i am working on nginx and minio on the ubuntu.
the minio server is started from
'nohup /usr/local/bin/minio server /data/tenant1 --address :9001 > /opt/logs/minio.log 2>&1 &#',
and it is working.
then I started the nginx and configure the nginx server with the following configuration.
nano /etc/nginx/sites-available/default
server {
listen 9000;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:9001;
}
}
sudo systemctl restart nginx
from the opening ports, it is clear to see the minio is running on port 9001
minio 9349 root 12u IPv6 35833021 0t0 TCP *:9001 (LISTEN)
nginx 12416 www-data 8u IPv4 36153228 0t0 TCP *:9000 (LISTEN)
At last, the gateway is inactive from the output of ufw status. and my server security group also allows 9000.
however when I tried to visit the minio server dashboard from http://IP:9000/minio , it is not working,
any problem with my configuration?
The MinIO console dashboard listens on a separate port - you need to specify this with the option --console-address :10000 - if you do not specify this, a random port is chosen for you and it will be displayed in MinIO's logs in your /opt/log/minio.log file. The 9001 port in your setup is for the S3 storage API only.
Related
I need help configuring Mercure 0.14 to run on port 3000 on a production server, which nginx will proxy to behind the path /mercure/.
To install Mercure, I did the following:
Grabbed Mercure 0.14 linux x86_64 binary from the release page on github. https://github.com/dunglas/mercure/releases
Unpacked the tarball and moved the mercure binary to /usr/bin/mercure
I set up supervisor with the following configuration (with sensitive info redacted):
# file: /etc/supervisor/conf.d/mercure.conf
[program:mercure]
command=/usr/bin/mercure run
process_name=%(program_name)s_%(process_num)s
numprocs=1
environment=HOME="/home/[redacted]",USER="[redacted]",JWT_KEY=[redacted],SUBSCRIPTIO\
NS="1",CORS_ALLOWED_ORIGINS="[redacted]",USE_FORWARDED_HEADERS="1",PUBLISH_ALLOWED_ORIGIN\
S="http://localhost:3000",directory=/tmp,SERVER_NAME=:3000
autostart=true
autorestart=true
startsecs=5
startretries=10
user=[redacted]
redirect_stderr=false
stdout_capture_maxbytes=1MB
stderr_capture_maxbytes=1MB
stdout_logfile=/var/log/mercure.out.log
stderr_logfile=/var/log/mercure.error.log
Note that I set SERVER_NAME=:3000 in order to run it on port 3000.
Supervisor was able to start the process and shows it as running.
$ sudo supervisorctl status
mercure:mercure_0 RUNNING pid 1410254, uptime 0:09:30
However, I'm not able to curl the server...
$ curl localhost:3000/.well-known/mercure
curl: (7) Failed to connect to localhost port 3000: Connection refused
Finally, I have Nginx set up to proxy requests on port 80 to the mercure server on port 3000. This is my Nginx configuration:
location /mercure/ {
proxy_pass http://127.0.0.1:3000/;
proxy_read_timeout 24h;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
}
However, going to (servername)/mercure/.well-known/mercure results in a 502.
Mercure's logs only show:
{"level":"info","ts":1675706204.7100313,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1675706204.7100613,"msg":"serving initial configuration"}
But there is no error message in the logs.
I think the Nginx part is correct, but for some reason the server is just not running/responding on port 3000. Can anyone help?
I configured nginx and gunicorn to serve flask app. And I started gunicorn with this command
gunicorn --bind 0.0.0.0:5000 wsgi:app My website is accessible from my provided ip address on port 80. However It is accessible on port 5000 as well. It seems my reverse proxy works as it should be, but gunicorn server can be accessible as well.
I'm planning to disable port 5000, but not sure this is the correct, secure way to solve such problem.
This is my nginx conf file:
server {
server_name <my_ip_adress>;
access_log /var/log/nginx/domain-access.log;
location / {
proxy_pass_header Server;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_connect_timeout 10;
proxy_read_timeout 10;
# This line is important as it tells nginx to channel all requests to port 5000.
# We will later run our wsgi application on this port using gunicorn.
proxy_pass http://127.0.0.1:5000/;
}
}
You're binding gunicorn to 0.0.0.0 hence it's available on the external interfaces. Assuming this is just one box, instead:
gunicorn --bind 127.0.0.1:5000 wsgi:app
This no longer listens for requests from external interfaces, meaning all requests must come through nginx.
Of course if you did bind gunicorn to 0.0.0.0 you could make a firewall rule with iptables to DROP traffic to that port from external interfaces.
If you are using a cloud provider they may implement this firewall functionality natively on their platform - for example Security Groups on AWS EC2 would allow you to create a 'webserver' group which only allows traffic through for ports 80 & 443.
I have installed rocket.chat version 0.72.3 on CentOS 7.6 as a private local team chat.
Then for configuring a reverse proxy to force rocket.chat use SSL protocol I installed nginx version 1.12.2 and followed this link https://rocket.chat/docs/developer-guides/mobile-apps/supporting-ssl/ to configure nginx as a reverse proxy.
After the configuration was successful, I have two urls both pointing to my rocket.chat application (http://localhost:3000 and https://localhost:443). I mean rocket.chat is accessible under both of these two links which the http access is redundant.
How can I disable access to rocket.chat via http://localhost:3000?
You need to 1) bind rocketchat service only to localhost interface and 2) let nginx to listen on public interface and to act as proxy (what you probably already did).
So, first open your rocketchat.service file (possibly in /lib/systemd/system/rocketchat.service, but this depends on how you did configure rocketchat service) and in [Service] section add this line:
[Service]
Environment=BIND_IP=127.0.0.1
Don't worry that you already have one (or some) Environment entries, these are aggregated (as for me I have single Environement entry for each variable).
Then open your nginx config (possibly /etc/nginx/sites-enabled/default, but this may differ) and make sure, that server block listens only on port 443 and does its proxy job. My nginx relevant entries look like this:
# Upstreams
upstream backend {
server 127.0.0.1:3000;
}
server {
listen 443;
server_name mydomain.com;
error_log /var/log/nginx/rocketchat.access.log;
ssl on;
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
location / {
proxy_pass http://127.0.0.1:3000/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forward-Proto http;
proxy_set_header X-Nginx-Proxy true;
proxy_redirect off;
}
}
You probably need to reload/restart nginx and rocketchat services and reload config issuing
$ sudo systemctl daemon-reload
command.
For me it works flawlessly.
I resolved this issue by blocking external connections to localhost and allowing internal connections to localhost using iptables:
iptables -A INPUT -p tcp --dport 3000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP
But I'm still wondering isn't there any config related to nginx to sort the issue out?
I have configured .net and nginx on ubuntu and it works in local web perfectly. I have static external ip, I have configured port forwarding on my router (I had done it for postgresql and it works fine from external web so I think I have done it properly) When it comes to nginx and when i type my ip f.e: xx.xx.x.xx:80 in url on computer in another web site is unreachable.
I have opened ports in firewall on linux:
sudo apt-get install ufw
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
Here is my nginx config:
server {
listen 80;
server_tokens off;
location / {
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
I hope, I find solution but still I don't know why it works this way. I have changed listen port to 9000 or any different instead 80 in nginx config and in my router forwarding. Now everything works fine, why port 80 does not work?
I have a node server listening on localhost:8080 and I'd like to use nginx as proxy pass, so i made nginx listen to port 80 incoming connections. However I'm not able to configure nginx config to do the reverse proxying. I do not currently have a domain, only server IP. So I'm guessing server_name has to be set to $host or something?
events{
}
http{
server{
listen 80;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host 127.0.0.1;
}
}
}
If I try to visit my server IP on port 80 I just receive welcome to Nginx page.
You should reload and restart your nginx
sudo service nginx reload
sudo service nginx restart