Proxy nginx a Tomcat con SSL

Jan 29 2021

Ho pubblicato questo su stackoverflow per errore (https://stackoverflow.com/questions/65942820/nginx-proxy-to-tomcat) e lo metto anche qui nella speranza di trovare qualche soluzione.

Ho seguito dozzine di tutorial e non riesco a capire quanto segue (anche se dovrebbe essere piuttosto semplice):

Ho la mia applicazione vue compilata in /var/www/mydomain.com e voglio che sia condivisa come contenuto statico.

Il mio backend in esecuzione su 8080 da Tomcat con API pubbliche su / api / qualcosa ... URL. Gli URL sono hardcoded inclusa la parte "api".

Vorrei configurare nginx per proxy miodominio.com/api/qualcosa ... le richieste a Tomcat e il resto vengano servite staticamente da /var/www/mydomain.com. Tutto servito tramite SSL.

Letteralmente non ho bisogno di nient'altro.

Potete aiutarmi a configurare nginx e tomcat per raggiungere questo obiettivo? Grazie!

configurazione di nginx /etc/nginx/sites-available/mydomain.com

upstream tomcat {
    server 127.0.0.1:8080 fail_timeout=0;
}

server {
        listen 443 ssl default_server;
        #listen [::]:443 ssl default_server;

        root /var/www/mydomain.com;
        index index.html index.htm index.nginx-debian.html;

       server_name _ mydomain.com www.mydomain.com;

        location /api/ {
                include proxy_params;
                proxy_set_header Host $server_name; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://tomcat; } location / { try_files $uri $uri/ /index.html; } ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot } server { if ($host = www.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = mydomain.com) { return 301 https://$host$request_uri;
    } # managed by Certbot


       listen 80 default_server;
        listen [::]:80 default_server;

       server_name _ mydomain.com www.mydomain.com;
   return 404; # managed by Certbot
}

(1) Blocco di posizione alternativa con cui sto sperimentando

        location /api/ {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Proto https;
                proxy_pass http://localhost:8080/api/;
        }

(2) Blocco alternativo suggerito da Praveen Premaratne.

In questo modo ottengo "GET /api/docs HTTP/1.0" 302 -e funzionano anche i file statici. Andare a / api / docs rende il reindirizzamento a domain:8443/api/docsdove vengo ERR_CONNECTION_REFUSED.

        location /api/ {
                include proxy_params;
                proxy_pass http://tomcat;
        }

        location / {
                try_files $uri $uri/ /index.html;
        }

(3) Alternativa utilizzando il sottodominio.

Sono stato in grado di creare il sottodominio api.mydomain.com e configurare nginx per andare alla pagina dell'indice da lì (aggiungendo il blocco successivo). Non ho idea di come eseguire il proxy in seguito.

server {
        listen 443 ssl;

        root /var/www/www.mydomain.com; <- redundand I guess?
        index index.html index.htm index.nginx-debian.html; <- redundand I guess?

        server_name api.mydomain.com

        ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
}

Configurazione di Tomcat server.xml

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               address="127.0.0.1"
               redirectPort="8443" />
<Engine name="Catalina" defaultHost="localhost">
   ...
   <Host name="localhost"  appBase="webapps"
         unpackWARs="true" autoDeploy="true">
      
      <Valve className="org.apache.catalina.valves.AccessLogValve" 
         directory="logs"
         prefix="localhost_access_log" suffix=".txt"
         requestAttributesEnabled="true"
         pattern="%h %l %u %t &quot;%r&quot; %s %b" />
        
      <Valve className="org.apache.catalina.valves.RemoteIpValve"
         protocolHeader="X-Forwarded-Proto" /> 
   ...

La situazione attuale è che quando vado su miodominio.com/api/docs dove dovrebbe essere in esecuzione swagger, vengo reindirizzato a miodominio.com o ricevo l'errore 500 o 502.

Risposte

1 TomášLeitl Feb 01 2021 at 01:45

Ok, quindi con l'aiuto di @Praveen Premaratne e @Piotr P. Karwasz e questo articolo ho creato la seguente configurazione:

non mettere righe con "# managed by Certbot", quelle sono create da certbot, controlla https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04

ecc / nginx / sites-available / miodominio.com

server {
    server_name    mydomain.com www.mydomain.com;

    root /var/www/mydomain.com;
    index index.html;

    access_log /var/log/nginx/mydomain-access.log;
    error_log /var/log/nginx/mydomain-error.log;

    location / {
        try_files $uri $uri/ /index.html;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.mydomain.com) { return 301 https://$host$request_uri; } # managed by Certbot if ($host = mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name    mydomain.com www.mydomain.com;
    listen 80;
    return 404; # managed by Certbot
}

/etc/nginx/sites-available/api.mydomain.com

server {
    server_name    api.mydomain.com;

    access_log /var/log/nginx/api-mydomain-access.log;
    error_log /var/log/nginx/api-mydomain-error.log;

    location / {
        proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://127.0.0.1:8080; } listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } server { if ($host = api.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name    api.mydomain.com;
    listen 80;
    return 404; # managed by Certbot
}

Tomcat server.xml

<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
    connectionTimeout="20000"
    address="127.0.0.1"
    proxyName="api.mydomain.com"
    proxyPort="80"/>

<Engine name="Catalina" defaultHost="localhost">

    <Realm className="org.apache.catalina.realm.LockOutRealm">
    ...
    </Realm>

    <Host name="localhost"  appBase="webapps"
        unpackWARs="true" autoDeploy="true">

        <Valve className="org.apache.catalina.valves.RemoteIpValve"
            remoteIpHeader="x-forwarded-for"
            proxiesHeader="x-forwarded-by"
            protocolHeader="x-forwarded-proto" />

        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
            prefix="localhost_access_log" suffix=".txt"
            pattern="%h %l %u %t %r %s %b" />

  </Host>
</Engine>

fuero Jan 29 2021 at 20:01

Prova questo:

location / {
        try_files $uri @backend;
}
location @backend {
        include proxy_params;
        proxy_pass http://tomcat;
}

PraveenPremaratne Jan 29 2021 at 23:22

Se dovessi farlo utilizzando l'approccio dei sottodomini, ecco come lo farei.

Crea un file di configurazione Nginx per l'API di backend
Crea un file di configurazione Nginx per il contenuto web statico

File statico HTML Nginx mydomain.com.nginx

server {
    server_name    mydomain.com;

    root /var/www/mydomain.com;
    index index.html;

    access_log /var/log/nginx/mydomain-access.log;
    error_log /var/log/nginx/mydomain-error.log;

    location / {
        try_files $uri $uri/ /index.html;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = mydomain.com) { return 301 https://$host$request_uri;
    } # managed by Certbot


    listen         80;
    server_name    mydomain.com;
    return 404; # managed by Certbot


}

File di configurazione API Nginx api.mydomain.com.nginx

server {
    server_name    api.mydomain.com;

    access_log /var/log/nginx/api-mydomain-access.log;
    error_log /var/log/nginx/api-mydomain-error.log;

    location / {
        proxy_set_header X-Forwarded-Host $host:$server_port; proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://127.0.0.1:8080; proxy_redirect off; } listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/api.mydomain.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/api.mydomain.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } server { if ($host = api.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen         80;
    server_name    app.mydomain.com;
    return 404; # managed by Certbot


}

Puoi aggiungerli alla /etc/nginx/site-available/directory e abilitarli.

Ps: rimuoverei la roba SSL ed eseguirò Certbot per aggiornarli poiché devi emettere un nuovo certificato per l' app.mydomain.com , quindi aggiornerà semplicemente i file stessi