2

We have an upstream which can serve both HTTP and HTTPS traffic. The question is - how to make NGINX send traffic to the correct upstream's port?

Current config is:

upstream  platfrom-dev-eu-app {
    server 52.***.***.80:443;
}
...
server {
...

    location / {
        proxy_redirect          off;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass $scheme://platfrom-dev-eu-app$request_uri;
    }
}

The only solution I see here - is to add two upstreams, one with :80 and second with :443, and then use if/else in the server {} to chose correct one (or just set port after proxy_pass), like:

upstream  platfrom-dev-eu-app-ssl {
    server 52.***.***.80:443;
}

upstream  platfrom-dev-eu-app {
    server 52.***.***.80;
}
...
    if ($scheme = "http") {
         proxy_pass http://platfrom-dev-eu-app$request_uri;
    }

    if ($scheme = "https") {
        proxy_pass https://platfrom-dev-eu-app-ssl$request_uri;
    }

Is it right solution here - or there is more suitable approach?

1 Answer 1

1

You can avoid the if statement by simply declaring two servers, this is a pattern I use for this kind of thing:

upstream  platfrom-dev-eu-app-ssl {
    server 52.***.***.80:443;
}

upstream  platfrom-dev-eu-app {
    server 52.***.***.80;
}

server {
  listen 80;

  include "common.conf";
  proxy_pass http://platfrom-dev-eu-app$request_uri;
}

server {
  listen 443 ssl;
  # SSL configuration

  include "common.conf";
  proxy_pass https://platfrom-dev-eu-app-ssl$request_uri;
}

Create the common.conf file and put your common configuration to both servers in it.

Really though, if you are on a trusted and secure network you could just terminate SSL on the reverse proxy and just talk plain text to your application servers. Afterwards on the application server define a server on a port that is for SSL connections and set the fastcgi param HTTPS to on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .