Nginx + Tomcat 8 + SSL reverse proxy

Question

I'm following this example:

https://devtidbits.com/2015/12/08/nginx-as-a-reverse-proxy-to-apache-tomcat/

my goal is to have Tomcat running and Nginx in front of it.

I would like to have structure similar to this:

test.com/ - static site from nginx

test.com/tomcat - tomcat manger (with working links)

test.com/app - tomcat app (deployed at /app on tomcat)

app2.test.com/app

My Nginx conf is:

upstream tomcat {
    server 127.0.0.1:8080 fail_timeout=0;
}
server {
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    include snippets/ssl-test.com.conf;
    include snippets/ssl-params.conf;
    root /var/www/test.com/html;
    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;
    server_name test.com www.test.com;
    location / {
        # First attempt to serve request as file, then as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
    }
    location ~ /.well-known {
                allow all;
        }

    location ~ ^/tomcat(/?)(.*)$ {  # OOPS!
      proxy_pass http://tomcat/$2$is_args$args;  # OOPS!
    }

    location /tomcat/ {
       include proxy_params;
       proxy_pass http://tomcat/;

        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
  expires 1M;
 }
}

Thank you in advance!

You have two conflicting tomcat locations - what happens if you remove the first one? — Richard Smith, Mar 02 '17 at 12:24
Do you mean to remove this one: location ~ ^/tomcat(/?)(.*)$ { # OOPS! proxy_pass http://tomcat/$2$is_args$args; # OOPS! } if I remove it the css of test.com/tomcat is broken — Vasil Koicev, Mar 02 '17 at 12:31
Try `location ^~ /tomcat/` for the second block (still with the first block removed) — Richard Smith, Mar 02 '17 at 12:37
It's working fine the problem is with the links: 1) Open https://test.com/tomcat but the links in the this page point to https://test.com/manager/html but the working address is https://test.com/tomcat/manager/html - so I get 404 Not Found — Vasil Koicev, Mar 02 '17 at 19:59

score 0 · Accepted Answer · answered Mar 02 '17 at 12:37

0

Try the following one instead of your two tomcat locations:

location ~ /tomcat(.*)$ {
    include proxy_params;
    proxy_pass http://tomcat$1$is_args$args;

    proxy_set_header HOST $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

answered Mar 02 '17 at 12:37

Tero Kilkanen

36,796
3
41
63

Thank you, its also working bu I get broken links: 1) Open https://test.com/tomcat is fine but 2) opening the links in the this page point to https://test.com/manager/html but the working address is https://test.com/tomcat/manager/html - so I get 404 Not Found – Vasil Koicev Mar 02 '17 at 20:00
You need to fix your Tomcat application so that it generates links with `/tomcat` prefix. There isn't a way nginx can do this link fixing for you. – Tero Kilkanen Mar 02 '17 at 20:01
In this case is it possible to open tomcat manager app via https:ip-address and what should be the port – Vasil Koicev Mar 02 '17 at 20:04
I don't know any details of Tomcat so I cannot help. However, with that location block you use the port specified in the `server` block `listen` directive to access the service from outside. – Tero Kilkanen Mar 02 '17 at 20:09
I see. One last question if possible about nginx. Can I create a separate location without domain only with ip address, in other words instead of server_name example.com; to be ip address – Vasil Koicev Mar 02 '17 at 20:14
You can create a `listen 443 default_server` block, which serves all requests that do not match other `server` blocks. You have to use an SSL certificate there that has the IP address in the CN field for it to work properly. – Tero Kilkanen Mar 03 '17 at 09:15

Nginx + Tomcat 8 + SSL reverse proxy

1 Answers1