Simple reverse proxy with Nginx (equivalent to Apache)

Question

With Apache, I can make reverse proxy working with this VirtualHost configuration. I have executed nanoc view -p 8080 to use 8080 port for nanoc web app.

With this setup, http://scalatra.prosseek is mapped to the nanoc.

<VirtualHost *:80>
    ProxyPreserveHost On
    ServerName scalatra.prosseek
    ProxyPass  /excluded !
    ProxyPass / http://127.0.0.1:8080/
    ProxyPassReverse / http://127.0.0.1:8080/
</VirtualHost>

I need to have the same setup with Nginx, with some trial and error, I could make it work with this configuration.

upstream aha { # ??? (1)
        server 127.0.0.1:8080;
        keepalive 8;
}

# the nginx server instance
server {
        listen 0.0.0.0:80;
        server_name scalatra.prosseek;
        access_log /usr/local/etc/nginx/logs/error_prosseek.log;

        location / {
            # ??? (2) 
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;

            proxy_pass http://aha/; # ??? (1)
            proxy_redirect off; # ??? (3)
        }
}

It works, but I'm not sure if this is the best setup. Here come my questions:

• Is the setup OK for http://scalatra.prosseek to localhost:8080:
  • Are these correct setup of proxy_set_headers? Or did I miss something?
  • For the proxy_pass and upstream, is it just OK as long as two names are the same?
  • Do I need proxy_redirect off; ?

Answer 1

Your configuration looks close.

• Proxy headers should be fine. Normally Nginx passes headers through, so proxy_set_header is used when you want to modify those - for example forcing the Host header to be present even if the client does not provide one.

• For the proxy_pass and upstream, yes the names need to match.

• Consider leaving proxy_redirect on (default). This option modifies whether Nginx interferes with responses like 301 & 302 redirects including the port number. Turning it off means that your upsteam application must take responsibility for passing the correct public domain name and port in any redirect responses. Leaving it set to default means that if you accidentally try to direct the client to port 8080, Nginx would in some cases correct it to be port 80 instead.

You also did not include the /excluded path in your nginx config. Add that in with

location /excluded {
    return 403;
}