gunicorn with HTTPS TLS 1.3

[info-sic]

As you might already assume, my knowlegde of Python, poetry, github and gunicorn is questionable, please be patient. It's a steep learning curve.

From pandora.circle.lu I learned, that it's running on 443/tcp: I assume, that's in generic.json?
Also it using TLS 1.3, according to the gunicorn docs, that needs a config file.
Is there a
--config FILE added somewhere in start.py or how was that done? I found a config.py in the virtual env, where
class NewSSLContext(Setting): has an example for a def that sets minimum requirements to TLS 1.3, but it is comment out.
What would break if I use that? Will it be gone after the next poetry run update?

At least I'll know how to get a certificate from our CA, but: what would be a safe place to store that? And where to hide the keyfile?
Any help appreciated, no need to hurry...

[Rafiot]

We run it behind a reverse proxy using more or less this approach: https://docs.gunicorn.org/en/stable/deploy.html

with the TCP option:

    # for a TCP configuration
    server localhost:6100 fail_timeout=0;

[info-sic]

Would you mind posting your nginx.conf here?

[Rafiot]

The one above is probably more recommended, but I use this one https://github.com/Lookyloo/lookyloo/blob/main/etc/nginx/sites-available/lookyloo

With one change : proxy_pass http://localhost:6100/;

[Rafiot]

then, you need to create and configure a certificate. For that, I recommend using certbot: https://blog.tekspace.io/how-to-setup-lets-encrypt-ssl-certificate-with-nginx-on-ubuntu-22-04/