I have 2 droplets (instances) on DigitalOcean. One is used as web server and has Nginx installed, one has my node.js app on it.
I've setup Nginx to take care of SSL, and to redirect all non-SSL and www traffic to https://url.com. I used proxy_pass to refer to the node app on my other droplet. So far so good. Everything works.
Now I want to also use Nginx to serve static files, instead of using Node. My static files are also on the App droplet, in the /var/www/node_app/public folder.
But for some reason I can't make it work to refer properly to them.
How do I do this?
This is my Nginx config:
server {
listen 80;
server_name www.url.com;
return 301 https://url.com$request_uri;
}
server {
listen 443 ssl;
server_name www.url.com;
return 301 https://url.com$request_uri;
ssl_certificate /etc/nginx/ssl/www.url.com.chained.crt;
ssl_certificate_key /etc/nginx/ssl/www.url.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
ssl_prefer_server_ciphers on;
}
server {
listen 443 ssl;
server_name url.com;
ssl_certificate /etc/nginx/ssl/www.url.com.chained.crt;
ssl_certificate_key /etc/nginx/ssl/www.url.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers AES256+EECDH:AES256+EDH:!aNULL;
ssl_prefer_server_ciphers on;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location ~ ^/(images/|fonts/) {
proxy_pass http://XX.XXX.XXX.XXX;
root /var/www/node_app/public;
autoindex off;
}
location / {
proxy_pass http://XX.XXX.XXX.XXX:4000;
proxy_redirect off;
proxy_http_version 1.1;
}
}
After limitless digging the internet for solutions. I retrace by step. I make sure my app static files should be configured like this
app.use(express.static(__dirname + '/public'));
on your nginx config for available site. add the following
$ sudo nano /etc/nginx/sites-available/example.com
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
After this test your config and restart your server using this command
$ sudo nginx -t
And
sudo systemctl restart nginx
And make sure all your html static files are reference with the forward trailing slash. Like this
<!-- Custom styles -->
<link href="/css/bundle.min.css" rel="stylesheet">
You can also following the digital ocean link on configuring nodejs application on
https://www.digitalocean.com/community/tutorials/how-to-set-up-a-node-js-application-for-production-on-ubuntu-18-04
Related
The project was very OK when I worked locally under development. Because the ports of backend 1337 and frontend 3000 were manually changed by me. After we deployed the project to the cloud server, we made OpenSSL work for the frontend. It meant to make nginx redirect requests from port 80 to safe 443, which expected to load the SSL certification. All is well until we tried to log in with our 1337 port to Strapi admin panel, which is part of a backend directory.
To be clear:
backend runs on 1337
frontend runs on 5000.
Both server processes run in pm2 in the background with no problem. nginx file seems to not have any syntax errors. But I can not reach any of the backend operations even through Postman.
What I expect it to do is: run all requests started with domain.com/api/ through localhost:1337. As it made happen with main directory, run through 'localhost:5000'. This is nginx config file:
server {
listen 80;
listen [::]:80;
server_name sinavhukuk.com www.sinavhukuk.com;
access_log /var/log/nginx/site80port.com.access.log;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name sinavhukuk.com www.sinavhukuk.com;
ssl_certificate /etc/letsencrypt/live/sinavhukuk.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/sinavhukuk.com/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'XXXXXXXXXX';
location /{
proxy_pass http://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
error_log /var/log/nginx/main-dir-error.log debug;
}
location /api{
proxy_pass http://localhost:1337;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
error_log /var/log/nginx/admin-error.log debug;
}
access_log /var/log/nginx/siteSSL.com.access.log;
error_log /var/log/nginx/siteSSL.com.error.log;
}
I'm working on a nodejs application and I want this app to be accessible via two domains (the two domains point to the same app) with nginx, the app is deployed on DigitalOcean droplet so
let's say I have my app : :port
and domain one: example1.com
and domain two: example2.com
I followed all the steps to set up ssl for one domain and I did the same for the second and here are my config files (they are in sites-available):
config example1.com
`server {
listen 443 ssl;
server_name example1.com;
ssl_certificate /etc/nginx/ssl-1/example1.com.crt;
ssl_certificate_key /etc/nginx/ssl-1/example1.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}`
config example2.com
`
server {
listen 443 ssl;
server_name example2.com;
ssl_certificate /etc/nginx/ssl-2/example2.com.crt;
ssl_certificate_key /etc/nginx/ssl-2/example2.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}`
example11.com works fine but example2.com not working and google chrome give this warning
basically, it's saying that the certificate of example2.com was issued for example1.com.
so anyone has an experience setting up two domains with ssl for the same application on nginx help me.
After redoing all the steps over and over I discovered that everything I did was correct just one thing I missed :
I forgot the site-enabled file for the second domain.
ln -s /etc/nginx/sites-available/example2 /etc/nginx/sites-enabled/example2
and after that everything worked fine
If it points to the same app, could you redirect? If so, try this:
server {
server_name example2.com;
return 301 https://example1.com;
}
I am trying to use a nodejs app behind an nginx reverse proxy to handle the ssl
I have my app running on localhost:2000. I can confirm this as working with a curl command.
This is my nginx setup:
# the IP(s) on which your node server is running. I chose port 3000.
upstream dreamingoftech.uk {
server 127.0.0.1:2000;
keepalive 16;
}
# the nginx server instance
server {
listen 0.0.0.0:80;
server_name dreamingoftech.uk;
return 301 https://$host$request_uri;
}
#HTTPS
server {
listen 443 ssl http2;
server_name dreamingoftech.uk;
access_log /var/log/nginx/dreamingoftech.log;
error_log /var/log/nginx/dreamingoftech.error.log debug;
ssl_certificate /etc/letsencrypt/live/dreamingoftech.uk/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dreamingoftech.uk/privkey.pem;
include snippets/ssl-params.conf;
# pass the request to the node.js server with the correct headers and much more can be added, see nginx config options
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-NginX-Proxy true;
proxy_pass http://dreamingoftech.uk/;
proxy_redirect off;
#proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "";
proxy_ssl_session_reuse off;
proxy_cache_bypass $http_upgrade;
}
}
if I now curl https://dreamingoftech.uk, it takes a while but I do get the webpage delivered. albeit with the message:
curl: (18) transfer closed with 1 bytes remaining to read
However when viewed from a browser I get a 502 gateway error.
I have checked the error log and this is the result: ERROR LOG
I can't understand why the reverse proxy is adding such a time delay into the process. Any ideas would be greatly appreciated.
PS: in the upstream config I have tried localhost instead of 127.0.0.1 to no avail
I have almost the same configuration. Can you try the following
You can redirect all http to https
server {
listen 80;
return 301 https://$host$request_uri;
}
or for a specific site like this
server {
server_name dreamingoftech.uk;
return 301 https://dreamingoftech.uk$request_uri;
}
but choose only one for your case
and then you make sure you node server is running on http mode and not https.
Also you mentioned that you run node on port 3000, then use port 3000 and not 2000 as I can see in your config.
After you confirm the above redirect all packets into localhost like this
server {
listen 443;
server_name dreamingoftech.uk;
ssl_certificate /etc/letsencrypt/live/dreamingoftech.uk/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dreamingoftech.uk/privkey.pem;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Fix the “It appears that your reverse proxy set up is broken" error.
proxy_pass http://localhost:3000;
proxy_read_timeout 90s;
proxy_redirect http://localhost:3000 https://dreamingoftech.uk;
}
}
Create a file and sum the above code put it in sites-available with a name like dreamingoftech.uk and the use ln -s to create a softlink into sites-enabled. go to your nginx.conf and make sure you include folder sites-enabled
Then must restart nginx to check if it works
#Stamos Thanks for your reply. I tried that but unfortunately it didn't work. I decided to try the most basic node app I could still using the basic modules I am using.
I tried this and it worked straight away.
The problem is with my app therefore. I will spend time rebuilding and testing step by step until I find the issue,
Thanks for your time!
I try to implement ssl in my node.js app but failed. Here is my app.js
https://gist.github.com/eldyvoon/7a1df560fd9d13da74d090e28f7ee801
In development (localhost) I got 'your connection is not private' error. I thought it was Chrome's problem.
So I try to deploy it to my ubuntu server, I use nginx proxy for my node.js app, my config as below
server {
listen 80;
server_name mysite.com;
location / {
proxy_pass http://localhost:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
}
}
But mysite.com refused to connect. No error in my node's console. I stuck for few days for this, need help. Please note that my site is running fine previously before trying to implement ssl.
You need to listen on port 443 and configure nginx to use some certificates.
Something like:
server {
listen 443;
server_name example.com;
add_header Strict-Transport-Security "max-age=3600";
ssl on;
ssl_certificate /.../chained2.pem;
ssl_certificate_key /.../domain.key;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_session_cache shared:SSL:50m;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://localhost:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
}
}
Add correct paths to your .pem and .key files. You can get the certificate for free from Let's Encrypt.
I have a Facebook game and since i started using nginx in front of node.js process it seems that many websocket connections are dropped. Does someone know if there are some versions of nginx and socket.io that are problematic or if someone has the good combination please let me and others with similar problem know. I am using socket.io 0.9.14 and nginx 1.6.2.
Here is mine nginx config file:
server {
listen 443;
server_name maumaugame.com;
access_log /var/log/nginx/maumau_access.log;
ssl on;
ssl_certificate /etc/ssl/certs/ssl-bundle.crt;
ssl_certificate_key /etc/ssl/private/maumaugame.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
proxy_pass http://node;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_read_timeout 86400s;
}
# Serve static files without going through upstreams
location ~ \.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|tar|wav|bmp|rtf|js|mp3)$ {
root /var/www/maumaugame.com/public_html/public;
access_log /var/log/nginx/maumau_other_access.log;
expires 1h;
}
}
upstream node {
ip_hash;
server 127.0.0.1:8000;
}
I don't know if moving to socket.io 1.0+ will solve this problem?