HTTPS 上的 CouchDB 权限

Question

更新/总结：

我在这里创建了一篇关于我所经历的过程的博客文章，我的配置文件与下面略有不同： https://medium.com/@silverbackdan/installing-couchdb-2-0-nosql-with-centos-7-and-certbot-lets-encrypt-f412198c3051#.216m9mk1m

HTTPS 的主要问题：

• 如果运行 HTTP 和 HTTPS，分片 dbs 会出现在 HTTPS 上
• HTTPS 上缺少 Fauxton 功能（管理员用户管理、配置管理、设置向导、Mango 索引/查询）
• 不确定它们是否应该，但是通过 HTTP 和 HTTPS 的数据库不一样

我希望我只是错过了一些非常明显的东西

原帖：

我正在尝试使用 CouchDB 2.0 配置 HTTPS (SSL)。我正在编写一份指南供其他人也可以遵循，但遇到了一些问题。

我认为通过 HTTPS，我没有启用 HTTP 并改为使用它时的相同权限。在 Fauxton over HTTP 中，我可以看到配置并且可以运行设置过程。使用 HTTPS 时出现错误，提示我无法创建数据库（它会尝试自动创建），因为它们以下划线开头。大多数数据库都已设置好，但当我访问配置页面时，有一些会显示错误，例如“_cluster_setup”。

此外，我收到重复的错误消息，它不会停止 CouchDB，但它说数据库“_users”不存在（database_does_not_exist）。当我启用并通过 HTTP 连接时它不存在，但当我通过 HTTPS 连接时它确实存在。如果我同时启用 HTTP 和 HTTPS，那么通过我的 HTTPS 连接，我最终会拥有很多分片数据库（我是 NoSQL 和 CouchDB 的新手，所以我不确定这是怎么回事，但是当错误显示类似于以上 - 创建以下划线开头的数据库）。无论哪种方式，当通过 HTTPS 而不是 HTTP 登录时，我都会看到那些分片数据库（Fauxton 将它们显示为“无法加载，然后我现在只是将它们从数据目录中删除）

使用 Chrome 通过 HTTPS 访问 Fauxton 也存在问题，但我认为这是一个已知错误，目前可以使用 Firefox 或 Safari。

谁能告诉我是否有任何设置意味着使用 HTTPS 通过端口 6984 的连接可以具有与 HTTP 的 5984 相同的管理权限？ ...或者可能存在哪些权限问题导致 HTTPS 连接在表名开头出现这些关于下划线的错误，因为我认为这基本上可以解决我的主要问题。

这是我的 local.ini 文件，它可能有一些用处（我还在 default.ini 中注释掉了“;httpd={couch_httpd, start_link, []}”，就像这里所说的那样：https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=48203146

; CouchDB Configuration Settings

; Custom settings should be made in this file. They will override settings
; in default.ini, but unlike changes made to default.ini, this file won't be
; overwritten on server upgrade.

[couchdb]
;max_document_size = 4294967296 ; bytes
;os_process_timeout = 5000
uuid = **REMOVED**

[couch_peruser]
; If enabled, couch_peruser ensures that a private per-user database
; exists for each document in _users. These databases are writable only
; by the corresponding user. Databases are in the following form:
; userdb-{hex encoded username}
;enable = true
; If set to true and a user is deleted, the respective database gets
; deleted as well.
;delete_dbs = true

[chttpd]
;port = 5984
;bind_address = 0.0.0.0
; Options for the MochiWeb HTTP server.
;server_options = [{backlog, 128}, {acceptor_pool_size, 16}]
; For more socket options, consult Erlang's module 'inet' man page.
;socket_options = [{recbuf, 262144}, {sndbuf, 262144}, {nodelay, true}]

[httpd]
; NOTE that this only configures the "backend" node-local port, not the
; "frontend" clustered port. You probably don't want to change anything in
; this section.
; Uncomment next line to trigger basic-auth popup on unauthorized requests.
WWW-Authenticate = Basic realm="administrator"
bind_address = 0.0.0.0
; Uncomment next line to set the configuration modification whitelist. Only
; whitelisted values may be changed via the /_config URLs. To allow the admin
; to change this value over HTTP, remember to include {httpd,config_whitelist}
; itself. Excluding it from the list would require editing this file to update
; the whitelist.
config_whitelist = [{httpd,config_whitelist}, {log,level}, {etc,etc}]

[query_servers]
;nodejs = /usr/local/bin/couchjs-node /path/to/couchdb/share/server/main.js


[httpd_global_handlers]
;_google = {couch_httpd_proxy, handle_proxy_req, <<"http://www.google.com">>}

[couch_httpd_auth]
; If you set this to true, you should also uncomment the WWW-Authenticate line
; above. If you don't configure a WWW-Authenticate header, CouchDB will send
; Basic realm="server" in order to prevent you getting logged out.
require_valid_user = true
secret = **REMOVED**

[os_daemons]
; For any commands listed here, CouchDB will attempt to ensure that
; the process remains alive. Daemons should monitor their environment
; to know when to exit. This can most easily be accomplished by exiting
; when stdin is closed.
;foo = /path/to/command -with args

[daemons]
; enable SSL support by uncommenting the following line and supply the PEM's below.
; the default ssl port CouchDB listens on is 6984
httpsd = {couch_httpd, start_link, [https]}

[ssl]
cert_file = /home/couchdb/couchdb/certs/cert.pem
key_file = /home/couchdb/couchdb/certs/privkey.pem
;password = somepassword
; set to true to validate peer certificates
;verify_ssl_certificates = false
; Set to true to fail if the client does not send a certificate. Only used if verify_ssl_certificates is true.
;fail_if_no_peer_cert = false
; Path to file containing PEM encoded CA certificates (trusted
; certificates used for verifying a peer certificate). May be omitted if
; you do not want to verify the peer.
cacert_file = /home/couchdb/couchdb/certs/chain.pem
; The verification fun (optional) if not specified, the default
; verification fun will be used.
;verify_fun = {Module, VerifyFun}
; maximum peer certificate depth
ssl_certificate_max_depth = 1
;
; Reject renegotiations that do not live up to RFC 5746.
secure_renegotiate = true
; The cipher suites that should be supported.
; Can be specified in erlang format "{ecdhe_ecdsa,aes_128_cbc,sha256}"
; or in OpenSSL format "ECDHE-ECDSA-AES128-SHA256".
;ciphers = ["ECDHE-ECDSA-AES128-SHA256", "ECDHE-ECDSA-AES128-SHA"]
ciphers = undefined
; The SSL/TLS versions to support
tls_versions = [tlsv1, 'tlsv1.1', 'tlsv1.2']

; To enable Virtual Hosts in CouchDB, add a vhost = path directive. All requests to
; the Virual Host will be redirected to the path. In the example below all requests
; to http://example.com/ are redirected to /database.
; If you run CouchDB on a specific port, include the port number in the vhost:
; example.com:5984 = /database
[vhosts]
REMOVEDDOMAIN.COM:* = ./database

[update_notification]
;unique notifier name=/full/path/to/exe -with "cmd line arg"

; To create an admin account uncomment the '[admins]' section below and add a
; line in the format 'username = password'. When you next start CouchDB, it
; will change the password to a hash (so that your passwords don't linger
; around in plain-text files). You can add more admin accounts with more
; 'username = password' lines. Don't forget to restart CouchDB after
; changing this.
[admins]
;admin = mysecretpassword
**REMOVED** = **REMOVED**

[cors]
origins = *
credentials = true
headers = accept, authorization, content-type, origin, referer
methods = GET, PUT, POST, HEAD, DELETE

Answer 1

我通过聊天与 CouchDB 团队取得了联系。 CouchDB 已经使用 haproxy 进行了很好的测试，所以我被建议简单地使用 haproxy，因为 erlang 很难为 SSL 配置。一旦一切正常，我将使用 haproxy 更新我写的文章，并附上完整的说明。