We have an application that runs in Tomcat on an EC2 instance. We have an ELB in front of the EC2 that is configured with the following listeners:
ELB
port 80 --> nginx port 80 --> redirect |
port 443 <--> tomcat port 8080 <---
On the EC2 instance we have nginx running and performing reverse proxy to redirect connections on port 80 to port 8080 (Tomcat). Here is the config:
http {
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
}
Tomcat, running on the same server, is configured for port 8080:
<Connector port="8080"
maxThreads="300"
protocol="org.apache.coyote.http11.Http11NioProtocol"
connectionTimeout="20000" />
Most of the time, this works fine, but this creates problems in a small number of cases when our application returns non-HTTPS traffic. In researching the problem I found this article.
The system as is was configured partially by a contractor, who favored using nginx running on the EC2 instance as the reverse proxy. My question is, is there an advantage in our use case of using nginx as the reverse proxy when it is running on the same server, if Tomcat can perform the same function and also redirect the non-secure traffic over the secure port (as seen in the linked article)? Why use nginx at all in this case?
