New answers tagged

0

The cause of the issue is literally printed in the browser's developer console: Therefore, you need to make XHR requests happening over HTTPS connection. You probably want to add another location to the nginx configuration: location /socket.io { proxy_pass http://localhost:5006; } while also changing the URL in the frontend configuration: socketUrl: ...


1

Try to replace https with http here: proxy_pass https://localhost:3000; and reload nginx. You said that curl localhost:3000 worked, and omitting a protocol for curl assumes http://. Most probably, your backend application does not support HTTPS (or not at this port, at least).


3

It depends on what is inside the bundle. I am certain it contains the certification path up to the trusted CA, the question is: does it also include the end server certificate (it's the "full chain" in terms of Let's Encrypt) or not ("chain")? Also, which file contains the private key? You can check that manually by simply looking with a ...


0

Tried to use systemctl edit nginx and pasted those lines: RestartSec=5s But getting this error and when nginx crashes its not restarted /etc/systemd/system/nginx.service.d/override.conf:1: Assignment outside of section. Ignoring.


0

root html defines the relative path, relative to the value of --prefix in Nginx configuration. In your case, the value of --prefix is /usr/share/nginx. So, root html means, the directory named "html" inside /usr/share/nginx is parsed to serve the requested file (50x.html). In the end, the request will look for the file at /usr/share/nginx/html/50x....


0

The ingress will just forward the entire path to the service. E.g. your api-service-v1 will get hit with urls such as https://yourhost/apiv1/asdfq If you want the ingress to modify the path used to hit the service, you need to tell it to rewrite, as described in: https://kubernetes.github.io/ingress-nginx/examples/rewrite/ Change path of api-service paths to ...


0

You need to get multiple IP addresses on the server, one for each of the subdomains you want to use. Then you need to assign a public IP address to each VM. After that you can bind the subdomain to the IP address. In the VM, one can do port forwarding to whichever final destination one wants.


0

what if you move the more specific flows section before the more general section? i guess the first location matches and is used


0

You have some missunderstanding how virtual host works. Check these points: When you configure virtual host you need set virtual host for http (port 80) and https (port 443). Redirect you virtualhost on port 80 to your virtual host on port 443. Remember always need handle incoming traffic of your http (port 80). Why? Some developer (I don’t know why) use ...


1

Try setting Site Address and WordPress Address . Go to Settings >> General Set WordPress Address (URL) and Site Address using your fqdn Reference For more oficial information: WordPress Doc


0

When configuring ProxyPass in older Apache versions the full ALB names were sometimes too long. As a workaround we had to create a shorter name as an ALIAS in a Route53 domain, for example: alb.mydomain.com. A ALIAS alb-dns-name.region.elb.amazonaws.com. And then do ProxyPass https://alb.mydomain.com. I wonder if this could be the same problem? Having ...


0

Dealing with performance in web servers, having the potential of handling static content along side dynamic content is significantly important. As reported by a benchmark take a look at performed by running up to 1,000 concurrent connections, NGINX performs 2 and half times quicker than Apache in static contents. will be} by no surprise because of the ...


1

One can connect to the container by using host A as the jump host. However, this requires a user-account on host A for this purpose. One can limit the jump host account so that there is no access to the server itself. The limitation can be done in host A sshd_config. Match user bob X11Forwarding no AllowTcpForwarding ForceCommand ssh bob@<...


0

nginx/1.21.3 doesn't seem to obey its own documentation as to redirection when URI replacement is ambiguous. Following config allowed me to make both /wp-admin and /wp-admin/ work. server { location = /wp-admin { rewrite /wp-admin / break; proxy_pass http://172.17.0.1:8000; } location /wp-admin/ { proxy_pass http://172....


0

The problem is that your request doesn't match your server block, but does match the default server block. You have: server { listen 80; server_name running-oaks.com; Which will match any request coming in on port 80 with the Hostname "running-oaks.com". Out of the box, Ubuntu includes an already enabled site file /etc/nginx/sites-...


0

After reading the answer to this question (Use "include" in nginx server block but where to save?), I realized I could factor out my locations in a modular fashion via include files: server { listen 443 ssl; ssl_certificate /etc/letsencrypt/live/this_host/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/...


3

What you see is an attack using an exploit in Apache 2.4.49 (only this version is affected). You can read more about it here CVE-2021-41773. TLDR: Path traversal allows attacker to remotely execute code, if files are not protected by require all denied configuration. If you are using any Apache servers upgrade those to, at least, version 2.4.50. Execute this ...


0

Inspiration https://serverfault.com/a/788576 and https://askubuntu.com/a/733604 Ubuntu 20.04 I changed two things First: I runned service NetworkManager-wait sudo systemctl enable NetworkManager-wait-online.service sudo systemctl start NetworkManager-wait-online.service Second: I added to path PIDFile (and pidfile) prefix var [Service] ... PIDFile=/var/run/...


1

Your problem stems from the fact that your web server is not sending any chain certificates with your leaf certificate. This is what the SSL Labs test is trying to tell you when it says, "This server's certificate chain is incomplete". Browsers and other clients have to guess how to verify the certificate you're sending and some are more capable/...


1

I solved this issue by defining a new environment variable called APP_HOST in the Google Cloud Run control panel and setting it to example.com. Then I added the following configuration to the .htaccess file in the document root: <IfModule mod_env.c> PassEnv APP_HOST </IfModule> <IfModule mod_headers.c> RequestHeader set Host %{...


1

cat intermediate.cert.pem >> domain.cert.pem In your nginx conf: server { ... ssl_certificate /path/to/domain.cert.pem; ssl_certificate_key /path/to/private.key.pem; ... }


2

Instead of having Apache do that leg work, have NGINX do it before it even hands off the data to Apache by setting the Host header that Apache is expecting as part of the proxy_pass handoff with an extra configuration option. NGINX has the following variable for proxy_set_header to augment what is passed to the proxy in the backend. So you'd have something ...


0

The subject alt name wasn't defined. When generating the cert, I ran the following: openssl x509 -req -days 365 -sha256 -in mydomain.com.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out mydomain.com.crt -extfile mydomain.com.ext where I had: mydomain.com.ext authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, ...


1

By default docker binds mapped ports to 0.0.0.0, which exposes it to all interfaces. If you don't want that, you can bind it to the local interface only. docker run -p 127.0.0.1:8080:80 httpd


0

Use the following command to fix the permission of nginx folder. sudo chmod -R 775 /var/lib/nginx/tmp Hope it helps.


1

Short version: no, that’s not possible. Short but optimistic version: that’s not possible when using only nginx, but it’s possible when using lua extension. Or any other programming language nginx extension, like perl. Long version: so you are trying to write a code inside nginx config files. Although nginx configuration does provide some instruments of ...


1

Because things get nasty when you use returns not bound to any location {}. Put your return 412 inside location / {} and there will be happiness and joy. P.S. When your web-server returns empty answer, you should use 204 status, not 200. Both will work, but 204 shows you know things.


1

You most likely want to move allow and deny directive to the outside of any location and place directly within server {}. Then it will be applied to all locations.


0

It is your application that generates the links to static resources in the HTML code it generates. Therefore you must configure your application's base URL to match the location in your proxy case. The rewrite statements in your configuration are not needed. They don't actually do anything.


0

I've solve a similar problem to this in the past. I was using the jwilder/nginx-proxy container to act as a HTTP proxy for a bunch of other containers all running in the same Docker system on a Raspberry Pi. Because that proxy uses the VIRTUAL_HOST environment variable to know which virtual host to forward to which container I was able to write a small ...


1

As it stated by the documentation, last parameter of the try_files directive can be a new URI; HTTP error code: =code; named location ID: @location_name. You are using /empty.png which is treated as a new URI that does not fall under the location /cache { ... } thus being served by the location / { ... }. When you remove the leading slash you get the new ...


1

This if block if (!-e $request_filename){ rewrite ^/(.*)$ /index.php break; } will rewrite any request for any file that is missing at the /var/www/wordpress folder to WordPress index.php. There is no need for this if block at all, remove it. Last argument of try_files directive can be either a new URI or a HTTP error code, but you are trying to use ...


3

The rewrite rule convertors are quite bad usually. It is better to implement then in native nginx way. In this case, the image location would be as follows: location ~ ^/image/([^/]+)/([^/]+)/([^/]+)/([^/]+)$ { try_files /image.php?t=$1&w=$2&h=$3&src=$4 =404; } BTW. I hope your image.php has proper input validation for width / height, so ...


1

Is it ok to use Nginx in the host which will forward traffic to multiple different dockerized Nginx? Yes. This is one way to do it. Does it have any known problems? The host instance of NGINX is not containerised which may make it more difficult to configure. Another common way to do this is to have a docker container bound to port 80 and 443 which handles ...


0

@drookie This is not working please, it is causing a 502 error if ($host ~* ^(.+)\.([a-z0-9-]+)$) { set $domainpart $1; set $tld $2; } add_header X-domain "$domainpart"; add_header X-tld "$tld"; subs_filter_types *; subs_filter 'action="/' action="/proxy/$...


-1

Because you should stop using nginx as a TCP load balancer for other Web-servers and switch it to a full-fledged HTTP reverse-proxy, which it is. That way you will get the per-request RR, which you want (with persistent connections disabled by default), instead of TCP session distribution.


1

Is it ok to use Nginx in the host which will forward traffic to multiple different dockerized Nginx? Yup, it's actually a common practice. Does it have any known problems? Caused by this setup itself - nope. Will that affect performance? In a way - sure: like every other load balancer (which it is) it will add some delay on buffering and TCP sockets.


0

map is a better way to perform these kinds of conditional things. Add the following to http level in nginx config: map $http_user_agent $upstream { ~robot "localhost:6000/Page/Get?url=https://test.page$request_uri"; default localhost:5000$request_uri; } And then use $upstream as target: proxy_pass http://$upstream;


0

Nginx is sorting the file includes containing the virtual hosts indeed. Because that's more comfortable to use and to understand the logic of selecting the default one - and this would be the first vhost include file when sorted alphabetically. In fact you're looking for the default option to listen directive, that is used to terminate all other sites not ...


0

Try this: if ($host ~* ^(.+)\.([a-z0-9-]+)$) { set $domainpart $1; set $tld $2; }


0

Looks valid, you should check what's the upstream is getting in it's access log. Bet the answer is there. Though I suppose the main issue is that you forgot to pass the Host header: proxy_set_header Host <whatever the Host is expected on the upstream, definitely not $host though> But this would be the clue only if the upstream server isn't the default ...


0

You can also use the nginx sub-directories in /usr/share/nginx... location = /.well-known/pki-validation/HASHHASH.txt { alias /usr/share/nginx/html/HASHHASH.txt; }


0

I believe this is now the way to go solving the original problem: proxy_set_header X-SSL-CERT $ssl_client_escaped_cert; According to the docs: $ssl_client_escaped_cert returns the client certificate in the PEM format (urlencoded) for an established SSL connection (1.13.5);


3

In many distributions, there is a include conf.d/*.conf line in nginx.conf http section. So, the script can create a file in conf.d directory with .conf extension and the reload nginx configuration.


0

Ingress controller version 0.22.0 or higher uses nginx.ingress.kubernetes.io/rewrite-target instead of ingress.kubernetes.io/configuration-snippet. So this would be the new for the @mdaniel answer: apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: ingress annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-...


1

As far a I know ssl_preread directive works only with HTTPS protocol. I don't know how to get HTTP Host header value in the ngx_stream_core_module. You can try to use an additional server block in the http context like shown here: http { ... map $http_host $proxy { hostnames; .neverssl.com $http_host; ... } server {...


0

The problem you're facing is that your backend also requires Basic Authentication. When your health check probe is polling the backend, it returns a HTTP/1.1 401 Unauthorized because you didn't provide the authorization header. We can fix this by sending a custom request header in your backend probe. Here's the VCL code: backend default { .host = "...


1

According to nginx developers you need to share the same TLS certificate between all backend servers. See the following bug report https://trac.nginx.org/nginx/ticket/1307#comment:5


0

I didn't find any other way, for now.... I just let Nginx create the file which will be owned by root, and then manually do chgrp and chown to my target user after the file was created. For me, I use webservergroup as the the file group, which nginx is also running on, so the log file is read and write-able.


0

Turned out neither my application nor nginx was the problem, but a faulty packet filter in front of both.


Top 50 recent answers are included