Nginx reverse proxy for Prometheus, Alertmanager, Grafana one domain with subdirectories

nginx-alertmanager-prometheus-grafana

# add to /lib/systemd/system/prometheus.service 
# --web.external-url=https://monitoring.mydomain.com/prometheus/ 
# add to /lib/systemd/system/alertmanager.service
#  --web.external-url=https://monitoring.mydomain.com/alertmanager \
#  --web.route-prefix="/" \
#  --cluster.advertise-address=0.0.0.0:9093
# systemctl daemon-reload
# systemctl restart prometheus alertmanager
# 
cat <<EOF > /etc/nginx/conf.g/monitoring.conf
upstream @prometheus {
    server 0.0.0.0:9090;
}
upstream @alertmanager {
    server 0.0.0.0:9093;
}
upstream @grafana {
    server 0.0.0.0:3000;
}



server {
    listen 80;
    listen [::]:80;
    server_name monitoring.mydomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2 ;
    listen [::]:443; 
    server_name monitoring.mydomain.com;

    keepalive_timeout 75s 75s;

    #log_format timed_combined '$remote_addr - $remote_user [$time_local] '
    #'"$request" $status $body_bytes_sent '
    #'"$http_referer" "$http_user_agent" '
    #'$request_time $upstream_response_time $pipe';
    access_log /var/log/nginx/prometheus/access.log;

    # Perfect forward secrecy
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/dhparams.pem;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

 
    ssl_certificate /etc/ssl/monitoring_mydomain_com.crt;
    ssl_certificate_key /etc/ssl/monitoring_mydomain_com.key;

    error_log /var/log/nginx/prometheus/error.log;

    location /prometheus/ {
        gzip_types *;
        proxy_pass         http://@prometheus/prometheus/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $host:443;
        proxy_set_header   X-Forwarded-Server $host;
        proxy_set_header   X-Forwarded-Port 443;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    location /alertmanager/ {
        gzip_types *;
        proxy_pass         http://@alertmanager/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $host:443;
        proxy_set_header   X-Forwarded-Server $host;
        proxy_set_header   X-Forwarded-Port 443;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    location /grafana/ {
        proxy_pass         http://@grafana/;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $host:443;
        proxy_set_header   X-Forwarded-Server $host;
        proxy_set_header   X-Forwarded-Port 443;
        proxy_set_header   X-Forwarded-Proto $scheme;

    }

    # Proxy Grafana Live WebSocket connections.
    location /grafana/api/live {
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host   $host:443;
        proxy_set_header   X-Forwarded-Server $host;
        proxy_set_header   X-Forwarded-Port 443;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $http_host;
        proxy_pass http://@grafana/;
    }

    location / {
        gzip_types *;

        return 301 /prometheus;
    }
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}
EOF

systemctl reload nginx