only allow traffic from one FQDN

Question

I have a docker container running a Flask app and then frontending it with an Nginx proxy. The Nginx container is running on port 80 and then I am using an HAProxy for SSL offloading. This setup works I browse to http://test.example.com and it redirects me th https and the site is up. Now, I would like the Nginx server to only reply on either localhost for healthchecks or my FQDN. If I browse to it via IP or any other domain I dont want to respond. With the config below, I got the healthcheck to work, but when I browse to it via FQDN (http://test.example.com), I get a 503 error. Not sure what I am missing. Not sure if I need to add anything for the https redirect or what, but localhost seems to work, but not FQDN. When I browse via FQDN, the flask server is not even seeing the request.

server {
    listen 80 default_server;

    return 444;
}

server {
    listen 80;
    charset utf-8;

    # Virtual host for localhost
    server_name localhost;

    location / {
        # Apply rate limiting
        limit_req zone=mylimit burst=20 nodelay;

        proxy_pass http://flask:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

server {
    listen 80;
    charset utf-8;

    # Virtual host for test.example.com
    server_name test.example.com;

    location / {
        # Apply rate limiting
        limit_req zone=mylimit burst=20 nodelay;

        proxy_pass http://flask:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Answer 1

I finally got it working. I had to add the IP of my HAProxy as an allowed IP, I also consolidated the nginx config.

server {
    listen 80;
    charset utf-8;

    server_name test.mydomain.com;


    location / {
        allow 10.36.130.1; # ip of HA Proxy doing SSL Offloading
        allow 127.0.0.1;
        deny all;

        # Apply rate limiting
        limit_req zone=mylimit burst=20 nodelay;

        proxy_pass http://flask:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

    }
}