Proxy with server_name

Projects NGINX
1

Can I use proxy_pass https://127.0.0.1 to proxy to a server that has server_name? If I use the server_name like proxy_pass https://example.com then I need a resolver which I don’t want to set up.

I want to use https instead of http in proxy_pass because the server I’m proxying is using SSL.

Does someone have an example of how to use unix sockets for this?

2

Hi there,

The proxy_pass docs are at http://nginx.org/r/proxy_pass . That shows how to use a unix socket as the upstream service (proxy_pass http://unix:/tmp/backend.socket:/uri/;).

If you use “proxy_pass https://example.com;”, you don’t need a within-nginx resolver – nginx will either read the “upstream example.com {}” configuration block to find “server” addresses, or will use the system resolver at load time to resolve example.com (and will not re-resolve while running).

But if the issue is that you want to validate the certificate presented by the proxied upstream server, or you want to send the correct SNI header to that proxied upstream server, then you can use “proxy_pass https://127.0.0.1;” but you will almost certainly want to add proxy_ssl_name (http://nginx.org/r/proxy_ssl_name) and maybe proxy_set_header (http://nginx.org/r/proxy_set_header) with “Host” for consistency.

Cheers,

3

The issue is I want to proxy without using a resolver. It would work if I only had one server block because it would always proxy to that one but if I have many server blocks with different server_names it won’t work because proxy_pass needs to know which one to use.

Is there a way to do it without a resolver? Unix sockets can be one way if it works.

4

Hi there,

there are (at least) two ways to do it without using any external resolver.

You can “proxy_pass” to the ip:port, and “proxy_set_header host” the appropriate name; or you can “upstream” the appropriate name with “server” to define the ip:port, and then “proxy_pass” to the upstream-name, letting the default values of “proxy_set_header” be used.

Demonstrating both: this config snippet is in one nginx “http” block that defines three server{}s listening on 127.0.0.1:8080 identified by server_name plus two upstream{}s that “resolve” some names to ip:ports. It also has one server{} listening on 8088 that will proxy_pass to another server{}, depending on the incoming request.

Each server{} returns some content indicating the block and request that was used.

    upstream one {
        server 127.0.0.1:8080;
    }
    upstream two.example.com {
        server 127.0.0.1:8080;
    }
    server {
        listen       127.0.0.1:8080;
        server_name  one one.example.com;
        return 200 "server $server_name\nhost $http_host\nrequest $request_uri\nuri $uri\n";
    }
    server {
        listen       127.0.0.1:8080;
        server_name  two two.example.com;
        return 200 "server $server_name\nhost $http_host\nrequest $request_uri\nuri $uri\n";
    }
    server {
        listen       127.0.0.1:8080;
        server_name  three three.example.com;
        return 200 "server $server_name\nhost $http_host\nrequest $request_uri\nuri $uri\n";
    }

    server {
        listen       8088;
        server_name  main.example.com;

        location ^~ /one/ {
            proxy_pass http://one;
        }
        location ^~ /two/ {
            proxy_pass http://two.example.com/;
        }
        location ^~ /three/ {
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header host "three.example.com";
        }
        location / {
            return 200 "ok\n";
        }
    }

With that, you can see if the output that you get, matches the output that you expect, from the commands:

$ curl http://localhost:8088/zero/
$ curl http://localhost:8088/one/
$ curl http://localhost:8088/two/
$ curl http://localhost:8088/three/

(Note that the extra / at the end of one proxy_pass is intentional, to show how that matters.)

If the upstream services are https not http, the other directives mentioned previously might matter too.

Cheers,