4

I am using Nginx to proxy pass to my wsgi app served with Circus.

I want to allow the traffic to that app for some urls of the app only for some IP address.

For now it look like this:

server {
    listen   80;
    server_name  service.dev;
    access_log  /var/log/service.access.log;
    error_log  /var/log/service.error.log debug;

    location / {
        try_files $uri @proxy_to_app;
    }

    location @proxy_to_app {
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass         http://127.0.0.1:9000/;
    }

    location /admin/ {
        allow 192.168.5.0/24;
        deny all;
    }
}

But it doesn't work. If I have the right, I get a 404 error instead of the proxy_pass.

Do you know how I can do that without having to copy/paste the proxy_pass configuration each time?

Thank you.

1 Answer 1

3

EDIT 2

As per VBart's comments, I've changed the entries in try_files to $uri @proxy_to_app. This avoids any confusion over the order of named locations (they must always come last). Be advised that if the /admin/ directory exists locally, this will be used instead of the proxy.

EDIT

If you really want to use a named location to avoid duplicating proxy_pass for each location, you can use the following:

server {
    listen       80;
    server_name  service.dev;
    access_log   /var/log/service.access.log;
    error_log    /var/log/service.error.log debug;

    location / { 
        # Catch all 
        try_files $uri @proxy_to_app;
    }   

    location /admin/ {
        # /admin/ only
        allow 192.168.5.0/24;
        deny  all;
        try_files $uri @proxy_to_app;
    }   

    location @proxy_to_app {
        proxy_set_header  Host $http_host;
        proxy_redirect    off;
        proxy_pass        http://127.0.0.1:9000;
    }   
}

It's a bit of a hack, try_files requires at least two parameters, in the first instance it will look for a local path with the same $uri (if you want to override with local files). In the second instance I've specified /dev/null as the second path; this will never be used.

ORIGINAL

Try this configuration:

server {
    listen       80;
    server_name  service.dev;
    access_log   /var/log/service.access.log;
    error_log    /var/log/service.error.log debug;

    # Proxy settings
    proxy_set_header   Host $http_host;
    proxy_redirect     off;

    location / {
        # Catch all
        proxy_pass     http://127.0.0.1:9000/;
    }

    location /admin/ {
        # /admin/ only
        allow 192.168.5.0/24;
        deny  all;
        proxy_pass     http://127.0.0.1:9000/;
    }
}

The location / block should only catch URIs that are not matched subsequently in other location blocks.

17
  • Thank you it is what I did with the try_files.
    – Natim
    Nov 14, 2013 at 11:00
  • try_files @proxy_to_app /dev/null; - this doesn't work. See the docs, it checks files on disk.
    – VBart
    Nov 14, 2013 at 11:46
  • I've tried the configuration out locally (nginx 1.0.15) and it works. What error are you getting? I think you're confused, try_files does more than check files on disk...
    – plasmid87
    Nov 14, 2013 at 11:48
  • 1
    Well, now I see. It's a bug in nginx 1.0.15, that was fixed in 1.1.12. A quote from changelog: Bugfix: a "proxy_pass" directive without URI part might use original request after redirection with the "try_files" directive. We have fixed it about two years ago, so I even don't remember.
    – VBart
    Nov 14, 2013 at 13:16
  • 1
    I would recommend you to use our packages: nginx.org/en/linux_packages.html (always fresh and secure).
    – VBart
    Nov 14, 2013 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .