web application to operate correctly, configure routing for the /docs path. To do this, set separate location parameters for /docs. If you specify only common location / with try_files, requests to /docs and /docs/ may be handled differently than the web application expects (including documentation access errors). Specify the following parameters:

Check that the configuration is correct by running the nginx -t command. If no errors occur, the output is as follows:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

In case of errors, check that all the parameters above are specified correctly.

If no errors are found, restart the web server by executing systemctl restart nginx. After the successful restart, the Postgres ProGate web application will be available at https://progate.example.com.