0

I have nginx used as a proxy for a handful of web services, running in a docker container, using the config below. I have the configuration to 90% of where it needs to be, but the problems for the last little bit are confounding me. Running this config results in the error message nginx: [emerg] invalid number of arguments in "try_files" directive in /etc/nginx/nginx.conf:75. This corresponds to this chunk of the config:

location / {
  try_files $uri @proxy_to_appserver;  # <--- this is line 75
}
location @proxy_to_appserver {
  proxy_pass http://appserver/;
}

This is attempting to have nginx handle requests for static resources, e.g. request for images/cat.gif would look for a cat picture in the web root, and send the request to the appserver if none was found. All the documentation I have found has essentially this same syntax, using the $uri variable followed by a named location for the proxy. But something else in the config must be turning this into an invalid syntax, or there is something else obvious that I cannot see after staring at config files for too long.

Full config file follows. I'm using the official nginx:1.11 docker image, fwiw.

worker_processes 4;

events {
  worker_connections 1024;
}

http {
  include mime.types;
  default_type application/octet-stream;

  upstream appserver {
    server appserver:8000;
  }
  upstream rabbitmq {
    server rabbitmq:15672;
  }
  upstream solr {
    server solr:8983;
  }
  upstream flower {
    server flower:5555;
  }

  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;
  ssl_session_tickets off;

  server {
    listen  80 default_server;
    listen  [::]:80 default_server;
    return  301 https://$host$request_uri;
  }

  server {
    listen                    443 ssl http2;
    listen                    [::]:443 ssl http2;

    ssl_certificate           /etc/ssl/my_application/certificate.chained.crt;
    ssl_certificate_key       /etc/ssl/my_application/certificate.key;

    ssl_dhparam               /etc/ssl/my_application/dhparam.pem;

    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers               'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
    ssl_prefer_server_ciphers on;

    # OCSP Stapling
    ssl_stapling              on;
    ssl_stapling_verify       on;
    ssl_trusted_certificate   /etc/ssl/my_application/trustchain.crt;
    resolver                  131.243.5.1 8.8.8.8 8.8.4.4;

    # HSTS header (15768000 == 6 months)
    add_header  Strict-Transport-Security max-age=15768000;

    client_body_buffer_size     10k;
    client_header_buffer_size   1k;
    client_max_body_size        50m;
    large_client_header_buffers 2 1k;

    client_body_timeout   12;
    client_header_timeout 12;
    keepalive_timeout     5;
    send_timeout          10;

    gzip             on;
    gzip_comp_level  2;
    gzip_min_length  1000;
    gzip_proxied     expired no-cache no-store private auth;
    gzip_types       text/plain text/css text/xml text/javascript application/javascript application/json application/x-javascript application/xml application/xml+rss;

    root /var/www;

    location / {
      try_files $uri @proxy_to_appserver;  # <--- this is line 75
    }
    location @proxy_to_appserver {
      proxy_pass http://appserver/;
    }

    location /flower {
      return 301 /flower/;
    }
    location /flower/ {
      proxy_pass http://flower/;
    }

    location /rabbitmq {
      return 301 /rabbitmq/;
    }
    location /rabbitmq/ {
      proxy_pass http://rabbitmq/;
    }

    location /solr {
      return 301 /solr/;
    }
    location /solr/ {
      proxy_pass http://solr/solr/;
    }

    error_page 500 502 503 504 /static/500.html;
  }
}

Update: for any from the future finding this… I ended up getting rid of try_files and the named location entirely. The problem section around line 75 is replaced with this:

location /static {
}
location /uploads {
}
location / {
  proxy_pass http://appserver/;
}

This works because all the files used by the appserver container are either under /var/www/static or /var/www/uploads. This also mirrors the layout for proxies to the other services, so the config remains simple.

  • AFAIK you need at least two file paths, so try to add $uri/ before @proxy_to_appserver. – gf_ Jun 29 '16 at 18:52
  • I thought the named location counted as a path, as the documentation for try_files has a location using only $uri and a named location in the final example. I do not want to provide directory listings, which is why there is no $uri/ in the config, but adding it gives a new message: nginx: [emerg] "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in /etc/nginx/nginx.conf:78 – wmorrell Jun 29 '16 at 18:58
  • 1
    1.) Adding $uri/ won't enable directory listings. 2.) Try to remove the trailing / from proxy_pass http://appserver/. – gf_ Jun 29 '16 at 19:09
  • Getting there. Removing the trailing / at least allows nginx to start up. But, trying to load mysite.example.org in a browser results in an endless redirection loop. So I need to do something else? Trying out a rewrite command. – wmorrell Jun 29 '16 at 19:14
  • Is appserver resolvable? – gf_ Jun 29 '16 at 19:17
1

According to the comments:

  • Contrary to what I wrote in the comments, this directive try_files $uri @proxy_to_appserver is valid and fine. I've just checked and tested this.

  • Removing the trailing / from the proxy_pass http://appserver/ directive solved this:

    nginx: [emerg] "proxy_pass" cannot have URI part in location given by regular expression, or inside named location, or inside "if" statement, or inside "limit_except" block in /etc/nginx/nginx.conf:78

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.