0

I have an nginx reverse proxy, proxying requests to a private load balancer in aws The proxy works as intended, until an amount of time has passed, then when trying to use the same endpoint, it times out, here is an example of my nginx.conf:

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" proxy_pass: "$proxy_host"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  www.proxy.com;
        auth_basic "Restricted Access";
        auth_basic_user_file /etc/nginx/.htpasswd;
        access_log  /var/log/nginx/access.help.log  main;

        location ~* "^/regex/$" {
                proxy_pass          http://example.com/$request_uri;
                proxy_redirect      off;
                proxy_set_header    Host            $host;
                proxy_set_header    X-Real-IP       $remote_addr;
                proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header    Authorization   $http_x_access_token;
        }
     }
 }

If I run the base64 auth string, the server still returns 401 before attempting to access the location block

The downstream server doesn't appear to be the issue, as I can connect to it and use it as intended through other means

I can't seem to generate any logs that help me in this instance

kometen
  • 6,536
  • 6
  • 41
  • 51
Arcticquiff
  • 13
  • 1

1 Answers1

0

Nginx resolves the hostname on container start and then only uses the IP for its requests, AWS rotates the IPs behind its load balancers.

To get around this I abstracted the domain out to a variable in the server block and set a DNS resolver in the location block (In AWS, there is always one in your VPC on .2 eg: 10.11.0.2, just find your own subnet range)

  server {
    listen       80;
    server_name  my-server;
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    set $domain "domain.com";
    location ~* "cool/regex/path" {
            resolver 0.0.0.2 valid=180s;
            set                 $path           "${domain}/${request_uri}";
            proxy_pass          $path;
            proxy_redirect      off;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header    Authorization   $http_x_access_token;
     }
}

This way it uses the Domain for each request rather than the IP

Arcticquiff
  • 13
  • 1