0

I am trying to implement a reverse-proxy in front of a Domino server. The webmail URI is at http://domino/Mail, meaning the base URI is http://domino/. With that in mind, I created the following config for NGINX:

upstream webmail {
     server 192.168.32.1:80; #internal Domino IP
}

server {
    listen 80;

    access_log            /var/log/nginx/mail.access.log;
    error_log             /var/log/nginx/mail.error.log;

    proxy_set_header        Host            $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto http;
    proxy_read_timeout      90;
    proxy_http_version 1.1;
    proxy_redirect http://domino http://frontend;

    location / {
        proxy_pass              http://webmail;
    }
}

But with this config, a user would always have to enter http://frontend/Mail to access the webmail. Modifying the line to read:

location / {
        proxy_pass              http://webmail/Mail;
    }

Is also not possible, since once a user has accessed their mailbox, the URI will read http://frontend/mail.

I am not sure how I can modify or add a location to redirect all queries to http://frontend/ to http://frontend/Mail without causing URIs like http://domino/Mailsomefileondomino to be passed to the backend.

2 Answers 2

0

The solution is to add to following:

 location / {
        proxy_pass http://webmail/;
    }

    location = / {
        proxy_pass http://webmail/Mail;
    }

With = / it checks for the exact path

0
  1. To redirect all traffic from / only on http://frontend/ to http://frontend/Mail add

    location = / {
        return 301 http://frontend/Mail;
    }
    

    This will work because nginx does match = locations before other locations. See here.

  2. To proxy_pass all requests for http://frontend/* to internal domino server keep this section

    location / {
        proxy_pass http://webmail;
    }
    

additional note: consider securing webmail access by using https.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .