Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using NGINX to proxy to a cluster of RIAK nodes*. I have a rewrite rule like

rewrite ^/bucket-([a-z]+)/object-([a-zA-Z0-9]+)/(.+)$ /riak/$1/$2 break;

and a location block

location /riak/ {
  proxy_pass      http://riak_servers/riak/;

Which will redirect to one of the RIAK servers. Problem is, users can directly access http://server/riak/ and get directly to the RIAK cluster and bucket information. I want to only allow access to users requesting resources via the rewritten URL. I'd rather avoid any ifs or multiple location blocks to catch everything. I'm probably missing something obvious.

NGINX 1.0.11

*This is generally a bad idea since anyone with access to the NGINX server can put/post stuff into your RIAK cluster. You should prevent all request types except GET and HEAD, also it's probably a good idea to remove andy X-* headers put in by RIAK. I don't think exposing the VClock value is a security issue but best to be safe.

share|improve this question
up vote 2 down vote accepted

Use the internal directive to mark it as an internal location which is not accessible directly.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.