Service proxies on Nginx

Proxies setup

I took a liberty to reorganize the way we define the proxies. Each proxy setup has a separate file. All definitions related to that proxy should be in that file and not anywhere else. The proxies definitions are in the directory proxies-available and enabled proxies are symlinked in proxies-enabled.

You don't have to do symlinks by hand, but you can use config_proxies.sh script.

.
├── config_proxies.sh
├── proxies-available
│   ├── cesilko
│   ├── ....
│   ├── pmltq
│   └── treex-web
├── proxies-enabled
...

Add new proxy

The file skeleton:

# who is responsible
# email

location /services/name {
  rewrite /services/name(.*) /proxied/path$1 break;

  include service_proxy;
  proxy_pass http://quest;
}

location

The crucial directive here is location see Nginx documentation for details.

The most important part is the way how are the locations matched to urls and which location gets used.

1. Exact match (note =)

   location = /services/exact { ... }

   If the exact match is found the matching process is terminated and the matched location is used.

2. The longest matching prefix

   location /services/name { config A }
   location /services/name/images { config B }

   The longest matching prefix is selected and than the matching continues ...

3. Regular expressions are checked after looking for the longest prefix

   # case-sensitive match
   location ~ \.(gif)$ { }
   # case-insensitive match
   location ~* \.(php)$ { }

   Regular expressions are checked in the order they appear in the config file. If the regular expression match the first one is used. If not the longest matching substring is used instead.

4. To get things even more complicated you can use ^~ operator to match the longest prefix and don't do regular expression search. This works in similar way the = works.

rewrite

Use rewrite to change base url if required. See documentation for details.

proxy_pass

Every location defined for service should end with proxy_pass. It's recommended to use include service_proxy; to inject useful headers to service endpoint.

The endpoint definition can be full url or so called upstream. The upstreams defined:

• quest
• apache
• tomcats

You can't define upstream in service file because it's not included in the context where upstream definition is allowed.

See documentation for more details.

Shibboleth authentication

Shibboleth authentication only works for https. To make things as simple as possible I have made a file you can include to make Shibboleth work out of the box. Otherwise those directives would have to be repeated everytime.

more_clear_input_headers 'Variable-*' 'Shib-*' 'Remote-User' 'REMOTE_USER' 'Auth-Type' 'AUTH_TYPE';

# Add your attributes here. They get introduced as headers
# by the FastCGI authorizer so we must prevent spoofing.
more_clear_input_headers 'displayName' 'mail' 'persistent-id';

# Require https and will redirect
if ($https != "on") {
  return 301 https://$http_host$request_uri;
}

shib_request /shibauthorizer;

Instead use include shibboleth_auth;.

Example:

location = /services/name/shibboleth-login-url {
  include shibboleth_auth;

  rewrite /services/name(.*) /proxied/path$1 break;

  include service_proxy;
  proxy_pass http://quest;
}

Note the = in location directive. This will ensure that Shibboleth authentication will trigger only for this location.