Question with using Airflow with HTTPS

[kivismik]

Hi,
Currently we use an AWS ELB to expose Airflow's Web UI to our users. The problem is that when they the URL directly https://airflow.domain.fi/ Airflow tries to execute a redirect to http://airflow.domain.fi/admin, dropping the HTTPS scheme. We discovered that flask supports setting the default scheme (http://stackoverflow.com/questions/14810795/flask-url-for-generating-http-url-instead-of-https) but where do we put the config value for airflow to pick it up? We tried airflow.cfg but it didn't work.

All help is much appreciated,
B.R.,
Mikko Kivistö

[mistercrunch]

From the creator of flask:
"The WSGI middleware is how you are supposed to fix it. This is not something Flask does. SERVER_NAME has nothing to do with that. The SERVER_NAME flag is for subdomain detection and for generating URLs in background scripts."
pallets/flask#1065

[mistercrunch]

I'm fine adding whatever hook you need for this to work, I'm just ensure on what the hook is... Something on the Tornado configuration around here?
https://github.com/airbnb/airflow/blob/master/airflow/bin/cli.py#L247

[kivismik]

It seems that problem is this line, where it asks for a redirect but dropps the HTTPS-scheme and tries a redirect to HTTP-page that causes the ELB not to function, as it works only HTTPS-connections.

[neovintage]

I did some work on this and it comes down to the url scheme in flask. If you can redirect to that and your whatever you're using to proxy requests ELB in this case uses X-Forwarded-Proto in the headers, then this is fixable.

This gist (https://gist.github.com/neovintage/d93baefc7f623a8f599f) is a plugin that you can add to your installation to add SSL support. Ideally, this should really be merged into master and a config option added. We don't want passwords and things flying over the wire in plain text.

If @mistercrunch thinks it's worthwhile, I can create a pull request instead of this being a plugin.

We can prob close this issue out too.

[kivismik]

Thanks! This worked like a charm. All we had to do is to drop that py-file into plugins folder! Great!

B.R.,
Mikko

From: Rimas Silkaitis [mailto:[email protected]]
Sent: 30. syyskuuta 2015 18:38
To: airbnb/airflow [email protected]
Cc: Kivistö Mikko [email protected]
Subject: Re: [airflow] Question with using Airflow with HTTPS (#373)

I did some work on this and it comes down to the url scheme in flask. If you can redirect to that and your whatever you're using to proxy requests ELB in this case uses X-Forwarded-Proto in the headers, then this is fixable.

This gist (https://gist.github.com/neovintage/d93baefc7f623a8f599f) is a plugin that you can add to your installation to add SSL support. Ideally, this should really be merged into master and a config option added. We don't want passwords and things flying over the wire in plain text.

If @mistercrunchhttps://github.com/mistercrunch thinks it's worthwhile, I can create a pull request instead of this being a plugin.

We can prob close this issue out too.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/373#issuecomment-144449599.

[kivismik]

In some release this was (or the ssl_everywhere plugin) were broken and we didn't want to path the gunicorn starting starting string, so we changed from ELB SSL termination to Nginx termination