issues setting up nginx as an https proxy

Submitted ⁨⁨4⁩ ⁨weeks⁩ ago⁩ by ⁨brokenlcd@feddit.it⁩ to ⁨selfhosted@lemmy.world⁩

i’m trying to setup nginx to run as a proxy to aggregate multiple services. running on different ports on the server, using nginx to let me connect to all the services by going to a specific subdirectory. so i can keep only one port open in the router between my lab and the main house network.

i’m using the following config file from an example i found to do this, with a landing page to let me get to the other services:

used config file

___ server { listen 80; server_name 10.0.0.114; # Replace with your domain or IP # Redirect HTTP to HTTPS return 301 https://$host$request_uri; } server { listen 1403 ssl; # Listen on port 443 for HTTPS server_name 10.0.0.114; # Replace with your domain or IP ssl_certificate /certs/cert.pem; # Path to your SSL certificate ssl_certificate_key /certs/key.pem; # Path to your SSL certificate key location / { root /var/www/html; # Path to the directory containing your HTML file index index.html; # Default file to serve } location /transbt { #configuration for transmission proxy_pass 10.89.0.3:9091;
proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme;$proxy_add_x_forwarded_for; }

but the problem i’m having is that, while nginx does redirect to transmission’s login prompt just fine, after logging in it tries to redirect me to 10.0.0.114:1403/transmission/web instead of remaining in 10.0.0.114:1403/transbt and breaks the page. i’ve found a configuration file that should work, but it manually redirects each subdirectory transmission tries to use, and adds proxy_pass_header X-Transmission-Session-Id; which i’m not sure what’s accomplishing: github gist

is there a way to do it without needing to declare it explicitly for each subdirectory? especially since i need to setup other services, and i doubt i’ll find config files for those as well? it’s my first time setting up nginx, and i haven’t been able to find anything

source

Comments

Sort:hotnew top

MangoPenguin@lemmy.blahaj.zone ⁨4⁩ ⁨weeks⁩ ago
For subdirectories it’s more complex as each application needs to be configured properly too, so you’ll need to go into transmission and tell it what subdirectory you’re using.

Or switch to subdomains as that just works without any extra config, and still let’s you use one port for everything.

source
darkan15@lemmy.world ⁨4⁩ ⁨weeks⁩ ago
Not all services/apps work well with subdirectories through a reverse proxy.

Some services/apps have a config option to add a prefix to all paths on their side to help with it.

But if you need to do some kind of path rewrite on the reverse proxy side only, to add/change a segment of the path, there can be issues if all path changes are not going through the proxy, an example of this is with PWA that when you click a link that should change the path, don’t reload the page (the action that would force a load that goes through the reverse proxy and that way trigger the rewrite), but instead use JavaScript to rewrite the path text locally and do DOM manipulation without triggering a page load.

To be honest, the best way out of this headache is to use subdomains instead of subdirectories, it is the standard used these days to avoid the need to do path rewrite magic that doesn’t work in a bunch of situations.

Yes, it could be annoying to handle SSL certificates if you don’t want or can’t issue wildcard certificates, but if you can do a cert with both maindomain.tld and *.maindomain.tld then you don’t need to touch that anymore and can use the same certificate for any service/app you could want to host behind the reverse proxy.

source
- brokenlcd@feddit.it ⁨4⁩ ⁨weeks⁩ ago
  I’m sorry. I forgot to mention it in the post. But the server is not facing the outside. It’s just behind an extra nat to keep my computers separate from the rest of the home. There’s no domain name linking to it. I’m not sure if that impacts using subomains.
  
  The SSL certificates shouldn’t be a problem since it’s just a self signed certificate, I’m just using SSL as a peace of mind thing.
  
  I’m sorry if I’m not making sense. It’s the first time I’m working with webservers. And I genuinely have no idea of what I’m doing.
  
  source
  - darkan15@lemmy.world ⁨4⁩ ⁨weeks⁩ ago
    Should not be an issue to have everything internally, you can setup a local DNS resolver, and config the device that handles your DHCP (router or other) to set that as the default DNS for any devices on your network.
    
    To give you some options if you want to investigate, there is: dnsmasq, Technitium, Pi-Hole, Adguard Home. They can resolve external DNS queries, and also do domain redirection to handle your internal only domain and redirect to the device with your reverse proxy.
    
    That way, you can have a local domain like domain.lan or domain.internal that only works and is managed on your Internal network. And can use subdomains as well.
    
    source
    -> View More Comments
  - N0x0n@lemmy.ml ⁨4⁩ ⁨weeks⁩ ago
    Subpaths are things of the past (kinda) ! SSL wildcards are going to be a life saver in your homelab !
    
    I have a self-signed rootCA + intermediateCA which are signing all my certificates for my services. But wait… It can get easier just put a wildcard domain for your homelab (*.home.lab) and access all your services in your lan with a DNS provider (pihole will be your friend!).
    
    Here is an very simplified example:
    
    Create a rootCA (certificate authority) and put that on every device (Pc, laptop, android, iphone, tv, box…)
    
    Sign a server certificate with that rootCA for the following wildcard domaine: *.home.lab and put that behind a reverse proxy.
    
    Add pihole as DNS resolver for your local domain name (*.home.lab) or if you like you can manually add the routes on all devices… But that"s also a thing of the past !
    
    Let your proxy handle your services
    
    Access all your services with the following url in your lan
    
    myservice.home.lab
    
    navidrome.home.lab
    
    whateva.home.lab
    
    This works flawlessly without the need to pay for any domain name, everything is local and managed by yourself. However, it’s not that easy as stated above… OpenSSL and TLS certificates are a beast to tame and lots of reading ^^ so does Ngnix or any other reverse proxy !
    
    But as soon as you get the hang of it… You can add a new services in seconds :) (specially with docker containers !)
    
    source
    -> View More Comments
Flipper@feddit.org ⁨4⁩ ⁨weeks⁩ ago
Consider using Caddy. It is much simpler to setup and all the required headers get set automatically.

source
SpookyMulder@twun.io ⁨4⁩ ⁨weeks⁩ ago
Seems like something you may need to change in Transmission’s configuration, somewhere. Because it’s Transmission that is redirecting you and what you want is for that redirect to inclide the uri prefix.

Otherwise, I see two options:

use a regex location block and match against all expected patterns

use a dedicated subdomain (i.e: server block) for this (each) service you want to proxy

The latter is what I would do.
source
- brokenlcd@feddit.it ⁨4⁩ ⁨weeks⁩ ago
  If I remember correctly there was an option for that. I need to dig up the manual…
  
  Still, I think I’m going to need to change approach. Eventually one of the other services will bite me if I keep using subdirectories.
  
  source