Merge pull request #2947 from open-craft/ekolpakov/insights_ssl

Enabling SSL for insights

playbooks/roles/insights/defaults/main.yml

@@ -127,6 +127,7 @@ INSIGHTS_CONFIG:
 INSIGHTS_NEWRELIC_APPNAME: "{{ COMMON_ENVIRONMENT }}-{{ COMMON_DEPLOYMENT }}-analytics-api"
 INSIGHTS_PIP_EXTRA_ARGS: "-i {{ COMMON_PYPI_MIRROR_URL }}"
 INSIGHTS_NGINX_PORT: "18110"
+INSIGHTS_NGINX_SSL_PORT: "18113"
 INSIGHTS_GUNICORN_WORKERS: "2"
 INSIGHTS_GUNICORN_EXTRA: ""
 INSIGHTS_COURSE_API_URL: "{{ INSIGHTS_LMS_BASE }}/api/course_structure/v0/"

playbooks/roles/nginx/templates/edx/app/nginx/sites-available/insights.j2

@@ -7,6 +7,15 @@ upstream insights_app_server {
 server {
   listen {{ INSIGHTS_NGINX_PORT }} default_server;
 
+  {% if NGINX_ENABLE_SSL %}
+  listen {{ INSIGHTS_NGINX_SSL_PORT }} ssl;
+
+  ssl_certificate /etc/ssl/certs/{{ NGINX_SSL_CERTIFICATE|basename }};
+  ssl_certificate_key /etc/ssl/private/{{ NGINX_SSL_KEY|basename }};
+  # request the browser to use SSL for all connections
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
+  {% endif %}
+
   location ~ ^/static/(?P<file>.*) {
     root {{ COMMON_DATA_DIR }}/{{ insights_service_name }};
     try_files /staticfiles/$file =404;