Hot answers tagged

19

Simple location prefix matching works for this without using a rewrite rule as long as you specify a URI in the proxy_pass directive: location /foo { proxy_pass http://localhost:3200/; } Notice the additional / at the end of the proxy_pass directive. NGINX will strip the matched prefix /foo and pass the remainder to the backend server at the URI /. ...


4

You can use sniproxy : https://github.com/dlundquist/sniproxy An example configuration : listener 0.0.0.0:443 { protocol tls table TableHTTPS fallback 127.0.0.1:8443 } listener 0.0.0.0:80 { protocol http table TableHTTP fallback 127.0.0.1:8080 } table TableHTTPS { domain1.com backend1:443 domain2.org backend2:443 } table ...


4

I suspect that your colleague misunderstood the ssl related directives: the file pointed to by ssl_certificate should contain your server's certificate followed by intermediate certificates, and ssl_client_certificate is only needed for client cert verification and OCSP - I think he copied the intermediate(s) into that file. Now, a browser that already has ...


3

I know i'm pretty late to the game, but for me this is the top result when searching for this problem, so i wanted to share my solution. This uses the if directive (with one of the few valid use cases) combined with the custom error handler: upstream backend { server backend1; server backend2; } server { server_name proxy; location / { ...


3

Basically, reverse proxies will hide your infrastructure from the world. So it is mainly a case of security by obscurity, unless your web server is really unmanageable and unsecured. It can also protect your webservers from some kind of DOS (distributed denial of service), especially if your website is "heavy", acting then as a caching layer. It has also ...


3

Yes... use CloudFront. Its official purpose, of course, is as a caching CDN, but it has the built-in ability to selectively route requests to the appropriate origin system, based on the path. So, you'd configure your default path to be S3, and requests would be sent to your bucket. Configure a second origin pointing to the Elastic Load Balancer in ...


3

What you're asking for is pretty much impossible, because the vast, vast majority of L7 protocols have no concept of a hostname, and thus can't be proxied based on a hostname The correct way to achieve what you want is to assign different public IP addresses, because even though you have a router in your diagram, it's actually NATting, which isn't routing ...


3

JavaScript Single-page apps often use a hash to handle navigation within the app (clicking on a link in the application might update the hash to https://example.com/springApp/#/foo/bar, for example). It's becoming less common as the HTML5 History API becomes well supported, though.


3

You can get the original client address of the connecting ELB in the variable $realip_remote_addr, but be aware that this variable was only added in nginx 1.9.7, so you'll need to be running a very recent version of nginx.


3

You could use multiple A records, one for each machine. But, regarding your high-availability tag: You won't get this via this technique. Alternatively, you could use Anycast or a Content delivery network aka CDN. SSL may be an issue. Basically can 1 cert work on multiple servers provided they have the same setup? Yes.


3

Varnish does not support SSL Running a site/service on SSL is a necessity for anything half serious, so thats one reason to use haproxy which will do SSL termination for you.


3

Your two server blocks will always conflict such that the first observed server block in the configuration file will be taking precedent as the default server block for all requests, unless you specify a proper server_name for each config to apply to incoming requests for that hostname / subdomain. (This applies also for all requests of which a requested $...


3

In general caching works poorly with dynamic content, especially with content that contains things like "recently viewed" that will change every singe page load. If you really want to use caching then the first step is to disable that plug in so that there's a theoretical chance that someone might be served the same page twice. The second step is to only ...


2

It's become default behaviour starting since version 1.9.13 To change it back manually you can use: proxy_next_upstream error timeout non_idempotent;


2

What you want is server_name ~ .*.example.com The tilde is what makes it a regex


2

There are 2 options: rewrite and HTTP 301 permanent redirect, second is more preferred: server { listen 80; server_name _; return 301 https://$server_name$request_uri; }


2

From my reading of the nginx websocket dock, when your nginx proxy sees the Upgrade headers, it passes them on to hack.chat. hack.chat then needs to respond with the 101 response. First of all, you want to be able to debug the actual HTTP and hack.chat transactions, so you know whether the problem is in your client app, or on the web server, or with the ...


2

This is possible. On Apache web server, you need to store all the files on a default virtual host so it can be accessed as http://IP_ADDRESS:PORT/hostname/path/ On Nginx server create multiple virtual hosts & add a proy_pass rule like below. A.com -> / will proxy forward to /a-com/ B.com -> / will proxy forward to /b-com/ C.com -> / will proxy forward ...


2

today, nginx Supports ssl pass thru: https://serversforhackers.com/tcp-load-balancing-with-nginx-ssl-pass-thru


2

Use alias instead of root. You don't even need try_files? location /assets/ { alias /var/www/frappe/sites/assets/; }


2

Of course it's possible. Why wouldn't it be? They won't be able to listen on the same IP:Port pair of course, but that is easily remedied.


2

Your understanding is correct as far as it goes, but your real limit is going to be file handles. Each socket connection requires a Linux file handle, and the default ulimit on those is 1024. /proc/sys/fs/file-max sets the limit for the entire system. You will need to raise these limits to handle high nginx connection rates. The NGINX folks have tested up ...


2

Found a solution in the end - I was forcing the nginx server to attempt serving files locally using the try_files $uri $uri/ =404;. All I had to do was remove this line and it works perfectly :) location / { proxy_pass http://104.46.52.226/; }


2

You're close, I think (I'm new to Nginx myself), but your second server block needs a bit more... I have one on my server with this: listen 443 ssl; listen [::]:443 ipv6only=on ssl; charset utf-8; client_max_body_size 75M; server_name example.com www.example.com; ssl_certificate /etc/ssl/certs/example.com.crt; ssl_certificate_key /etc/ssl/private/example....


2

To terminate SSL on nginx: a) The server section needs to specify port and 'ssl' listen 192.168.2.26:443 ssl; b) The server block then also specifies certs and ssl params ssl_certificate new-cert.cer; ssl_certificate_key new-cert.key; ssl_protocols SSLv3 TLSv1; ssl_ciphers HIGH:!aNULL:!MD5;


2

You can add the gzip_proxied any; directive to your conf. edit: My test : I set up a simple HTTP Server (not able to gzip by itself) on my machine (192.168.122.1) with python -m http.server 8080. When I request it I get : [pat@morbier ~]$ curl -I -H 'Accept-Encoding: gzip,deflate' http://192.168.122.1:8080/ HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/...


2

Based on the docs of the accept-proxy bind option, and more generically the usage of the PROXY protocol, all the fields contained in the PROXY protocol header (source IP & port, destination IP & port) replace those from the real connection: ... The PROXY protocol dictates the layer 3/4 addresses of the incoming connection to be used ...


2

The best way to do this is by assign a different IP by server: server1 first public IP server2 second public IP server3 third public IP Then assign each domain a different IP in the DNS. If you're ISP can't provide you more IP addresses, then you can migrate elsewhere, or bring the traffic to your servers through tunnels.


2

You could just turn off proxy_buffering. location / { proxy_buffering off; proxy_pass https://xx.xx.xx.xx:10000/; } Be aware that buffering is a performance optimization that usually works best when enabled; if disabling it causes you problems overall, you may wish to disable it only for specific locations (by creating a new location block).


2

I've finally solved the issue. The breakthrough occured when I followed @john ktejik's directives: http://stackoverflow.com/questions/4390134/failed-to-load-resource-under-chrome/26742627 I came to realize that the involved resource was encompassed within a .jar file. Therefore, I had to tell Apache2 to explicitely use "SetOutputFilter INFLATE;proxy-html;...



Only top voted, non community-wiki answers of a minimum length are eligible