1

I'm just starting to develop a SPA, with java(dropwizard) REST backend. I'm kinda new to 'web' development, but I did internal web apps before, so security was not a big concern before. Right now I'm using nginx as my public facing web server, and I just discovered whole slew of complications that arise as we're splitting actual servers: static web server serving my SPA's files, and java microservices behind it.

I'm used to apache talking to tomcat with mod_jk, but now I had to implement CORS in dev because my SPA is deployed on a lite-server serving at different port than the REST Api served by dropwizard.

Now I got to my minimum viable product and wanted to deploy it on prod, but I have no idea how do I do it.

  1. Do I still need the CORS header? Dropwizard will be run separately on a different port only available to local processes, then I configure nginx to route incoming request from, e.g. /api/ to that port. Does that counts as cross-origin?
  2. I'd like to serve full https. Dropwizard can serve to https, but I don't want to update SSL cert on multiple microservices. I read about nginx ssl termination, will this enable me to use plain http in local and https on nginx?
  3. Any other caveats to watch out on deploying with this architecture?

Thank you!

Evan
  • 492
  • 1
  • 3
  • 15
  • this seems to answer my no.1: http://stackoverflow.com/questions/30307216/how-to-deploy-an-angularjs-application-frontend-with-nginx-and-dropwizard – Evan Jun 09 '16 at 07:01

1 Answers1

1

Yes, you can certainly do it!

You can terminate https with nginx, and still have the backend operate on either plain http or even https still. The proxy_pass directive does support both access schemes for the upstream content. You can also use the newer TCP stream proxying, if necessary.

There are not that many caveats, really. It usually just works.

cnst
  • 25,870
  • 6
  • 90
  • 122