0

I have some problem with my config.

If I add upstream HTTPS servers authorization didnt work.

Working config

upstream facturatest {
server s1test.com:443 max_fails=3 fail_timeout=10s;
server s2test.com:443 backup;
     }
     
     
server {
        server_name  gw.site.com;


location /tst {
allow all;
proxy_buffering on;
proxy_buffer_size 1k;
proxy_buffers 24 4k;
proxy_busy_buffers_size 8k;
proxy_max_temp_file_size 2048m;
proxy_temp_file_write_size 32k;
#proxy_redirect off;
#proxy_set_header Host              $host;
#proxy_set_header X-Real-IP         $remote_addr;
#proxy_set_header X-Forwarded-for   $remote_addr;
include /etc/nginx/cors;
proxy_set_header Authorization "Basic ZGlkb3g6cHJvdjF0Z";
proxy_pass https://s1test.com/;
}

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/_________________/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/__________/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
     
     
server {
    if ($host = gw.site.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name  gw.site.com;


listen --.--.--.--:80;
return 404; # managed by Certbot

}

If I change proxy_pass https://s1test.com/; to my upstream proxy_pass https://facturatest/; authorization didnt work

Pavel Kharchenko
  • 1
  • You could try `proxy_set_header Host s1test.com;` because your old config would have been setting that value, whereas your new config will use `facturatest`. Alternatively rename `upstream facturatest` to `upstream s1test.com` which I think might also work. – Richard Smith Mar 23 '21 at 10:37
  • If my upstream has changed server `proxy_set_header Host s1test.com;` my failower config dont work :-) – Pavel Kharchenko Mar 23 '21 at 12:53
  • It's not easy to get Nginx to use a different Host header for each upstream host. There is a [horrible hack](https://serverfault.com/a/622782/316685) that can do it, but it involves a second layer of proxy. – Richard Smith Mar 23 '21 at 13:10

0 Answers0