Any suggestions for 2nd level Nginx reverse-proxy config - Superdesk Development Discussions on Sourcefabric Forum

Chux · Post edited by Chux at 2018-09-01 16:14:12

Hi,

I used the automated installation shell script, so I am up and running and can login to the web UI. I also see the nginx config that gets deployed as part of the automated install.

I have deployed within an intranet (not visible on the internet) - this is standard in my dev life-cycle. Typically, I rely on a single nginx reverse-proxy for everything I want to expose.

I have been trying to get Superdesk working through this reverse proxy (which uses letsencrypt to provide ssl, but terminates to non-ssl servers within the intranet). The intention is to share whatever config I finally get working.

So, basically I want to do:

P ==> N ==> Superdesk components

N is the Nginx server setup by the auto-install script on the system system where all of Superdesk components are deployed .. and my biggest issue is how to ensure all components work well when accessed via P (which is an nginx reverse-proxy server) ..

Any pointers or suggestions on how I might go about this?

Chux

Turns out that I needed to reproduce the exact level-1 proxy deployed by the first level nginx reverse proxy as installed and configured during the auto-install

So, I ended up with the following, assuming that superdesk and nginx level-1 reverse proxy are deployed on 192.168.77.10

    location / {
        proxy_pass http://192.168.77.10/;
        proxy_redirect http://192.168.77.10/ https://superdesk.example.com/;
        # TODO: use "config.js:server" for user installations
        sub_filter_once off;
        sub_filter_types application/javascript;
        sub_filter 'http://localhost' 'http://$host';
        sub_filter 'ws://localhost/ws' 'ws://$host/ws';
        #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include /etc/nginx/proxy_params;
    }

    location /ws {
        proxy_pass http://192.168.77.10:5100;
        proxy_redirect http://192.168.77.10:5100/ https://superdesk.example.com/ws;
        include /etc/nginx/proxy_params;
        #proxy_http_version 1.1;
        #proxy_buffering off;
        #proxy_read_timeout 3600;
        #proxy_set_header Upgrade $http_upgrade;
        #proxy_set_header Connection "Upgrade";
    }

    location /api {
        proxy_pass http://192.168.77.10:5000;
        proxy_redirect http://192.168.77.10:5000/ https://superdesk.example.com/api;
        include /etc/nginx/proxy_params;
        #proxy_set_header Host localhost;
        expires epoch;

        sub_filter_once off;
        sub_filter_types application/json;
        sub_filter 'http://localhost' 'http://$host';
    }

    location /contentapi {
        proxy_pass http://192.168.77.10:5400;
        proxy_redirect http://192.168.77.10:5400/ https://superdesk.example.com/contentapi;
        include /etc/nginx/proxy_params;
        #proxy_set_header Host localhost;
        expires epoch;
    }

    location /mail {
        proxy_pass http://192.168.77.10/mail;
        proxy_redirect http://192.168.77.10/mail https://superdesk.example.com/mail;
        #alias /var/log/superdesk/mail/;
        include /etc/nginx/proxy_params;
        default_type text/plain;
        autoindex on;
        autoindex_exact_size off;
    }

Chux

Well, it won't work because of mixed mode content in how the /api and /ws servers are accessed.

Have tried creating a detached nginx proxy for websockets, but that doesn't help ..

The calls to ws:// urls are embedded in so many places within app.bundle.js .. so, fronting superdesk with an ssl reverse-proxy may not be possible, without editing all these ws;// calls in app.bundle.js ..

Doesn't help that there is absolutely no information around this, and important forum questions are not answered.

May have to move on from this .. looking like the system is too far from being usable ..

Petr Jasek

you can change the websocket url in config.js file you add to dist folder, like this one:

window.superdeskConfig={		
    defaultTimezone: "Europe/Oslo",
    server: {
        url: "https://example.superdesk.pro/api",
        ws: "wss://example.superdesk.pro/ws"
    },
};

Howdy, Stranger!

Categories

Poll

Top Posters