NGINX: ssl proxy based on path to multiple apps on localhost with different ports

Question

I'm trying to configure nginx to proxy requests to different servers running on the host machine with different ports depending on request path. To complicate things a bit more, I want all the apps to use ssl. In other words I want nginx to do the following:

https://www.example.com/app1 --> http://localhost:8001
https://www.example.com/app2 --> http://localhost:8002
https://www.example.com/app3 --> http://localhost:8003
...

What I got so far (which is not quite working):

# redirecting from http to https
server {
    listen 80;
    301 https://$host$request_uri;
}

# proxying path to port
server {
    listen 443;
    ssl_certificate     /path/to/cert.pem
    ssl_certificate_key /path/to/privkey.pem
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location /app1 {
        proxy_pass http://localhost:8001
    }
    location /app2 {
        proxy_pass http://localhost:8002
    }
    location /app3 {
        proxy_pass http://localhost:8003
    }
}

What ends up happening is that nginx only exposes one specific app (that was there first).

Any ideas on what I'm doing wrong would be appreciated. Thanks.

Answer 1

Replace your nginc.conf with the following

    server {
      listen 80 default_server;
      listen [::]:80 default_server;
      server_name _;
      return 301 https://$host$request_uri;
    }

    server {
      listen 443;
      root /usr/share/nginx/html;

      ssl on;
      ssl_certificate    /etc/nginx/ssl/demo.com.crt;
      ssl_certificate_key    /etc/nginx/ssl/demo.com.key;

      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";      

      chunked_transfer_encoding on;

      location /app1 {
         proxy_pass http://<private-ip>:8001
      }
      location /app2 {
         proxy_pass http://<private-ip>:8002
      }
      location /app3 {
         proxy_pass http://<private-ip>:8003
      }

    }  

Copy your .crt, .kry file in your required folder