Скачать или смотреть How to Configure an Nginx SSL-Passthrough Reverse Proxy for HTTP and HTTPS Connections

Discover how to set up an Nginx reverse proxy that efficiently handles both HTTP and HTTPS connections using SSL passthrough and termination with our comprehensive guide.
---
This video is based on the question https://stackoverflow.com/q/77964008/ asked by the user 'Luiz Pasqualetto' ( https://stackoverflow.com/u/15982653/ ) and on the answer https://stackoverflow.com/a/77970660/ provided by the user 'Luiz Pasqualetto' ( https://stackoverflow.com/u/15982653/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, comments, revision history etc. For example, the original title of the Question was: Need help configuring an Nginx SSL-Passthrough Reverse Proxy that allows HTTP and HTTPS connections

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Introduction

When setting up an Nginx reverse proxy, handling both HTTP and HTTPS connections can be a challenging task, particularly when incorporating SSL passthrough. Many developers encounter difficulties configuring Nginx to meet their specific needs, especially when equipment limitations prevent the transition from HTTP to HTTPS. In this guide, we will explore how to configure an Nginx SSL-passthrough reverse proxy that allows HTTP connections on port 80 while providing SSL passthrough for HTTPS connections on port 443.

Understanding the Problem

In this scenario, the requirements are:

Accept both HTTP and HTTPS connections for different web servers.

Maintain HTTP traffic on port 80 due to equipment constraints.

Enable SSL passthrough for seamless HTTPS connections.

While it may seem straightforward to redirect HTTP traffic to HTTPS, some setups require preserving the HTTP traffic. This leads to the need for a specific configuration that allows for SSL passthrough and serves HTTP traffic correctly.

Common Issues

Users typically encounter issues like:

HTTP traffic not receiving proper address information from the upstream server.

Errors in log files indicating misconfigurations.

Proposed Solution

The solution entails a careful and organized configuration of the Nginx server. Here’s how you can achieve this:

1. Basic Structure

The following structure is a complete Nginx configuration using a separate stream block for SSL passthrough and an HTTP block for regular traffic handling.

[[See Video to Reveal this Text or Code Snippet]]

2. Configuration Breakdown

Stream Block: Handles SSL passthrough. The map directive identifies the SNI (Server Name Indication) to route incoming HTTPS requests to the correct backend server.

Upstream Configuration: Define the backend servers for both HTTPS and HTTP requests which allows redundancy and load balancing.

HTTP Block: Directly terminates HTTP connections. This section clearly defines how to manage requests without redirecting them to HTTPS.

Access and Error Logs: Monitor your setup effectively to troubleshoot issues by using defined logs for both HTTP and stream activities.

3. Testing the Configuration

After implementing the configuration, restart the Nginx service and analyze logs for any errors. Access your sites on both HTTP and HTTPS to ensure proper handling.

Conclusion

Configuring an Nginx SSL-passthrough reverse proxy to handle both HTTP and HTTPS connections can initially seem intricate, especially with special requirements. However, by following the clear structure and breakdown provided in this guide, you can achieve a fully functional setup. Remember, continuous testing and iteration can help refine your configuration further.

If you have any suggestions or questions, feel free to reach out, as community feedback helps improve everyone's experience!