My issue:
I am using nginx:alpine docker image and using it as a webserver as well as reverse proxy. I am trying to reverse proxy: api.hume.ai and specifically websocket.
How I encountered the problem:
When I run this I get: wss://foo_domain/api/v0/evi/chat?fernSdkLanguage=JavaScript&fernSdkVersion=0.9.12&apiKey=&verbose_transcription=false
Solutions I’ve tried:
I have tried curl and openssl command from within my docker container and they all provide response. I even tried adding ssl_ciphers, proxy_ciphers settings etc. but nothing works (I am new to this). Later I removed these trial and errors from my config assuming that I am doing too much. I would really appreciate if someone could help here.
My config:
Main nginx file:
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format custom_log '$remote_addr - $remote_user [$time_local] "$request" '
'status=$status body_bytes_sent=$body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'"$http_x_forwarded_for" "$http_host" '
'request_uri="$request_uri" '
'query_string="$query_string" '
'request_headers="$http_user_agent, $http_accept, $http_accept_encoding" '
'proxied_request="$scheme://$proxy_host$request_uri"';
# access_log /var/log/nginx/access.log main;
access_log /var/log/nginx/access.log custom_log;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
# Define DNS resolver
resolver 8.8.8.8 8.8.4.4 valid=300s;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
include /etc/nginx/conf.d/*.conf;
}
Nginx Server File:
server {
listen 443 ssl;
server_name foo_domain;
ssl_certificate /etc/nginx/ssl/fullchain.pem; # Path to your fullchain.pem
ssl_certificate_key /etc/nginx/ssl/server.key; # Path to your server.key
# Content Security Policy (CSP) header for the entire website
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self' wss: ws:;" always;
error_log /var/log/nginx/error.log debug;
error_log /dev/stdout debug;
location /api/ {
# Capture the entire query string
set $intercepted_requesturi $request_uri;
# If api_key is present, replace its value with "secret_value"
if ($intercepted_requesturi ~ "^(.*[&?])*apiKey=(.*)$") {
# Reconstruct the query string with api_key=secret_value
set $firstvar $1;
set $secondvar $2;
set $intercepted_requesturi "${firstvar}apiKey=secret_value${secondvar}";
}
proxy_pass https://third_pary_domain/$intercepted_requesturi; # Replace with the backend server's URL
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
}
server {
listen 80;
server_name foo_domain;
return 301 https://$host$request_uri;
}