Hello
I need help configure Nginx reverse proxy to Solidfire(Element 12.7) like this :
This is the Nginx config :
server {
listen 10443 ssl;
ssl_certificate /etc/ssl/proxy/server.crt;
ssl_certificate_key /etc/ssl/proxy/server.key;
location / {
proxy_pass https://192.168.1.22:443;
proxy_set_header Host $host;
}
}
On the client machine(10.0.0.22 does not have route to Solidfire MVIP 192.168.1.22) when I browse https://10.0.0.11:10443
The browser stops at URL below, showing ERR_CONNECTION_REFUSED
https://10.0.0.11/auth/connect/authorize?client_id=element-ui&redirect_uri=https://10.0.0.11:10443/cluster/#/auth-callback&response_type=code&scope=op... profile element_api&state=49d0b7181d9e474cbd06af68a927d26b&code_challenge=Hq462Eln6PjwBkjYZb9I0ZgJDD87-CCTcaPga4LgBtk&code_challenge_method=S256&response_mode=query
I spent some time trying to get this to work, but without success.
I did get a bit farther by using additional `location` directives, but that wasn't enough.
Normally reverse proxy hits /auth/api/2/account/login which generates a 302 redirect to /auth/connect/authorize/callback. I managed to get redirect_uri to my NGINX public URI, but that was not enough:
I think there's another 302 redirect, maybe after successful authentication.
I'm not sure if this can or can't be fixed on a reverse proxy. It would be better if API endpoint redirected to public IP (so, to SolidFire MVIP without NGINX reverse proxy, and to NGINX reverse proxy with NGINX reverse proxy), but it seems hardcoded to use MVIP.
I can't think of other proxy-related workarounds than use a proxy server for the Web UI.
I tried with Squid on Linux, it works fine (client--(http)---> Squid ---> (https) --> SolidFire).
For a more secure approach, a commercial TLS-terminating proxy would be better.
Do you mean on Nginx I need to redirect 443/tcp to 10443/tcp ?
I tried :
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 10443
Now the page stops at
https://10.0.0.11/login/error?ErrorCode=unauthorized_client&RequestId=0HMQPLPOG9AJN:00000001&ErrorDescription=
I spent some time trying to get this to work, but without success.
I did get a bit farther by using additional `location` directives, but that wasn't enough.
Normally reverse proxy hits /auth/api/2/account/login which generates a 302 redirect to /auth/connect/authorize/callback. I managed to get redirect_uri to my NGINX public URI, but that was not enough:
I think there's another 302 redirect, maybe after successful authentication.
I'm not sure if this can or can't be fixed on a reverse proxy. It would be better if API endpoint redirected to public IP (so, to SolidFire MVIP without NGINX reverse proxy, and to NGINX reverse proxy with NGINX reverse proxy), but it seems hardcoded to use MVIP.
I can't think of other proxy-related workarounds than use a proxy server for the Web UI.
I tried with Squid on Linux, it works fine (client--(http)---> Squid ---> (https) --> SolidFire).
For a more secure approach, a commercial TLS-terminating proxy would be better.
