How to use HTTPS URLs as upstream backend services

What I’m trying to do:
I am trying to use nginx as a load balancer, but the backend services is deploied on gcp cloud run service, so it only has https url. And the config below it worked 2 months ago.

worker_processes auto;

events {
    worker_connections 1024;
}

http {
    resolver 8.8.8.8 8.8.4.4 ipv6=off;

    upstream backend_servers {
        server walrus-client-1.us-central1.run.app:443;
        server walrus-client-2.us-central1.run.app:443;
    }

    server {
        listen 8080;

        location /v1/blobs {
            proxy_pass https://backend_servers;  
            proxy_ssl_server_name on;
            proxy_ssl_verify off;


            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            access_log /var/log/nginx/store_access.log;
            error_log /var/log/nginx/store_error.log debug;
    
            client_max_body_size 50M;
            client_body_buffer_size 16M;

            proxy_connect_timeout 300s;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }


        location / {
            return 404;
        }
    }
}

Where I’m stuck:
But the response always be 404 error.

What I’ve already tried:
I tried directly use a backend service for proxy_pass:
proxy_pass https://walrus-client-1.us-central1.run.app;
and set :
proxy_set_header Host walrus-client-1.us-central1.run.app;
it works in this config, my request can pass to my cloud run backend, but can not realise the load balance. Is there anyway that i can config the proxy_set_header Host dynamically?

1 Like

Hi,

an upstream { } group of servers means that all servers in the group are configured identically. The potential solution may have “double proxy” configuration:

  • proxy to 127.0.0.1, where possible to set a specific header;
  • proxy to an upstream.

Also, in case of FQDN in an upstream { } the recommended approach is to use resolve parameter for every server entry.

Hope that helps.

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.