Created
May 21, 2019 23:03
-
-
Save Kiran01bm/64e354261f3adfb621c4c3eba9fe9e1b to your computer and use it in GitHub Desktop.
Nginx config when Backend is SNI based.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# For more information on configuration, see: | |
# * Official English Documentation: http://nginx.org/en/docs/ | |
# * Official Russian Documentation: http://nginx.org/ru/docs/ | |
##################################################################################################################### | |
########## For backend which is based on SNI - 3 options: | |
#1. Set HOST header with the actual domain name for the backend. | |
# OR | |
#2. Add the SNI lines below and HOST header (#1) not required in that case. | |
# OR | |
#3. Dont override the Host header (#1) or provide SNI (#2), The default HOST header propgates to the backend when the host header has the required backend domain name. | |
##################################################################################################################### | |
user nginx; | |
worker_processes auto; | |
error_log /var/log/nginx/error.log; | |
pid /run/nginx.pid; | |
# Load dynamic modules. See /usr/share/nginx/README.dynamic. | |
include /usr/share/nginx/modules/*.conf; | |
events { | |
worker_connections 1024; | |
} | |
http { | |
log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | |
'$status $body_bytes_sent "$http_referer" ' | |
'"$http_user_agent" "$http_x_forwarded_for"'; | |
access_log /var/log/nginx/access.log main; | |
sendfile on; | |
tcp_nopush on; | |
tcp_nodelay on; | |
keepalive_timeout 65; | |
types_hash_max_size 2048; | |
include /etc/nginx/mime.types; | |
default_type application/octet-stream; | |
# Load modular configuration files from the /etc/nginx/conf.d directory. | |
# See http://nginx.org/en/docs/ngx_core_module.html#include | |
# for more information. | |
include /etc/nginx/conf.d/*.conf; | |
server { | |
listen 80 default_server; | |
#IPv6 listen [::]:80 default_server; | |
server_name _; | |
root /usr/share/nginx/html; | |
# Load configuration files for the default server block. | |
include /etc/nginx/default.d/*.conf; | |
location / { | |
} | |
error_page 404 /404.html; | |
location = /40x.html { | |
} | |
error_page 500 502 503 504 /50x.html; | |
location = /50x.html { | |
} | |
} | |
# Settings for a TLS enabled server. | |
server { | |
listen 443 ssl http2 default_server; | |
#IPv6 listen [::]:443 ssl http2 default_server; | |
server_name _; | |
root /usr/share/nginx/html; | |
ssl_certificate "/etc/pki/nginx/server.crt"; | |
ssl_certificate_key "/etc/pki/nginx/private/server.key"; | |
ssl_session_cache shared:SSL:1m; | |
ssl_session_timeout 10m; | |
ssl_ciphers HIGH:!aNULL:!MD5; | |
ssl_prefer_server_ciphers on; | |
# Load configuration files for the default server block. | |
include /etc/nginx/default.d/*.conf; | |
location / { | |
#HOST-OVERRIDE proxy_set_header Host app-proj.mydomain.com.au; | |
proxy_set_header X-Real-IP $remote_addr; | |
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | |
proxy_set_header X-Forwarded-Proto $scheme; | |
# Fix the “It appears that your reverse proxy set up is broken" error. | |
proxy_pass https://app-proj.mydomain.com.au; | |
proxy_read_timeout 60; | |
#SNI proxy_ssl_name app-proj.mydomain.com.au; | |
#SNI proxy_ssl_server_name on; | |
proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
proxy_ssl_session_reuse off; | |
} | |
error_page 404 /404.html; | |
location = /40x.html { | |
} | |
error_page 500 502 503 504 /50x.html; | |
location = /50x.html { | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment