使用SSL，AWS Load Balancer，Nginx和Gunicorn的具有复杂堆栈的Dja​​ngo Rest Framework错误的超链接

Question

I can't find out how to correctly set up nginx so my hyperlinks in API build by DRF are correct.

My current configuration for nginx is:

upstream web {
  ip_hash;
  server web:8000;
}

# portal
server {
  listen 8000;
  server_name localhost;

  location / {
        proxy_set_header        Host $host:$server_port;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_pass http://web/;
    }
}

nginx is running inside a container exposing port 8000 and maps it into internally running gunicorn (also in a container) also on 8000 . So when I spin up the whole docker machinery, I can nicely access localhost:8000/api and links are rendered OK. Even when I access it using different domain (eg if I set in /etc/hosts : 127.0.0.1 mytest.com ), the URL and port get passed correctly to the DRF and links are rendered as expect.

But this service must sit behind AWS Load Balancer with certificate using SSL. Hostname on this LB is set otherdomain.com and it redirects traffic to the machine where the above nginx is run using HTTP on port 8000. Then, when try to access it using https://otherdomain.com/api , links are rendered as http://otherdomain.com:8000/api/ <- hence wrong scheme (http instead https) and wrong port (8000 instead of 80/443). It make sense, since nginx doesn't know anything about the original request coming to load balancer...

None of the ideas I could think of sounds correct. Would greatly appreciate any help. I am willing to change the infrastructure of course.

Any idea how can this be solved?

Answer 1

Add to your settings.py .

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
SECURE_SSL_REDIRECT = not DEBUG

Edit by kotrfa: relevant part of documentation . I didn't want to add the second line, so it was still possible to access the server directly without HTTPS, eg when testing on localhost. For that, I had to set up two different servers in nginx - one with hardcoded Host my.domain.org on the same port coming from load balancer (eg 7779) and then a second with Host $host:$port on 7778 so it could be accessed directly behind VPN or on localhost and links still works :-) .