Enabling Https with Apache

Here we suggest you use Let’s Encrypt to get a certificate from a Certificate Authority (CA). If you use a paid ssl certificate from some authority, just skip the first step.

Generate SSL certificate

For users who use Let’s Encrypt, you can obtain a valid certificate via Certbot ACME client

On Ubuntu systems, the Certbot team maintains a PPA. Once you add it to your list of repositories all you’ll need to do is apt-get the following packages.

  1. sudo apt-get update
  2. sudo apt-get install software-properties-common
  3. sudo add-apt-repository ppa:certbot/certbot
  4. sudo apt-get update
  5. sudo apt-get install python-certbot-apache

Certbot has a fairly solid beta-quality Apache plugin, which is supported on many platforms, and automates both obtaining and installing certs:

  1. sudo certbot --apache

Running this command will get a certificate for you and have Certbot edit your Apache configuration automatically to serve it. If you’re feeling more conservative and would like to make the changes to your Apache configuration by hand, you can use the certonly subcommand:

  1. sudo certbot --apache certonly

To learn more about how to use Certbot you can read threir documentation.

If you’re using a custom CA to sign your SSL certificate, you have to enable certificate revocation list (CRL) in your certificate. Otherwise http syncing on Windows client may not work. See this thread for more information.

Enable https on Seahub

Assume you have configured Apache as Deploy Seafile with
Apache. To use https, you need to enable mod_ssl

  1.     sudo a2enmod ssl

On Windows, you have to add ssl module to httpd.conf

  1. LoadModule ssl_module modules/mod_ssl.so

Then modify your Apache configuration file. Here is a sample:

  1. <VirtualHost *:443>
  2.   ServerName www.myseafile.com
  3.   DocumentRoot /var/www
  5.   SSLEngine On
  6.   SSLCertificateFile /path/to/cacert.pem
  7.   SSLCertificateKeyFile /path/to/privkey.pem
  9.   Alias /media  /home/user/haiwen/seafile-server-latest/seahub/media
  11.   <Location /media>
  12.     Require all granted
  13.   </Location>
  15.   RewriteEngine On
  17.   #
  18.   # seafile fileserver
  19.   #
  20.   ProxyPass /seafhttp http://127.0.0.1:8082
  21.   ProxyPassReverse /seafhttp http://127.0.0.1:8082
  22.   RewriteRule ^/seafhttp - [QSA,L]
  24.   #
  25.   # seahub
  26.   #
  27.   SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
  28.   ProxyPass / http://127.0.0.1:8000/
  29.   ProxyPassReverse / http://127.0.0.1:8000/
  30. </VirtualHost>

Modify settings to use https

ccnet conf

Since you change from http to https, you need to modify the value of “SERVICE_URL” in ccnet.conf. You can also modify SERVICE_URL via web UI in “System Admin->Settings”. (Warning: if you set the value both via Web UI and ccnet.conf, the setting via Web UI will take precedence.)

  1. SERVICE_URL = https://www.myseafile.com

seahub_settings.py

You need to add a line in seahub_settings.py to set the value of FILE_SERVER_ROOT. You can also modify FILE_SERVER_ROOT via web UI in “System Admin->Settings”. (Warning: if you set the value both via Web UI and seahub_settings.py, the setting via Web UI will take precedence.)

  1. FILE_SERVER_ROOT = 'https://www.myseafile.com/seafhttp'

Start Seafile and Seahub

  1. ./seafile.sh start
  2. ./seahub.sh start