aboutsummaryrefslogtreecommitdiff
path: root/content/blog/2022-04-02-nginx-reverse-proxy.md
diff options
context:
space:
mode:
authorChristian Cleberg <hello@cleberg.net>2024-04-29 14:18:55 -0500
committerChristian Cleberg <hello@cleberg.net>2024-04-29 14:18:55 -0500
commitfdd80eadcc2f147d0198d94b7b908764778184a2 (patch)
treefbec9522ea9aa13e8105efc413d2498c3c5b4cd6 /content/blog/2022-04-02-nginx-reverse-proxy.md
parentd6c80fdc1dea9ff242a4d3c7d3939d2727a8da56 (diff)
downloadcleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.gz
cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.bz2
cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.zip
format line wrapping and fix escaped characters
Diffstat (limited to 'content/blog/2022-04-02-nginx-reverse-proxy.md')
-rw-r--r--content/blog/2022-04-02-nginx-reverse-proxy.md175
1 files changed, 83 insertions, 92 deletions
diff --git a/content/blog/2022-04-02-nginx-reverse-proxy.md b/content/blog/2022-04-02-nginx-reverse-proxy.md
index 70b8794..4ece921 100644
--- a/content/blog/2022-04-02-nginx-reverse-proxy.md
+++ b/content/blog/2022-04-02-nginx-reverse-proxy.md
@@ -7,36 +7,34 @@ draft = false
# What is a Reverse Proxy?
-A reverse proxy is a server that is placed between local servers or
-services and clients/users (e.g., the internet). The reverse proxy
-intercepts all requests from clients at the network edge and uses its
-configuration files to determine where each request should be sent.
+A reverse proxy is a server that is placed between local servers or services and
+clients/users (e.g., the internet). The reverse proxy intercepts all requests
+from clients at the network edge and uses its configuration files to determine
+where each request should be sent.
## A Brief Example
-For example, let\'s say that I run three servers in my home:
+For example, let's say that I run three servers in my home:
-- Server~01~ (`example.com`)
-- Server~02~ (`service01.example.com`)
-- Server~03~ (`service02.example.com`)
+- Server01 (`example.com`)
+- Server02 (`service01.example.com`)
+- Server03 (`service02.example.com`)
-I also run a reverse proxy in my home that intercepts all public
-traffic:
+I also run a reverse proxy in my home that intercepts all public traffic:
-- Reverse Proxy
+- Reverse Proxy
-Assume that I have a domain name (`example.com`) that allows
-clients to request websites or services from my home servers.
+Assume that I have a domain name (`example.com`) that allows clients to request
+websites or services from my home servers.
-In this case, the reverse proxy will intercept all traffic from
-`example.com` that enters my network and determine if the
-client is requesting valid data, based on my configuration.
+In this case, the reverse proxy will intercept all traffic from `example.com`
+that enters my network and determine if the client is requesting valid data,
+based on my configuration.
-If the user is requesting `example.com` and my configuration
-files say that Server~01~ holds that data, Nginx will send the user to
-Server~01~. If I were to change the configuration so that
-`example.com` is routed to Server~02~, that same user would
-be sent to Server~02~ instead.
+If the user is requesting `example.com` and my configuration files say that
+Server~01~ holds that data, Nginx will send the user to Server~01~. If I were to
+change the configuration so that `example.com` is routed to Server~02~, that
+same user would be sent to Server~02~ instead.
``` txt
┌──────┐ ┌───────────┐
@@ -52,62 +50,61 @@ be sent to Server~02~ instead.
# Reverse Proxy Options
-There are a lot of options when it comes to reverse proxy servers, so
-I\'m just going to list a few of the options I\'ve heard recommended
-over the last few years:
+There are a lot of options when it comes to reverse proxy servers, so I'm just
+going to list a few of the options I've heard recommended over the last few
+years:
-- [Nginx](https://nginx.com)
-- [Caddy](https://caddyserver.com)
-- [Traefik](https://traefik.io/)
-- [HAProxy](https://www.haproxy.org/)
-- [Squid](https://ubuntu.com/server/docs/proxy-servers-squid)
+- [Nginx](https://nginx.com)
+- [Caddy](https://caddyserver.com)
+- [Traefik](https://traefik.io/)
+- [HAProxy](https://www.haproxy.org/)
+- [Squid](https://ubuntu.com/server/docs/proxy-servers-squid)
-In this post, we will be using Nginx as our reverse proxy, running on
-Ubuntu Server 20.04.4 LTS.
+In this post, we will be using Nginx as our reverse proxy, running on Ubuntu
+Server 20.04.4 LTS.
# Nginx Reverse Proxy Example
## Local Applications
-You may be like me and have a lot of applications running on your local
-network that you\'d like to expose publicly with a domain.
+You may be like me and have a lot of applications running on your local network
+that you'd like to expose publicly with a domain.
-In my case, I have services running in multiple Docker containers within
-a single server and want a way to visit those services from anywhere
-with a URL. For example, on my local network, [Dashy](https://dashy.to)
-runs through port 4000 (`localhost:4000`) and [Uptime
+In my case, I have services running in multiple Docker containers within a
+single server and want a way to visit those services from anywhere with a URL.
+For example, on my local network, [Dashy](https://dashy.to) runs through port
+4000 (`localhost:4000`) and [Uptime
Kuma](https://github.com/louislam/uptime-kuma) runs through port 3001
(`localhost:3001`).
In order to expose these services to the public, I will need to do the
following:
-1. Set up DNS records for a domain or subdomain (one per service) to
- point toward the IP address of the server.
-2. Open up the server network\'s HTTP and HTTPS ports (80 & 443) so
- that the reverse proxy can accept traffic and determine where to
- send it.
-3. Install the reverse proxy software.
-4. Configure the reverse proxy to recognize which service should get
- traffic from any of the domains or subdomains.
+1. Set up DNS records for a domain or subdomain (one per service) to point
+ toward the IP address of the server.
+2. Open up the server network's HTTP and HTTPS ports (80 & 443) so that the
+ reverse proxy can accept traffic and determine where to send it.
+3. Install the reverse proxy software.
+4. Configure the reverse proxy to recognize which service should get traffic
+ from any of the domains or subdomains.
## Step 1: DNS Configuration
-To start, update your DNS configuration so that you have an
-`A` record for each domain or subdomain.
+To start, update your DNS configuration so that you have an `A` record for each
+domain or subdomain.
-The `A` records should point toward the public IP address of
-the server. If you don\'t know the public IP address, log in to the
-server and run the following command:
+The `A` records should point toward the public IP address of the server. If you
+don't know the public IP address, log in to the server and run the following
+command:
```sh
curl ifconfig.co
```
-In the DNS example below, `xxx.xxx.xxx.xxx` is the public IP
-address of the server.
+In the DNS example below, `xxx.xxx.xxx.xxx` is the public IP address of the
+server.
-``` config
+```conf
example.com A xxx.xxx.xxx.xxx
uptime.example.com A xxx.xxx.xxx.xxx
dashy.example.com A xxx.xxx.xxx.xxx
@@ -115,33 +112,30 @@ www CNAME example.com
```
Finally, ensure the DNS has propagated correctly with [DNS
-Checker](https://dnschecker.org) by entering your domains or subdomains
-in the search box and ensuring the results are showing the correct IP
-address.
+Checker](https://dnschecker.org) by entering your domains or subdomains in the
+search box and ensuring the results are showing the correct IP address.
## Step 2: Open Network Ports
-This step will be different depending on which router you have in your
-home. If you\'re not sure, try to visit
-[192.168.1.1](http://192.168.1.1) in your browser. Login credentials are
-usually written on a sticker somewhere on your modem/router.
+This step will be different depending on which router you have in your home. If
+you're not sure, try to visit [192.168.1.1](http://192.168.1.1) in your
+browser. Login credentials are usually written on a sticker somewhere on your
+modem/router.
-Once you\'re able to log in to your router, find the Port Forwarding
-settings. You will need to forward ports `80` and
-`443` to whichever machine is running the reverse proxy.
+Once you're able to log in to your router, find the Port Forwarding settings.
+You will need to forward ports `80` and `443` to whichever machine is running
+the reverse proxy.
-In my case, the table below shows the port-forwarding rules I\'ve
-created. In this table, `xxx.xxx.xxx.xxx` is the local device
-IP of the reverse proxy server, it will probably be an IP between
-`192.168.1.1` and `192.168.1.255`.
+In my case, the table below shows the port-forwarding rules I've created. In
+this table, `xxx.xxx.xxx.xxx` is the local device IP of the reverse proxy
+server, it will probably be an IP between `192.168.1.1` and `192.168.1.255`.
- NAME FROM PORT DEST PORT/IP ENABLED
- ------- ------ ------ ----------------- ---------
- HTTP ​\*\* 80 xxx.xxx.xxx.xxx TRUE
- HTTPS ​\*\* 443 xxx.xxx.xxx.xxx TRUE
+| NAME | FROM PORT | DEST PORT/IP | ENABLED |
+|-------|-----------|-----------------|---------|
+| HTTP | 80 | xxx.xxx.xxx.xxx | TRUE |
+| HTTPS | 443 | xxx.xxx.xxx.xxx | TRUE |
-Once configured, these rules will direct all web traffic to your reverse
-proxy.
+Once configured, these rules will direct all web traffic to your reverse proxy.
## Step 3: Nginx Installation
@@ -151,12 +145,11 @@ To install Nginx, simply run the following command:
sudo apt install nginx
```
-If you have a firewall enabled, open up ports `80` and
-`443` on your server so that Nginx can accept web traffic
-from the router.
+If you have a firewall enabled, open up ports `80` and `443` on your server so
+that Nginx can accept web traffic from the router.
-For example, if you want to use `ufw` for web traffic and
-SSH, run the following commands:
+For example, if you want to use `ufw` for web traffic and SSH, run the following
+commands:
```sh
sudo ufw allow 'Nginx Full'
@@ -166,14 +159,12 @@ sudo ufw enable
## Step 4: Nginx Configuration
-Now that we have domains pointing toward the server, the only step left
-is to configure the reverse proxy to direct traffic from domains to
-local services.
+Now that we have domains pointing toward the server, the only step left is to
+configure the reverse proxy to direct traffic from domains to local services.
-To start, you\'ll need to create a configuration file for each domain in
-`/etc/nginx/sites-available/`. They will look identical
-except for the `server_name` variable and the
-`proxy_pass` port.
+To start, you'll need to create a configuration file for each domain in
+`/etc/nginx/sites-available/`. They will look identical except for the
+`server_name` variable and the `proxy_pass` port.
Dashy:
@@ -209,8 +200,8 @@ server {
}
```
-Once the configuration files are created, you will need to enable them
-with the `symlink` command:
+Once the configuration files are created, you will need to enable them with the
+`symlink` command:
```sh
sudo ln -s /etc/nginx/sites-available/dashy.example.com /etc/nginx/sites-enabled/
@@ -220,12 +211,12 @@ Voilà! Your local services should now be available through their URLs.
# HTTPS with Certbot
-If you\'ve followed along, you\'ll notice that your services are only
-available via HTTP (not HTTPS).
+If you've followed along, you'll notice that your services are only available
+via HTTP (not HTTPS).
-If you want to enable HTTPS for your new domains, you will need to
-generate SSL/TLS certificates for them. The easiest way to generate
-certificates on Nginx is [Certbot](https://certbot.eff.org):
+If you want to enable HTTPS for your new domains, you will need to generate
+SSL/TLS certificates for them. The easiest way to generate certificates on Nginx
+is [Certbot](https://certbot.eff.org):
```sh
sudo apt install snapd; sudo snap install core; sudo snap refresh core