4

I host a small Java-based JAR-packaged webapp on AWS ELB using a custom domain. I upload a ZIP file like:

myapp.zip
* myapp.jar

I've configured a certificate using AWS CM and am able to access my application via both http://www.example.com as well as https://www.example.com.

Now I need to force HTTPS always. And I'm completely lost on how to do it.

I saw a number of answers like "configure your nginx":

https://stackoverflow.com/questions/24603620/redirecting-ec2-elb-from-http-to-https https://aws.amazon.com/de/premiumsupport/knowledge-center/redirect-http-https-elb/ http://www.emind.co/how-to/how-to-force-https-behind-aws-elb/

Other answers goint in the same direction.

While I can understand the idea of the rewriter rule like:

if ($http_x_forwarded_proto = 'http') {
    return 301 https://www.example.com$request_uri;
}

What I'm missing is how to actually add this the AWS ELB nginx.

What I've tried last was adding .ebextensions\nginx\conf.d\my.conf to my ZIP archive:

myapp.zip
* myapp.jar
* .ebextensions
  * nginx
    * conf.d
      * my.conf

Contents:

if ($http_x_forwarded_proto = 'http') {
    return 301 https://www.example.com$request_uri;
}

This gives me the following error:

2016/12/24 12:08:27 [emerg] 22709#0: "if" directive is not allowed here in /var/elasticbeanstalk/staging/nginx/conf.d/myconf:1

I guess the sytnax of my.conf is not right. I was hoping my.conf will extend the AWS ELB nginx configuration, but apparently it does not. And I'd really like to avoid having the full nginx configuration in my .ebextensions. I don't even know where to get it.

2 Answers 2

7

I have finally figured it out. I had to put my configuration in \.ebextensions\nginx\conf.d\elasticbeanstalk\*.conf, for instance \.ebextensions\nginx\conf.d\elasticbeanstalk\force-https.conf.

Contents are:

if ($http_x_forwarded_proto = 'http') {
    return 301 https://www.example.com$request_uri;
}

This gets included in the AWS ELB config file automatically:

# Elastic Beanstalk Nginx Configuration File
...
http {
    ...
    server {
        ...
        # Include the Elastic Beanstalk generated locations
        include conf.d/elasticbeanstalk/*.conf;
    }
}

So no need to copy/override the whole nginx.conf.

2
  • In my load balancer port 80 was pointing to instance port 5000, today I check the log and for 5000 request never going through nginx. So I chance instance port to 80 again and it start working. For others who if it don't work please make sure port 80 points to instance port 80 only.
    – Jimmy
    Jul 10, 2018 at 7:11
  • Reference: docs.aws.amazon.com/elasticbeanstalk/latest/dg/…
    – Chloe
    Nov 25, 2018 at 23:50
-1

I'd like to propose a MUCH better solution to look toward in the future. Amazon ELB v1 uses nginx as a reverse proxy before your Docker containers. You have to hack it to do the rewrites on the AWS instance when it boots similar to your solution. However, with v2 you can ditch that and just use your own nginx that you're running anyhow. It's much handier to do almost everything with v2, v1 was back during EBS infancy when they weren't sure how it would be used.

2
  • 2
    At the moment I don't use Docker in this case and I don't install/run "my own" nginx. Do I understand you correctly that you suggest I should configure/install run nginx on my own (supposedly via Docker)? It gives me much more burden, how is that a much better solution? The disadvantage is that I'd have to setup/manage nginx installation and make sure it works with AWS ELB. What are the advantages?
    – lexicore
    Jan 25, 2017 at 7:30
  • Can you provide step by step instructions and code examples? What do you mean 'use your own Nginx'? ElasticBeanstalk only gives 2 options for the load balancer, Apache and Nginx. How are you going to deploy another Nginx via a WAR file with an embedded Tomcat server on the backend? This doesn't make any sense.
    – Chloe
    Nov 14, 2018 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .