1

I hope anyone can throw a bit of light in here since I'm stuck in the dark :-P

Basically, I'm trying to make a Reverse Proxy NGINX cache content. Reverse proxying works OK, but the caching part... doesn't. I've followed many guides and different approaches, but all results in my cache folder emtpy and in every

curl -X GET -I resource returning X-Proxy-Cache: MISS

My Setup is very basic as I said, I have one backend server running Apache and Tomcat, and a frontend running NGINX reverse-proxying all request.

I'll just post info for one specific (and the most simple) nginx virtual host, which serves en Owncloud installation.

cat /etc/redhat-release

CentOS Linux release 7.2.1511 (Core)

NGINX -V

nginx version: nginx/1.6.3
built by gcc 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC)
TLS SNI support enabled
configure arguments: --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_spdy_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_geoip_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-http_perl_module --with-mail --with-mail_ssl_module --with-pcre --with-pcre-jit --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt='-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'

nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    ## BEGIN PROXY PARAMS ##

    proxy_cache_path /etc/nginx/cache levels=1:2 keys_zone=one:10m inactive=24h  max_size=1g;

    # END PROXY PARAMS ##

    ## BEGIN SECURITY ##

    # Prevent attackers to find out which nginx version is running.
    server_tokens off;

    ## END SECURITY ##

    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        server_name  _;
        #root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        # include /etc/nginx/default.d/*.conf;

        location / {
            return 403;
        }

        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}

01-owncloud.conf

server {
    listen      80;
    server_name cloud.mydomain.com;
    access_log  /var/log/nginx/01-owncloud_access.log;
    error_log   /var/log/nginx/01-owncloud_error.log error;

    ## BEGIN SECURITY ##

    # Block nasty robots
    if ($http_user_agent ~ (msnbot|Purebot|Baiduspider|Lipperhey|Mail.Ru|scrapbot) ) {
        return 403;
    }

    # Deny referal spam
    if ( $http_referer ~* (jewelry|viagra|nude|girl|nudit|casino|poker|porn|sex|teen|babes) ) {
        return 403;
    }

    ## END SECURITY ##

    location / {
        #proxy_cache_bypass  $http_cache_control;
        #add_header X-Proxy-Cache $upstream_cache_status;
        proxy_redirect    off;
        proxy_set_header  Host               $host;
        proxy_set_header  X-Forwarded-Server $host;
        proxy_set_header  X-Real-IP          $remote_addr;
        proxy_set_header  X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header  X-Forwarded-Proto  http;
        proxy_pass      http://192.168.1.42:80/;
        proxy_cache            one;
        proxy_cache_valid      200  1d;
        proxy_cache_use_stale  error timeout invalid_header updating http_500 http_502 http_503 http_504;
    }
}

Any help is really appreciated.

Thank you for reading this post!

Have a nice day!

1 Answer 1

0

Old post,.. but I wanted to update it-

In the end it was SELinux which was preventing the nginx process from writing to /etc/nginx/cache. A quick peek at /var/log/messages revealed this, and with setroubleshoot-server installed, it gave me the right commands to execute for allowing that write.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .