We are looking to use HAProxy in a Kubernetes environment to proxy http requests to specific pods based on the content of the body in the http post request. The body contains a json object {customer: name} that we want to route to the internal service http://name-service.local
We have approximately 50,000 pods each with a unique service (IP) with new pods created and destroyed dynamically all the time.
Basically I want to dynamically choose where to proxy the requests by grabbing a piece of data from the http request (which can be any value), using that data to resolve a dns name, and then forward the request to the resulting service.
I was able to achieve something similar in nginx with cookies using the configuration shown below. I would like to know if it is possible to replicate this in HAProxy without having to specify all 50,000 backend servers in the configuration file?
Example Nginix configuration:
server {
listen 80;
resolver 10.21.9.15;
location / {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $host;
set $dbname $cookie_dbname;
set $upstream_server $dbname-service.default.svc.cluster.local;
proxy_pass http://$upstream_server$request_uri;
}
Related
Unable to load admin console. I have setup Nginx confif
As described in the documentation
nginx needs to provide X-Fordward-For and X-Forwarded-Proto Header when acting as ssl proxy for keycloak
e.g like that
location /
{
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
add_header Access-Control-Allow-Origin *;
proxy_pass http://keycloak;
}
And you need to configure proxy adress forwarding in keycloak. Either by adding proxy-address-forwarding="true" to http-listener in the standalone.xml or by setting the environment variable PROXY_ADDRESS_FORWARDING: "true" when using docker.
And finally, in case I'm allowed to give you an avdice: If you ask more specific/detailed questions you will get better answers. A screenshot with an error message and the info you "have a nginx" is normally not enough. Posting your full configuration is essential to provide you useful help.
I have a server (ubuntu 20.04 core) with nginx installed. On the same server I have a running Spring Boot Web(2.3.3.RELEASE) service on port 8080.
I want to access the resources from the Spring Boot Web service externally with
e.g. http://server/api/users to access http://localhost/api/users and return that response to the client.
I have the following rule configured in nginx:
location /api {
proxy_pass http://localhost:8080;
}
This works fine for GET request, but doesn't for POST or PUT. The first response to the client is a response with status code 301: Moved permanently and according to HTTP spec a client should change the HTTP method to either GET or HEAD. The client changes the method automatically after the first response as seen in the nginx logfile at /var/log/nginx/access.log:
192.168.0.1 - - [14/Oct/2020:11:23:56 +0100] "POST /api/users?key=key HTTP/1.1" 301 162 "-" "PostmanRuntime/7.26.5"
192.168.0.1 - - [14/Oct/2020:11:23:56 +0100] "GET /api/users?key=key HTTP/1.1" 200 93 "http://server/api/users?key=key" "PostmanRuntime/7.26.5"
192.168.0.1 - - [14/Oct/2020:11:23:59 +0100] "PUT /api/users/1/deleted?key=key&deleted=false HTTP/1.1" 301 162 "-" "PostmanRuntime/7.26.5"
192.168.0.1 - - [14/Oct/2020:11:23:59 +0100] "GET /api/users/1/deleted?key=key&deleted=false HTTP/1.1" 405 141 "http://server/api/users/1/deleted?key=key&deleted=false" "PostmanRuntime/7.26.5"
The GET-Request from the PUT-Request failed with 405 because theres no mapped GET for path "/api/users/{id}/deleted". I tried adding and modifing many different configurations in the "location /api {..}" for example:
location /api {
proxy_pass http://localhost:8080;
proxy_redirect http://localhost:8080/ /; # I tried "../api /", ".../api/ /", ".../ /api"
proxy_read_timeout 60s;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
Suggested in serverfault(how do I get nginx to forward HTTP POST requests via rewrite?)
I found the exact same question on trac.nginx.com but that config didn't work either:
location /api { # "/api" and "/api/" doesn't work
proxy_pass ​http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
I am currently quite lost with what else I should try to get it to work.
--- EDIT: With the help of #ti7 and #ampularius the working solution now is:
NGINX location entry:
location /api {
proxy_pass http://localhost:8080;
proxy_redirect off;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
}
And in application.properties of the Spring Boot Service no changes were made, so NONE of these settings does anything for this case:
server.use-forward-headers=true
server.forward-headers-strategy=native
server.forward-headers-strategy=framework
server.forward-headers-strategy=none
Recently I've been working a good deal with the excellent Gunicorn WSGI server with an nginx frontend.
The deploy docs suggest disabling proxy_redirect with proxy_pass and the Host header set, which could be the source of your troubles!
This has been working great to handle POST and GET requests, albeit with a wildly-different webserver.
location #proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $http_host;
# we don't want nginx trying to do something clever with
# redirects, we set the Host: header above already.
proxy_redirect off;
proxy_pass http://app_server;
}
This likely happens because your backend server thinks the request is http and redirects it to https. Try adding this in your location block:
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
It lets your backend server know that the request is in fact coming with https but tls is terminated further up (in most cases you have to whitelist your proxyserver to make it work).
According to this answer you can do that like this in application.properties:
server.use-forward-headers=true
I have docker container created from "quay.io/mongodb/charts:19.12.1" for mongodb chart.
Here my container url is http://intenal.nosql.chart//, This url is accessible inside my docker network and it is working perfectly.
Now I want to expose this url to public domain via nginx at http://mypublicdomain.com/mongo/chart.
I have below configuration in nginx
location /mongo/chart/ {
proxy_pass "http://intenal.nosql.chart/";
}
Now if i access my chart from http://mypublicdomain.com/mongo/chart, it is not working. it seems there is error related to baseurl.
So what should i do in mongodb chart to take difference base url
I have to add following header in ngnix
location / {
proxy_pass http://intenal.nosql.chart/;
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
I'm running sameersbn/docker behind a nginx reverse proxy, but I get a mixed content warning on the avatar image.
No matter what I try, it is either the mixed content warning or a too many redirects error page.
I forward my http traffic automatically in nginx with this config:
server
{
listen 80;
server_name myserver.com;
return 301 https://myserver.com$request_uri;
}
server
{
listen 443 ssl;
server_name myserver.com;
ssl on;
ssl_certificate myserver.cert.combined;
ssl_certificate_key myserver.key;
include nginx_php.conf;
location / {
proxy_set_header X-Forwarded-Proto: https;
proxy_set_header X-Forwarded-Ssl: on;
proxy_pass http://127.0.0.1:10080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
include /etc/nginx/webapps.ssl.conf;
}
As soon as I run my gitlab container with the following options, I get the too many redirects
- GITLAB_HTTPS=true
- SSL_SELF_SIGNED=false
- GITLAB_HOST=myserver.com
- GITLAB_PORT=443
- GITLAB_SSH_PORT=22
What am I doing wrong here?
And why does Gitlab try to load the avatar over http?
I am having some troubles with my application. During redirects my flask application lose the https and redirect to http instead.
I've been trying to find the solution but nothing works.
My nginx configuration for the application (location /) is as follows:
proxy_pass http://localhost:5400;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-port 443;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
(Some examples on the internet says to use "X-Forwarded-Proto". I've tried that without success. And also to use "ssl" or "https" as value on that parameters.
A simple print in the flask application (before_request:) shows that it is still http-requests made event though i use https between client and nginx.
print(request.environ["wsgi.url_scheme"])
What am I doing wrong?
If your application ignores the X-Forwarded headers for setting the scheme in http 3xx responses, you could try setting one or more proxy_redirect rules:
proxy_redirect http:// $scheme://;
See this document for details.
Warning. Making unwanted HTTP redirects is a security flaw as in those requests the connection is not encrypted!!
The only solution here is to correctly configure NGINX and GUNICORN to allow Flask to use the correct headers.
NGINX config should contain at least following directives:
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_pass http://appserver:5000;
And, this is the real solution here, GUnicorn must be started with the --forwarded-allow-ips parameter.
Following is how I start it in production, fixing also the real IP address in logs (beware to complain to the GDPR :P ):
PYTHONUNBUFFERED=FALSE gunicorn \
--access-logfile '-' \
--access-logformat '%(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" "%({X-Real-IP}i)s"' \
-b :5000 \
--forwarded-allow-ips="*" \
app:app
You should NEVER send a request in HTTP. The first and only redirect should be the /.