How do i configure minio using iis as a reverse proxy - iis

Question

I am trying to configure minio using IIS as a reverse proxy.
I want the main service to run from minio.mysite.com and the console to run from console.minio.mysite.com, both of which is already configured with my webhost/dns.
docker-compose.yml
version: '3.7'
networks:
minio_network2:
name: minio_network2
services:
minio_web2:
image: quay.io/minio/minio:RELEASE.2021-10-23T03-28-24Z
container_name: minio_web2
restart: unless-stopped
command: server --console-address ":9001" /data
environment:
MINIO_ROOT_USER: multinerd#mysite.com
MINIO_ROOT_PASSWORD: super_secure_pass
# MINIO_SERVER_URL: https://minio.mysite.com
# MINIO_BROWSER_REDIRECT_URL: https://console.minio.mysite.com
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
interval: 30s
timeout: 20s
retries: 3
networks:
- minio_network2
volumes:
- ./minio-data/minio:/data
minio_nginx2:
image: nginx:1.19.2-alpine
container_name: minio_nginx2
restart: unless-stopped
hostname: nginx
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
ports:
- "3009:9000" ## Client
- "30091:9001" ## Console
depends_on:
- minio_web2
networks:
- minio_network2
nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 4096;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
keepalive_timeout 65;
# include /etc/nginx/conf.d/*.conf;
upstream minio {
server minio_web2:9000;
}
upstream console {
ip_hash;
server minio_web2:9001;
}
server {
listen 9000;
listen [::]:9000;
server_name localhost;
# To allow special characters in headers
ignore_invalid_headers off;
# Allow any size file to be uploaded.
# Set to a value such as 1000m; to restrict file size to a specific value
client_max_body_size 0;
# To disable buffering
proxy_buffering off;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 300;
# Default is HTTP/1, keepalive is only enabled in HTTP/1.1
proxy_http_version 1.1;
proxy_set_header Connection "";
chunked_transfer_encoding off;
proxy_pass http://minio;
}
}
server {
listen 9001;
listen [::]:9001;
server_name localhost;
# To allow special characters in headers
ignore_invalid_headers off;
# Allow any size file to be uploaded.
# Set to a value such as 1000m; to restrict file size to a specific value
client_max_body_size 0;
# To disable buffering
proxy_buffering off;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-NginX-Proxy true;
# This is necessary to pass the correct IP to be hashed
real_ip_header X-Real-IP;
proxy_connect_timeout 300;
# To support websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
chunked_transfer_encoding off;
proxy_pass http://console;
}
}
}
In IIS, I've set up 2 websites.
S_Minio
binds to minio.mysite.com
rewrite rules
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="RedirectBrowsers" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" negate="false" />
<conditions logicalGrouping="MatchAny" trackAllCaptures="false">
<add input="{HTTP_USER_AGENT}" pattern="*firefox*" />
<add input="{HTTP_USER_AGENT}" pattern="*edge*" />
<add input="{HTTP_USER_AGENT}" pattern="*chrome*" />
</conditions>
<action type="Redirect" url="https://console.minio.mysite.com/login" logRewrittenUrl="true" redirectType="Found" />
</rule>
<rule name="Docker reverse proxy for minio" enabled="true" stopProcessing="false">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{HTTP_HOST}" pattern="*console*" />
</conditions>
<action type="Rewrite" url="http://10.200.2.67:3009/{R:1}" logRewrittenUrl="true" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
S_Minio_Console
binds to console.minio.mysite.com
rewrite rules
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Docker reverse proxy for minio console" enabled="true" stopProcessing="true">
<match url="(.*)" />
<action type="Rewrite" url="http://10.200.2.67:30091/{R:1}" appendQueryString="true" logRewrittenUrl="true" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
Up until this point, everything works well.
If I visit https://minio.mysite.com, I get redirected to https://console.minio.mysite.com.
I can log in to the console and view my files.
If I try to share a file, the following url gets generated: http://172.18.0.2:9000/test/my_excel_file.xlsx?query_strings_ommitied which is no good.
According to the things to consider section, I updated my docker-compose.yml file with the following changes
services:
minio_web2:
...
environment:
...
+ MINIO_SERVER_URL: https://minio.mysite.com
+ MINIO_BROWSER_REDIRECT_URL: https://console.minio.mysite.com
Now when I log in, I get a error Post "https://minio.mysite.com/": dial tcp: i/o timeout.
nginx and my rewrite rules have not changed and im not sure what to change from this point.