Using nginx as a proxy to to java web servlet

Question

I'm trying to use nginx as a load balancer / proxy server which points to a series to tomcat servers. This is my current nginx configuration.

server {

    listen 80;
    server_name _;
    rewrite ^ https://$http_host$request_uri? permanent;
}

server {
     listen 443;

     resolver 127.0.0.11 valid=5s;

     ssl on;
     ssl_certificate /etc/nginx/certs/default.crt;        # path to your cacert.pem
     ssl_certificate_key /etc/nginx/certs/default.key;    # path to your privkey.pem
     ssl_verify_client off;
     server_name localhost;
     fastcgi_param   HTTPS               on;
     fastcgi_param   HTTP_SCHEME         https;

     charset utf-8;
     client_max_body_size 200M;

     set $app https://app:8443;
     set $auth https://auth:8443/authentication/;
     set $discovery https://discovery:8443/discovery/;

   location / {
       proxy_pass $app;
   }
   location /authentication {
       proxy_pass $auth;
   }
   location /discovery {
       proxy_pass $discovery;
       proxy_set_header Host $http_host;
       proxy_set_header X_FORWARDED_PROTO https;
   }

}

This is dockerized if it makes any difference, but provisioning fails to resolve correctly while docs is working fine. The only difference between docs and provisioning is that 'docs' is serving pure html files via tomcat. (The tomcat7 standard /docs/) while provisioning is actually a java servlet (JaxRS/spring etc ).

If I hit the image directly it works as expected, while if I try to hit the same endpoint via the nginx it fails to resolve.

My docker-compose configuration for reference.

version: '2'
services:
  db:
    image: db:nodata
    expose:
    - 5433
  zk:
     image: zookeeper
     ports:
     - 2181:2181
  discovery:
    image: services_discovery:latest
    env_file: docker_environment
    expose:
    - 8443
    ports:
    - 8443:8443
    links:
     - db
     - zk
  app:
    image: tomcat-jsse-ssl:7-jdk8
    volumes:
    - ./app/www/:/usr/local/tomcat7/webapps/ROOT/
    expose:
    - 8443
    ports:
    - 8444:8443
  auth:
    image: tomcat-jsse-ssl:7-jdk8
    volumes:
    - ./authentication/www/authentication/:/usr/local/tomcat7/webapps/authentication/
    expose:
    - 8443
  proxy:
    build: ./proxy/
    depends_on:
     - 'auth'
     - 'app'
     - 'discovery'
    ports:
    - 443:443
    restart: always

With the images running I can resolve the following URLs just fine.

• https://localhost:8443/discovery/ready
• https://localhost:8444/

ie. both containers are running fine:

• https://localhost/ loaded via nginx works fine.
• https://localhost/authentication/ loaded via nginx works fine.
• https://localhost/discovery/ready ==> 404.

Server Logs:

proxy_1      | 172.20.0.1 - - [24/Apr/2017:00:04:28 +0000] "GET /discovery/ready HTTP/1.1" 404 400 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"
proxy_1      | 172.20.0.1 - - [24/Apr/2017:00:04:43 +0000] "GET /discovery/api/swagger.json HTTP/1.1" 404 400 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"
proxy_1      | 172.20.0.1 - - [24/Apr/2017:00:04:57 +0000] "GET /discovery/ready HTTP/1.1" 404 400 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"

Discovery Tomcat Access Log (when access directly)

172.20.0.1 - - [23/Apr/2017:00:02:38 +0000] "GET /discovery/ready HTTP/1.1" 200 70
172.20.0.2 - - [24/Apr/2017:00:04:28 +0000] "GET /discovery/ HTTP/1.0" 404 949
172.20.0.2 - - [24/Apr/2017:00:04:43 +0000] "GET /discovery/ HTTP/1.0" 404 949
172.20.0.2 - - [24/Apr/2017:00:04:57 +0000] "GET /discovery/ HTTP/1.0" 404 949

The first entry is when I hit the server directly via https://localhost:8443/discovery/ready everything else is when nginx sends the request to the server. For some reason it's not translating the request correctly.

Any thoughts/suggestions would be appreciated?

Note: I simplified my example/config for the purposes of this question and any references to "provisioning" are now "discovery".

UPDATE: I figured out why it's breaking for the 'servlet'. It's actually breaking constantly. It's stripping away all of the URL except the base.

for example.

https://localhost/authentication?q=dummy

becomes 172.20.0.3 - - [24/Apr/2017:03:22:06 +0000] "GET /authentication/ HTTP/1.0" 200 28

note that the query parameters are stripped away.

Answer 1

The nginx documentation says that you are responsable to rebuild the url:

http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass

So, you can try to capture the rest of the URI using regex and send it on the proxy_pass section:

location ~* ^/discovery/(.*) {
  proxy_pass $discovery$1$is_args$args;
  .... other configs....
}