0

We have an Amazon Web Services (AWS) Classic Elastic Load Balancer (ELB) that is in front of an Nginx. The Nginx is in front of a Jenkins and an EC2 Container Service Repository (ECR).

The setup is rather complex and a lot of it is due to AWS and project limitations (we're trying to host a Jenkins instance as a container in Europe => AWS ECS service => can't use ALBs or NLBs due to their limitations regarding forwarding HTTP and TCP => have to use Classic ELB; the Nginx is in there because the ECS repository can't have a custom domain name).

The Classic ELB can't filter traffic based on the domain name, so I'd like to do it in the Nginx configuration.

Can I do this in Nginx, based on the forwarding headers received from the ELB? Side question, is there some actual documentation for these headers? I found bits and pieces (for example $http_x_forwarded_proto) but nothing in the official documentation.

The current config looks a bit like this (it's an artifact from when Nginx would just do HTTP -> HTTPS and forwarding for HTTPS for the ECR URL; at the time there was an ALB in front that did the domain filtering):

server {
    listen 80;
    server_name  localhost;

    # Redirect HTTP to HTTPS.
    if ($http_x_forwarded_proto = "http") {
            return 301 https://$host$request_uri;
    }

    # Forward HTTPS requests to the Elastic Container Repository (ECR).
    location / {
            proxy_pass              "https://ecr-url";
            proxy_set_header        Host "ecr-url";
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Proto $scheme;
            proxy_read_timeout  90;
    }

}

I know that if is evil but I couldn't find a simpler alternative and I tried to stay within the "safe" limits of Nginx if.

  • I do not think you can do what are you trying with a classic ELB and NGINX. Can you talk more about why you think you need to use Classic ELB, also why are you proxying ECR and not using the CLI/API directly? docs.aws.amazon.com/elasticloadbalancing/latest/classic/… – strongjz Jan 30 '18 at 20:47
  • It isn't entirely clear what else this server is doing, but it sounds as if you simply need multiple server { ... } blocks, each with a server_name so that nginx knows which one should be used based on the Host header in each incoming request. See, for example, digitalocean.com/community/tutorials/… – Michael - sqlbot Jan 31 '18 at 0:31
  • 1
    @strongjz: I'm proxying the ECR because I don't want the images to contain references to the ECR repo name, which has the ugly AWS URL and ID. I want to use subdomain.companyname.com. – oblio Feb 1 '18 at 9:54
  • @Michael-sqlbot: Your solution might be cleaner than mine, since now I was using an if to check the $host variable, which I assume matches the Host header you mention. – oblio Feb 1 '18 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.