0

I'm trying to configure Nginx to serve my application on both port 443 and 5501 with SSL. I have the following Nginx configuration:

upstream pixel {
    server pixel.example.com:8080 weight=1;
    server pixel.example.com:8081 weight=1;
    server pixel.example.com:8082 weight=1;
    server pixel.example.com:8083 weight=1;
    server pixel.example.com:8084 weight=1;
    server pixel.example.com:8085 weight=1;
}

upstream main {
  server pixel.example.com:5501;
}

upstream ha {
  server pixel.example.com:6501;
}

server {
        listen       5501 default_server;
        listen       [::]:5501 default_server;
        root /var/www/html/pixel.example.com;
        index index.html index.htm index.nginx-debian.html;
        server_name  pixel.example.com www.pixel.example.com;

        location / {
            proxy_pass http://main;
        }
}

server {
        listen       5601 default_server;
        listen       [::]:5601 default_server;
        server_name  pixel.example.com www.pixel.example.com;

        location / {
            proxy_pass http://ha;
            try_files $uri $uri/ =404;
        }
}

server {
        listen       80 default_server;
        listen       [::]:80 default_server;
        root /var/www/html/pixel.example.com;
        index index.html index.htm index.nginx-debian.html;
        server_name  pixel.example.com www.pixel.example.com;

        location / {
            proxy_pass http://pixel;
            try_files $uri $uri/ =404;
        }

        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }
}

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name pixel.example.com www.pixel.example.com;
        server_tokens off;
        ssl_certificate /etc/nginx/ssl/live/pixel.example.com/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/live/pixel.example.com/privkey.pem;
        ssl_buffer_size 8k;
        ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;
        location / {
                try_files $uri @server;
        }

        location ~ /.well-known {
          allow all;
        }

        location @server {
                proxy_pass http://pixel;
                proxy_ssl_server_name on;
                proxy_set_header Host pixel.example.com;
                add_header X-Frame-Options "SAMEORIGIN" always;
                add_header X-XSS-Protection "1; mode=block" always;
                add_header X-Content-Type-Options "nosniff" always;
                add_header Referrer-Policy "no-referrer-when-downgrade" always;
                add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
                add_header 'Access-Control-Allow-Origin' '*' always;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
                add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
        }

        root /var/www/html/pixel.example.com;
        index index.html index.htm index.nginx-debian.html;
}

server {
        listen  5501 ssl http2;
        listen [::]:5501 ssl http2;
        server_name pixel.example.com www.pixel.example.com;
        server_tokens off;
        ssl_certificate /etc/nginx/ssl/live/pixel.example.com/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/live/pixel.example.com/privkey.pem;
        ssl_buffer_size 8k;
        ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;
        location / {
                try_files $uri @server;
        }

        location ~ /.well-known {
          allow all;
        }

        location @server {
                proxy_pass http://main;
                proxy_ssl_server_name on;
                proxy_set_header Host pixel.example.com;
                add_header X-Frame-Options "SAMEORIGIN" always;
                add_header X-XSS-Protection "1; mode=block" always;
                add_header X-Content-Type-Options "nosniff" always;
                add_header Referrer-Policy "no-referrer-when-downgrade" always;
                add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
                add_header 'Access-Control-Allow-Origin' '*' always;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
                add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
                add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
        }

        root /var/www/html/pixel.example.com;
        index index.html index.htm index.nginx-debian.html;
}

I want my server to respond to both https://pixel.example.com and https://pixel.example.com:5501. How can I modify my Nginx configuration to achieve this?

Specifically, I want to ensure that SSL is properly configured for both ports, and the appropriate proxying is set up for my application, I'm at the moment being able to access through http.

Also, I want to use the same cert. The certificate works in port 443.

Any insights or examples would be greatly appreciated! Thank you.

2
  • Why would you want 5501 to work with plain http and https simultaneously? Why would you want 5501 to be accessible from outside at all?
    – Alexey Ten
    Nov 22 at 9:17
  • Also, you got 2 ssl server blocks setup correctly. What's not working?
    – suchislife
    Nov 23 at 18:21

0

You must log in to answer this question.

Browse other questions tagged .