serving multiple docker microservices behind nginx proxy - nginx

Question

I'm trying to figure out how to dynamically proxy several microservices behind a single nginx proxy via docker. I have been able to pull it off with a single app, but I would like to dynamically add microservices. I'm like to do this without restarting nginx and disrupting users.
Is this possible or should i create a config file for each microservice? I've included samples below:
localhost = simple welcome page
localhost/service1 = microservice
localhost/service2 = microservice
localhost/serviceN = microservice
docker-compose.yml
---
version: '2'
services:
app:
build: app
microservice1:
image: registry.local:4567/microservice1:latest
microservice2:
image: registry.local:4567/microservice2:latest
proxy:
build: proxy
ports:
- "80:80"
proxy.conf
server {
listen 80;
resolver 127.0.0.11 valid=5s ipv6=off;
set $upstream "http://app";
location / {
proxy_pass $upstream$request_uri;
}
}

Answer 1

I was also facing the same issue, I had microservices in the Flask and I had to deploy them in a single EC2 instance as a staging environment.
I had the directory structure as below:
SampleProject
|\_microservices
||\
|| \_A
|| |-docker-compose.yml
|| |-Dockerfile
| \
| \_B
| |-docker-compose.yml
| |-Dockerfile
|
|
|\_docker
| \_web
| |-Dockerfile
| |_nginx
| |-nginx.conf
|
|-docker-compose.yml(Nginx)
For Nginx the docker-compose.yml is given below:
version: '3.7'
services:
web:
build:
context: .
dockerfile: ./docker/web/Dockerfile
ports:
- "80:80"
networks:
default:
external:
name: microservices
And the configurations for Nginx is given below:
upstream files_to_text {
server microserviceA:5000;
}
upstream text_cleaning {
server microserviceB:5050;
}
server {
listen 80;
location /microserviceA {
proxy_pass http://files_to_text;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
}
location /microserviceB {
proxy_pass http://text_cleaning;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
}
}
To enforce SSL I used AWS Certificate Manager along with Application Load Balancer.
There are 3 steps:
Create an Application Load Balancer with default settings, In the register targets create a target by picking up your EC2 instance with HTTP protocol.
Monitor the Health of the Target group if healthy then edit the listeners of Application Load Balancer remove the default HTTP listener and add HTTPS listener. While adding HTTPS listener we need to specify the default actions as Forward To and select your target group and in Default SSL certificate select the certificate that you created with AWS Certificate Manager
Final step to add DNS name of Application Load Balancer to your name settings where you have purchased the domains.

Answer 2

Config file for each microservice in /etc/nginx/sites-available/ with a symlink in /etc/nginx/sites-enabled/
sample proxy.conf for each where you put app/microservice1/microservice2 as $MICRO_SERVICE,
upstream REPLACEME_SERVICENAME {
server $MICRO_SERVICE:PORT fail_timeout=0;
}
server {
listen 80;
server_name REPLACEME_SITENAME.REPLACEME_DOMAIN;
proxy_pass http://REPLACEME_SERVICENAME;
}
Force-SSL:
upstream REPLACEME_SITENAME.REPLACEME_DOMAIN {
server $MICRO_SERVICE fail_timeout=0;
}
server {
# We only redirect from port 80 to 443
# to enforce encryption
listen 80;
server_name REPLACEME_SITENAME.REPLACEME_DOMAIN;
return 301 https://REPLACEME_SITENAME.REPLACEME_DOMAIN$request_uri;
}
server {
listen 443 ssl http2;
server_name REPLACEME_SITENAME.REPLACEME_DOMAIN;
# If you require basic auth you can use these lines as an example
#auth_basic "Restricted!";
#auth_basic_user_file /etc/nginx/private/httplock;
# SSL
ssl_certificate /etc/letsencrypt/live/REPLACEME_SITENAME.REPLACEME_DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/REPLACEME_SITENAME.REPLACEME_DOMAIN/privkey.pem;
proxy_connect_timeout 75s;
proxy_send_timeout 75s;
proxy_read_timeout 75s;
proxy_http_version 1.1;
send_timeout 75s;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH";
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_pass http://REPLACEME_SITENAME.REPLACEME_DOMAIN;
}
}
I also have a repo where I build a tiny nginx service for a raspberryPi in my closet that serves everything in my house to the WAN:
https://github.com/joshuacox/local-nginx/
there's a Makefile to help with creating new services as well.