2

I have two containers, one of which is running NGINX as a reverse proxy for serveral other containers. One of the other containers is running Apache with SSL enabled and configured. I have seen several configuration examples in which, to the best of my understanding, NGINX handles the certificates instead of Apache, and merely pipes through everything else to some non-SSL Apache.

Now, I'd rather have Apache handle its own certificates, particularly because it makes my life easier when managing them them (using a dockerized letsencrypt, which mounts the volumes from the relevant Apache container and drops the certificates in all the right places).

The issue is that I can't find any example configuration for NGINX to just transparently proxy everything through to the Apache container.

Morpheu5
  • 259
  • 4
  • 18

1 Answers1

0

That's because nginx can't do that.

It can terminate an SSL connection, but it cannot pass one through.

You have at least two options:

  1. Stick the SSL certificates in a tiny Docker volume that's shared between your letsencrypt container and your nginx container. While you're at it, you may as well let nginx intercept Let's Encrypt challenges as well, which might simplify your architecture a bit.
  2. Use haproxy instead of nginx. Unlike nginx, haproxy is capable of passing through SSL connections (and doing a variety of other things that are useful in a containerized setup). Note that this requires SNI support, and so such sites won't be accessible to ancient web clients which can't support SNI.
Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
  • Thanks, I think I'll investigate the haproxy avenue, as I am not really a fan of having to duplicate configurations across services if I can avoid it -- besides, I'd have to maintain a long list of volumes mounted to the proxy. SNI should be fine: according to Wikipedia, only a minority of very ancient clients have no support for it, so I should be OK. I could leave non-SSL option open for those browsers, if need be, but chances are I'll be OK. – Morpheu5 Apr 29 '16 at 12:04