Attempt to get the Wii U to connect to nginx directly

It doesn't work for some reason, even though TLSv1.0 is enabled in nginx.

compose.yml

@@ -14,19 +14,40 @@ services:
             - type: bind
               source: ./config/mitmproxy.yaml
               target: /home/mitmproxy/mitmproxy-config.yaml
+              read_only: true
             - type: volume
               source: mitmproxy-pretendo-data
               target: /home/mitmproxy/.mitmproxy
         command: mitmweb --web-host 0.0.0.0
         tty: true
 
-    coredns:
+    coredns-public:
+        # This responds to DNS queries from the console, redirecting them to
+        # the host machine. Note that this causes them skip mitmproxy and go
+        # straight to nginx.
+        image: coredns/coredns:latest
+        restart: unless-stopped
+        ports:
+            - 53:53/udp
+        volumes:
+            - type: bind
+              source: ./config/public.Corefile
+              target: /etc/coredns/Corefile
+              read_only: true
+        env_file:
+            - ./environment/system.local.env
+        command: -conf /etc/coredns/Corefile
+
+    coredns-internal:
+        # This responds to DNS queries from the internal network of containers,
+        # redirecting them to the nginx container
         image: coredns/coredns:latest
         restart: unless-stopped
         volumes:
             - type: bind
-              source: ./config/Corefile
+              source: ./config/internal.Corefile
               target: /etc/coredns/Corefile
+              read_only: true
         networks:
             internal:
                 ipv4_address: 172.20.0.200
@@ -35,20 +56,27 @@ services:
     nginx:
         image: nginx:mainline-alpine
         depends_on:
-            - coredns
+            - coredns-internal
+            - mitmproxy-pretendo
         restart: unless-stopped
         ports:
             # HTTP
             - 80:80
-            # HTTPS (currently unused)
+            # HTTPS (supports TLSv1.0 for Wii U)
             - 443:443
         volumes:
             - type: bind
               source: ./config/nginx.conf
               target: /etc/nginx/nginx.conf
+              read_only: true
             - type: bind
               source: ./config/nginx
               target: /etc/nginx/conf.d/
+              read_only: true
+            - type: volume
+              source: mitmproxy-pretendo-data
+              target: /etc/nginx/mitmproxy-certs
+              read_only: true
         networks:
             default:
             internal:
@@ -58,7 +86,7 @@ services:
         # TODO: Set up authentication
         image: mongo:latest
         depends_on:
-            - coredns
+            - coredns-internal
         restart: unless-stopped
         ports:
             # For connecting with mongosh or MongoDB Compass
@@ -67,6 +95,7 @@ services:
             - type: bind
               source: ./config/mongod.conf
               target: /etc/mongod.conf
+              read_only: true
             - type: volume
               source: mongodb-database
               target: /data/db
@@ -78,7 +107,7 @@ services:
     mongo-express:
         image: mongo-express:latest
         depends_on:
-            - coredns
+            - coredns-internal
             - mongodb
         restart: unless-stopped
         ports:
@@ -94,7 +123,7 @@ services:
     minio:
         image: minio/minio:latest
         depends_on:
-            - coredns
+            - coredns-internal
         restart: unless-stopped
         ports:
             # Web console
@@ -114,7 +143,7 @@ services:
     redis:
         image: redis:alpine
         depends_on:
-            - coredns
+            - coredns-internal
         restart: unless-stopped
         volumes:
             - type: volume
@@ -131,7 +160,7 @@ services:
     maildev:
         image: maildev/maildev:latest
         depends_on:
-            - coredns
+            - coredns-internal
         restart: unless-stopped
         ports:
             # MailDev web UI
@@ -151,7 +180,7 @@ services:
     postgres:
         image: postgres:alpine
         depends_on:
-            - coredns
+            - coredns-internal
         restart: unless-stopped
         ports:
             # For connecting with pgAdmin
@@ -163,6 +192,7 @@ services:
             - type: bind
               source: ./scripts/run-in-container/postgres-init.sh
               target: /docker-entrypoint-initdb.d/postgres-init.sh
+              read_only: true
         networks:
             internal:
         dns: 172.20.0.200
@@ -173,7 +203,7 @@ services:
     adminer:
         image: adminer:latest
         depends_on:
-            - coredns
+            - coredns-internal
             - postgres
         restart: unless-stopped
         ports:
@@ -183,6 +213,7 @@ services:
             - type: bind
               source: ./config/adminer-login-servers.php
               target: /var/www/html/plugins-enabled/login-servers.php
+              read_only: true
         networks:
             internal:
         dns: 172.20.0.200
@@ -192,7 +223,7 @@ services:
     account:
         build: ./repos/account
         depends_on:
-            - coredns
+            - coredns-internal
             - nginx
             - mongodb
             - minio
@@ -226,6 +257,7 @@ services:
             - type: bind
               source: ./config/website-config.json
               target: /app/config.json
+              read_only: true
         networks:
             internal:
         dns: 172.20.0.200
@@ -279,6 +311,7 @@ services:
             - type: bind
               source: ./config/juxtaposition-config.js
               target: /app/config.js
+              read_only: true
         networks:
             internal:
         dns: 172.20.0.200

config/Corefile

@@ -1,10 +0,0 @@
-. {
-    log
-    rewrite name regex (.*\.)?nintendo\.net nginx
-    rewrite name regex (.*\.)?nintendowifi\.net nginx
-    rewrite name regex (.*\.)?pretendo\.cc nginx
-    rewrite name regex (.*\.)?pretendo\.network nginx
-    rewrite name regex (.*\.)?pretendo-cdn\.b-cdn\.net nginx
-    rewrite name regex (.*\.)?minio minio
-    forward . /etc/resolv.conf
-}

config/internal.Corefile

@@ -0,0 +1,10 @@
+. {
+    log
+    rewrite name regex (.*\.)?nintendo\.net nginx answer auto
+    rewrite name regex (.*\.)?nintendowifi\.net nginx answer auto
+    rewrite name regex (.*\.)?pretendo\.cc nginx answer auto
+    rewrite name regex (.*\.)?pretendo\.network nginx answer auto
+    rewrite name regex (.*\.)?pretendo-cdn\.b-cdn\.net nginx answer auto
+    rewrite name regex (.*\.)?minio minio answer auto
+    forward . /etc/resolv.conf
+}

config/nginx.conf

@@ -1,7 +1,7 @@
 user nginx;
 worker_processes auto;
 
-error_log /var/log/nginx/error.log notice;
+error_log /var/log/nginx/error.log info;
 pid /var/run/nginx.pid;
 
 
@@ -14,9 +14,9 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-    '$status $body_bytes_sent "$http_referer" '
-    '"$http_user_agent" "$http_x_forwarded_for"';
+    log_format main '$remote_addr - $remote_user [$time_local] ($ssl_protocol '
+    '$ssl_cipher) $host "$request" $status $body_bytes_sent "$http_referer" '
+    '"$http_user_agent" $request_time';
 
     access_log /var/log/nginx/access.log main;
 
@@ -26,5 +26,12 @@ http {
 
     resolver 127.0.0.11 valid=600s;
 
+    ssl_certificate /etc/nginx/mitmproxy-certs/mitmproxy-ca-cert.pem;
+    ssl_certificate_key /etc/nginx/mitmproxy-certs/mitmproxy-ca.pem;
+
+    # The Wii U needs to connect using TLSv1.0
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
+    ssl_ciphers DEFAULT:ECDHE-RSA-AES128-SHA:@SECLEVEL=0;
+
     include /etc/nginx/conf.d/*.conf;
 }

config/nginx/account.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name account.pretendo.cc c.account.pretendo.cc conntest.pretendo.cc
     nasc.pretendo.cc datastore.pretendo.cc api.pretendo.cc assets.pretendo.cc;
 

config/nginx/cdn.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name cdn.pretendo.cc mii.olv.pretendo.cc pretendo-cdn.b-cdn.net;
 
     set $upstream http://pn-cdn.minio:9000;

config/nginx/default.conf

@@ -1,5 +1,6 @@
 server {
     listen 80 default_server;
+    listen 443 ssl default_server;
 
     location / {
         return 404;

config/nginx/juxtaposition.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name juxt.pretendo.network juxt-test.pretendo.network juxt-dev.pretendo.network
     portal.olv.pretendo.cc portal-test.olv.pretendo.cc portal-dev.olv.pretendo.cc
     ctr.olv.pretendo.cc ctr-test.olv.pretendo.cc ctr-dev.olv.pretendo.cc;

config/nginx/miiverse-api.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name api.olv.pretendo.cc api-test.olv.pretendo.cc api-dev.olv.pretendo.cc
     discovery.olv.pretendo.cc discovery-test.olv.pretendo.cc discovery-dev.olv.pretendo.cc;
 

config/nginx/redirect.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name pretendo.cc www.pretendo.cc;
 
     location / {

config/nginx/website.conf

@@ -1,5 +1,6 @@
 server {
     listen 80;
+    listen 443 ssl;
     server_name pretendo.network www.pretendo.network;
 
     set $upstream http://website:8080;

config/public.Corefile

@@ -0,0 +1,13 @@
+. {
+    log
+    rewrite name regex (.*\.)?nintendo\.net server.local answer auto
+    rewrite name regex (.*\.)?nintendowifi\.net server.local answer auto
+    rewrite name regex (.*\.)?pretendo\.cc server.local answer auto
+    rewrite name regex (.*\.)?pretendo\.network server.local answer auto
+    rewrite name regex (.*\.)?pretendo-cdn\.b-cdn\.net server.local answer auto
+    hosts {
+        {$SERVER_IP} server.local
+        fallthrough
+    }
+    forward . /etc/resolv.conf
+}

scripts/run-in-container/create-server-in-database.js

@@ -11,7 +11,7 @@ async function runAsync() {
         "Friend List",
         "0003200",
         ["0005001010001C00"],
-        process.env.COMPUTER_IP,
+        process.env.SERVER_IP,
         process.env.FRIENDS_PORT,
         "dev",
         1,
@@ -29,7 +29,7 @@ async function runAsync() {
         "Wii U Chat",
         "1005A000",
         ["000500101005A100"],
-        process.env.COMPUTER_IP,
+        process.env.SERVER_IP,
         process.env.WIIU_CHAT_PORT,
         "dev",
         1,

scripts/setup-environment.sh

@@ -73,11 +73,11 @@ echo "PN_MIIVERSE_API_CONFIG_AES_KEY=$miiverse_aes_key" >>./miiverse-api.local.e
 echo "JUXT_CONFIG_AES_KEY=$miiverse_aes_key" >>./juxtaposition-ui.local.env
 
 # Get the computer IP address
-printf "What is your computer's IP address? It must be accessible to your consoles: "
-read -r computer_ip
-echo "COMPUTER_IP=$computer_ip" >>./system.local.env
-echo "PN_FRIENDS_SECURE_SERVER_HOST=$computer_ip" >>./friends.local.env
-echo "PN_WIIU_CHAT_SECURE_SERVER_LOCATION=$computer_ip" >>./wiiu-chat.local.env
+printf "What is your server's IP address? It must be accessible to your consoles: "
+read -r server_ip
+echo "SERVER_IP=$server_ip" >>./system.local.env
+echo "PN_FRIENDS_SECURE_SERVER_HOST=$server_ip" >>./friends.local.env
+echo "PN_WIIU_CHAT_SECURE_SERVER_LOCATION=$server_ip" >>./wiiu-chat.local.env
 
 # Get the Wii U IP address
 printf "Enter your Wii U's IP address: "

scripts/update-account-servers-database.sh

@@ -21,7 +21,7 @@ done
 
 docker compose up -d account
 
-docker compose exec -e COMPUTER_IP="$COMPUTER_IP" \
+docker compose exec -e SERVER_IP="$SERVER_IP" \
     -e FRIENDS_PORT="$PN_FRIENDS_AUTHENTICATION_SERVER_PORT" \
     -e FRIENDS_AES_KEY="$PN_FRIENDS_CONFIG_AES_KEY" \
     -e MIIVERSE_AES_KEY="$PN_MIIVERSE_API_CONFIG_AES_KEY" \