Encrypted Connection and HTTPS Configuration of ohpm-repo in HarmonyOS Next

In HarmonyOS Next development, the data security of the ohpm-repo private repository is of vital importance. Through HTTPS encrypted connections, the security of data during transmission can be effectively protected, preventing data from being stolen or tampered with. Next, I will, combined with practical experience, provide a detailed analysis of how ohpm-repo protects data transmission through HTTPS and carry out relevant configurations.

How to Enable HTTPS Listening to Ensure Data Security?

Modification of the listen Configuration

In ohpm-repo, the key to enabling HTTPS listening lies in modifying the listen configuration item in the config.yaml file. By default, the configuration value of listen is http://localhost:8088, using the HTTP protocol and only listening on the local address. To enhance security, we need to modify it to use the HTTPS protocol and specify the specific machine IP. For example:

listen: https://:8088

Here, needs to be replaced with the actual server IP address. After this modification, ohpm-repo will use the HTTPS protocol to listen on the specified IP and port, ensuring the encryption of data transmission.

SSL Certificate Management

Enabling HTTPS requires configuring SSL certificates, including the private key file (https_key) and the certificate file (https_cert). We can use the OpenSSL tool to generate a self-signed certificate. The sample commands are as follows:

openssl genrsa -out server.key 4096
openssl req -new -x509 -days 3650 -key server.key -out server.crt

After generating the certificate, configure the paths of https_key and https_cert in the config.yaml file:

https_key:./ssl/server.key
https_cert:./ssl/server.crt

Ensure that the ssl directory exists and the permission settings are correct. Only the user running ohpm-repo should have read permissions to prevent the certificate file from being leaked.

Configuration of Reverse Proxy and Secure Communication for Multiple Instances

Nginx Proxy

In the scenario of multi-instance deployment, the Nginx reverse proxy can play an important role. It can not only hide the real IP addresses of the backend ohpm-repo instances but also uniformly process and distribute requests. First, you need to install and configure the Nginx server. Add the following configuration to the Nginx configuration file:

server {
    listen       443 ssl;
    server_name  your_domain.com; # Replace with the actual domain name

    ssl_certificate /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;

    location / {
        proxy_pass http://ohpm-repo-instances; # Point to the ohpm-repo instance cluster
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

upstream ohpm-repo-instances {
    server instance1_ip:port;
    server instance2_ip:port;
    # Add more instances according to the actual situation
}

In the above configuration, ssl_certificate and ssl_certificate_key specify the paths of the SSL certificates, which should be consistent with the certificates in the ohpm-repo configuration. proxy_pass forwards requests to the ohpm-repo instance cluster, and some necessary request header information is set through proxy_set_header to ensure that the backend instances can obtain the correct client information.

Configuration of the use_reverse_proxy Parameter

In the config.yaml file of ohpm-repo, the use_reverse_proxy parameter also needs to be configured to ensure coordinated work with the reverse proxy server. Set use_reverse_proxy to true:

use_reverse_proxy: true

At the same time, according to the Nginx configuration, set store.config.server to the domain name or IP address of the reverse proxy server:

store:
  config:
    server: http://your_domain.com # Replace with the address of the reverse proxy server

In this way, ohpm-repo can cooperate with the Nginx reverse proxy server to achieve secure communication for multiple instances.

Best Practices: How to Prevent Data Leakage?

Certificate Management

Regularly updating SSL certificates is an important measure to prevent data leakage. Once the certificate expires, it may lead to insecure connections. Therefore, a reminder mechanism should be set up to replace the certificate in a timely manner. At the same time, strictly keep the private key of the certificate confidential, store it in a secure location, and limit access permissions to avoid the leakage of the private key. For example, the private key file can be stored in a dedicated key management system, and only specific administrators are allowed to access it.

HSTS Configuration

HTTP Strict Transport Security (HSTS) is a security policy that can force browsers to use HTTPS connections and prevent users from accessing websites through insecure HTTP connections. In the Nginx configuration, relevant HSTS configurations can be added:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

In the above configuration, max-age specifies the validity period of the HSTS policy in seconds; includeSubDomains means that the policy applies to all subdomains; preload can add the website to the browser's HSTS preload list to further improve security.

TLS Version Control

Transport Layer Security (TLS) is the core encryption technology of the HTTPS protocol. Different versions of TLS have different security features and vulnerabilities. Therefore, insecure TLS versions should be disabled in a timely manner, and only the latest secure version should be enabled. In the Nginx configuration, the TLS version can be controlled in the following way:

ssl_protocols TLSv1.3;

In this way, Nginx will only allow encrypted communication using the TLSv1.3 protocol, effectively enhancing the security of data transmission.

Through the detailed analysis of the encrypted connection and HTTPS configuration of ohpm-repo above, as well as the introduction of relevant best practices, it is hoped that everyone can master how to build a secure and reliable communication environment for ohpm-repo, protect the security of data transmission, and prevent data leakage. In practical applications, adjust the configuration flexibly according to specific needs and scenarios to ensure the security and stability of the system.