0

Our current nginx setup handles http/https with a solution similar to the one specified in this answer

nginx.conf

http {
    upstream backend {
        server backend.com
    }
    upstream backend_ssl {
        server backend.com:443
    }
}

sites-available/domain.conf

server {
    listen 80;
    server_name www.domain.com
    location /a/update {
        proxy_pass http://backend;
    }
}

sites-available/domain_ssl.conf

server {
    listen 443 ssl;
    server_name www.domain.com
    location /a/update {
        proxy_pass https://backend_ssl;
    }
}

I'd like to modify this to use the solution mentioned in the official nginx docs for using a single http/https server block. How do I do this in the above scenario as even though the location block url is same, the proxy_pass directive parameter differs for http and https.

5
  • 1
    What the reason to proxy to ssl backend? Usually nginx terminates ssl and proxies to plain http.
    – Alexey Ten
    Oct 27, 2014 at 6:58
  • 1
    Don't bother. Just leave them separate. Oct 27, 2014 at 7:18
  • Makes sense. In fact we have a hardware LB and maybe ssl terminates there. I'm refactoring some extra large nginx configuration and probably the ssl proxy is obsolete now. Need to confirm the same and if so I can just remove the obsolete configuration part.
    – livinston
    Oct 27, 2014 at 7:19
  • The current setup terminates the ssl in LB and still serves traffic via 443 to help distinguish whether the incoming traffic was http or https in the php code which I understand is bad design. Php code was using this info to mark certain cookies as secure. I've moved away from this model by fully terminating ssl at the LB and just setting a header to denote if the incoming connection was https. Then the same fastcgi param used for distinguishing ssl in php is set using this new header.
    – livinston
    Oct 28, 2014 at 4:09
  • @AlexeyTen If the backend needs to be reached through a network, HTTPS might be useful and even recommended. For what it is worth, Google changed their mind about unsecured backends when they got news that some agency was tapping on them... and now every inter-datacenter link is encrypted! ;o) Nov 6, 2014 at 11:52

1 Answer 1

1

Use the $scheme variable.

server {
    listen 80;
    listen 443 ssl;
    server_name www.domain.com
    location /a/update {
        proxy_pass $scheme://backend;
    }
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .