How to configure NGINX to route external request to my stage and production docker hosts
I have 2 FQDNs stage.external.example.net
and external.example.net
that resolve to the same external public IP address, e.g. 140.240.40.111
(configured on the external DNS)
The HTTPS requests to this IP (e.g. GET https://stage.external.example.net) are then routed to my NGINX server that has one leg on the DMZ e.g. 172.20.180.111
and another to my internal network e.g. 10.222.20.1/16
on which I have 2 docker hosts that resolve internally as follow:
stage.internal.example.net
=>10.222.20.14
internal.example.net
=>10.222.20.15
I am trying to configure my NGINX to route:
- external request
stage.external.example.net:443
to internalstage.internal.example.net:443
- external request
external.example.net:443
to internalinternal.example.net:443
stage.external.example.net:443 -> 140.240.40.111:443 -> 172.20.180.111:443 (NGINX) -> 10.222.20.14:443 (stage.internal.example.net)
external.example.net:443 -> 140.240.40.111:443 -> 172.20.180.111:443 (NGINX) -> 10.222.20.15:443 (internal.example.net)
I can see that requests are hitting my NGINX in the access.log, but then the request do not seem to be routed forward to my docker hosts.
Hereafter the configuration that I have tried, any pointers are most welcome:
nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
worker_connections 1024;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/conf.d/*.conf;
upstream internal_stage {
server 10.222.20.14:443; # docker host stage.internal.example.net
}
upstream internal_production {
server 10.222.20.15:443; # docker host internal.example.net
}
# Forward all requests to stage.external.example.net:443
server {
listen 443;
server_name stage.external.example.net;
location / {
proxy_pass http://internal_stage;
}
}
# Forward all requests to external.example.net:443
server {
listen 443;
server_name external.example.net;
location / {
proxy_pass http://internal_production;
}
}
}
UPDATE: Change error_log
to info
I can now observe that I am getting a 400 Bad Request
Client sent invalid request while reading client request line