I'm trying to redirect an APP that already works, to https.
The app is a PWA that is running locally, on 8080 port.
I know that's something in my configuration, because the root works ok, but the sub apps doesn't.
The root is just a html with the routes for the sub apps.
This is the app that I'm trying to redirect: https://github.com/PolymerLabs/multitenant-prpl
This is my configuration file, that I've made with searching around and mixing things into the main nginx configuration file.
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
upstream node-app {
least_conn;
server 192.168.0.9:8080 weight=10 max_fails=3 fail_timeout=30s;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
# https redirection
location / {
return 301 https://$host$request_uri;
}
}
server {
# http2 setup
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name node-app;
# ssl setup
ssl_certificate /etc/nginx/certs/nginx.crt;
ssl_certificate_key /etc/nginx/certs/nginx.key;
ssl_dhparam /etc/nginx/certs/dhparam.pem;
# server redirection
location / {
proxy_pass http://node-app$request_uri;
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
}
}
Probably something is missing.
Thanks in advance.
Images:
The root working.
Another route with the dev tools open, the error is a bit longer.
Related
I am very newbie on NGINX.
In my project, the server is defined in both etc/nginx/nginx.conf and etc/nginx/conf.d/proxy.conf. And etc/nginx/conf.d/proxy.conf is included in nginx.conf
I am not understand the relationship the server's setting in these two files. ex. In nginx.conf, server's setting is listen 80 ; listen [::]:80 ; and in proxy.conf, server's setting is listen 80 proxy_protocol.
In above example, which setting will be used in real communication?
Does the server's setting of proxy.conf overwrite the server's setting of nginx.conf?
or the server's setting of proxy.conf will be merged into server's setting of nginx.conf?
Please find the full conf files as below:
etc/nginx/conf.d/proxy.conf
content: |
client_max_body_size 500M;
server_names_hash_bucket_size 128;
upstream backend {
server unix:///var/run/puma/my_app.sock;
}
server {
listen 80 proxy_protocol;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
large_client_header_buffers 8 32k;
set_real_ip_from 10.0.0.0/8;
real_ip_header proxy_protocol;
location / {
proxy_http_version 1.1;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
proxy_set_header Host $http_host;
proxy_set_header X-NginX-Proxy true;
proxy_buffers 8 32k;
proxy_buffer_size 64k;
proxy_pass http://backend;
proxy_redirect off;
Enables WebSocket support
location /v1/cable {
proxy_pass http://backend;
proxy_http_version 1.1;
proxy_set_header Upgrade "websocket";
proxy_set_header Connection "Upgrade";
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
}
}
}
etc/nginx/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
server {
listen 80 ;
listen [::]:80 ;
server_name localhost;
root /usr/share/nginx/html;
location / {
}
}
}
Nginx selects a server block to process a request based on the values of the listen and server_name directives.
If a matching server name cannot be found, the default server for that port will be used.
In the configuration in your question, the server block in proxy.conf is encountered first, so it becomes the de-facto default server for port 80.
The server block in nginx.conf will only match requests which use the correct host name, i.e. http://localhost
See this document for details.
I am using the current configuration and running it as root:
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
stream {
upstream web {
server 127.0.0.1:8445;
}
upstream tcpsocket {
server 127.0.0.1:8444;
}
map $ssl_preread_alpn_protocols $upstream {
"" tcpsocket;
default web;
}
server {
listen 443;
proxy_pass $upstream;
ssl_preread on;
}
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 8445 ssl;
server_name 127.0.0.1;
ssl_certificate_key /etc/nginx/cert.key;
ssl_certificate /etc/nginx/cert.crt;
ssl_protocols TLSv1.2;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Fix the “It appears that your reverse proxy set up is broken" error.
proxy_pass http://localhost:8443;
proxy_read_timeout 90;
proxy_redirect http://localhost:8443 https://127.0.0.1;
}
}
}
With a requirement to have only one port open (443), I am trying to:
Dispatching http requests to 127.0.0.1:8443 eventually after handling ssl
All "other" requests (I only expect tcp socket connections) to a tcp socket server running at 127.0.0.1:8444
This configuration is working perfectly except that the caller IP changes to 127.0.0.1 for tcp connections.
I don't care about the http caller IP.
I tried the following solutions:
server {
listen 443;
proxy_pass $upstream;
ssl_preread on;
proxy_bind $remote_addr:$remote_port transparent;
}
This causes upstream timed out (110: Connection timed out) while proxying connection
server {
listen 443;
proxy_pass $upstream;
ssl_preread on;
set_real_ip_from 10.0.0.0/8;
real_ip_header X-Real-IP;
real_ip_recursive on;
}
real_ip settings do not work inside the stream block
server {
listen 443;
proxy_pass $upstream;
ssl_preread on;
proxy_protocol on;
}
This causes nginx to fail with error broken header while reading PROXY protocol
Please help!
I am trying to setup tusd with Uppy on https without success. It works well on http.
Here's my nginx conf file:
server {
listen 80;
listen[::]: 80;
server_name
DOMAIN.com
www.DOMAIN.com;
root / srv / users / DOMAIN / apps / DOMAIN / public;
access_log / srv / users / DOMAIN / log / DOMAIN / DOMAIN_nginx.access.log main;
error_log / srv / users / DOMAIN / log / DOMAIN / DOMAIN_nginx.error.log;
proxy_set_header Host $host;
proxy_set_header X - Real - IP $remote_addr;
proxy_set_header X - Forwarded - For $proxy_add_x_forwarded_for;
include / etc / nginx - sp / vhosts.d / DOMAIN.d
/*.nonssl_conf;
include /etc/nginx-sp/vhosts.d/DOMAIN.d/*.conf;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name
DOMAIN.com
www.DOMAIN.com
;
ssl_certificate_key ssl/DOMAIN.key;
ssl_certificate ssl/DOMAIN.combined_crt;
root /srv/users/DOMAIN/apps/DOMAIN/public;
access_log /srv/users/DOMAIN/log/DOMAIN/DOMAIN_nginx.access_ssl.log main;
error_log /srv/users/DOMAIN/log/DOMAIN/DOMAIN_nginx.error_ssl.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-SSL on;
proxy_set_header X-Forwarded-Proto $scheme;
include /etc/nginx-sp/vhosts.d/DOMAIN.d/*.ssl_conf;
include /etc/nginx-sp/vhosts.d/DOMAIN.d/*.conf;
location /files/ {
#resolver 8.8.8.8 4.2.2.2;
proxy_pass http://localhost:3020/files;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
# Disable request and response buffering
proxy_request_buffering off;
proxy_buffering off;
proxy_http_version 1.1;
# Add X-Forwarded-* headers so that response can reference https and
# originating host:port
proxy_set_header X-Forwarded-Host $hostname;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Allow proxying of websockets if required
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 0;
}
}
At another conf file I have this additional configuration:
location / {
proxy_pass $backend_protocol://$backend_host:$backend_port;
}
At Chrome console I have the following output:
upload.js:2 OPTIONS https://DOMAIN/files/2b775a112504ed1222c6ffdd4fbdac03+Dc99JI0Zvgh54FXVfpp5K32GAiZBjV5bY-d9tzj8fDL1FxNKKZrHP_SBE6OERG8SWAm1ZjqtjYMVWSvWCQLba0qsR8krfVBYw8ApHqIBO7DG9Bn1t_tv_a6nuuTuqlXC net::ERR_NAME_NOT_RESOLVED
Notice the domain without the .com extension!
I tried all combinations of configuration, commenting the configuration lines without success. Can you spot the mistake?
A contractor solved it for me and the solution is neat. He did it instead configuring Apache.
At the first nginx conf file he removed the "location /files/" section entirely. At the apache conf file, he added the following lines:
ProxyPass /files http://localhost:3020/files
ProxyPassReverse /files http://localhost:3020/files
And it worked.
This is pretty clearly a network issue which should be a definite mismatch between the data that is advertised in the HTTP Headers and the data transferred over the wire.
It could come from the following:
Server: If a server has a bug with certain modules that changes the content but don't update the content-length in the header or just doesn't work properly. It was the case for the Node HTTP Proxy at some point (see here)
Proxy: Any proxy between you and your server could be modifying the request and not update the content-length header.
This problem could also be the nginx docker container disk space. Just check and if full please clear the files.
Let me know if that helps.
Re-use then adapt (from companion.mywebsite.com to yourdomain.com) this working nginx configuration file :
( don't forget to change also ssl_certificate, ssl_certificate_key and ssl_dhparam )
# For more information on configuration, see:
# * Official English Documentation: http://nginx.org/en/docs/
# * Official Russian Documentation: http://nginx.org/ru/docs/
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
server {
server_name companion.mywebsite.com;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://0.0.0.0:3020;
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/companion.mywebsite.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/companion.mywebsite.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = companion.mywebsite.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 default_server;
listen [::]:80 default_server;
server_name companion.mywebsite.com;
return 404; # managed by Certbot
}}
Then try again... if you get this error:
Nginx Error: The page you are looking for is temporarily unavailable. Please try again later.
Run:
setsebool -P httpd_can_network_connect 1
To fix permission then restart apache
I have a droplet on Digital Ocean, that I am using to host a site and an API for that site.
I would like:
https://example.com to serve the website
https://example.com/api to serve the API, running on port 3000.
Here's my /etc/nginx/nginx.conf file:
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/http-error.log;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server {
server_name example.com; # managed by Certbot
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
# SSL settings
ssl_certificate /path/to/file.pem; # managed by Certbot
ssl_certificate_key /path/to/file.pem; # managed by Certbot
include /path/to/file.conf; # managed by Certbot
ssl_dhparam /path/to/file.pem; # managed by Certbot
proxy_http_version 1.1;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
# Routes
location /api/ {
proxy_pass http://127.0.0.1:3000/;
}
location / {
root /usr/share/nginx/html;
}
error_page 404 /404.html;
location = /40x.html {}
error_page 500 502 503 504 /50x.html;
location = /50x.html {}
}
server {
if ($host = example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name example.com;
return 404; # managed by Certbot
}
}
Serving the static html files works great, but the https://example.com/api/ returns a 502: Bad Gateway error. I don't understand what I am doing wrong... any help would be appreciated. Thank you.
Turns out my config was totally fine. I just need to enable networking on the Droplet. I used this post to do so. Thanks, everyone!
In short:
setsebool httpd_can_network_connect on
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:3000;
}
This normally does not disappoint me. Please try.
I need to install a uWSGI app and Kibana4 / elastic search stack on the same server. The uwsgi app only needs to be used when a user accesses the server via [server_IP]/charts/ and I'd like Kibana4 to be accessed via [Server_IP].
Both listen on port 80 via their own separate conf files and, predictably, the uwsgi app doesn't allow for Kibana4 to receive requests.
How would I adjust my conf files to allow the access I need? I'm a bit confused as to what I need to use (rewrite, redirect, something else?)
Thanks for your time
nginx_conf_for_uwsgi:
server {
server_name 192.168.250.37;
listen 80;
root /usr/local/wsgi;
access_log /var/log/nginx/graph_server/access.log;
error_log /var/log/nginx/graph_server/error.log;
client_max_body_size 500M;
proxy_read_timeout 600;
location / {
include uwsgi_params;
uwsgi_pass 192.168.250.37:9091;
uwsgi_read_timeout 600;
}
}
kibana4.conf:
server {
listen 80;
server_name 192.168.250.37;
#auth_basic "Restricted Access";
#auth_basic_user_file /etc/nginx/htpasswd.users;
location / {
proxy_pass http://192.168.250.37:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
nginx.conf:
user nginx;
worker_processes 4;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
index index.html index.htm;
# Increase header buffer size (needed for PHP)
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
# Update the logs to display the real IP address after removing the IP for
# the load balancers
set_real_ip_from redacted; # a
set_real_ip_from redacted; # b
real_ip_header X-Forwarded-For;
real_ip_recursive on;
# Custom logger to display the subdomain folder (if applicable)
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format log_thing '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$http_x_forwarded_for" sub:"$subdomain"';
log_format i_server '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'filename:"$http_filename"';
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
include /etc/nginx/conf.d/*.conf;
server {
listen 80 default_server;
server_name localhost;
root /usr/share/nginx/html;
include /etc/nginx/default.d/*.conf;
location / {
}
error_page 404 /404.html;
location = /40x.html {
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
}
}
}
One way is to use nginx as a reverse proxy which is effectively what you are doing already. This way you have one nginx virtual host listening on port 80 which forwards different locations to separate nginx vhosts listening on different ports on your system.
You nginx reverse proxy vhost would look something like this, the 3 proxy_set_header lines can be moved to the server block if all locations work with them
server {
listen 80;
server_name 192.168.250.37;
port_in_redirect off
location / {
proxy_pass http://127.0.0.1:8081;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /charts {
proxy_pass http://127.0.0.1:8082;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Then change you Kibanaconf to listen on port 8081 and uwsgi to listen on 8082
Alternatively you can combine the two vhosts into one and will need to set custom aliases for the root folders under each location and rearrange.
server {
listen 80;
server_name 192.168.250.37;
root /usr/local/wsgi;
client_max_body_size 500M;
proxy_read_timeout 600;
#auth_basic "Restricted Access";
#auth_basic_user_file /etc/nginx/htpasswd.users;
location / {
proxy_pass http://192.168.250.37:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
location /charts {
include uwsgi_params;
uwsgi_pass 192.168.250.37:9091;
uwsgi_read_timeout 600;
}
}