NGINX config for TLS passthrough with multiple services?
I am trying to set up a reverse proxy server, with TLS passthrough.
I am behind CGNAT, so I cannot forward any ports from my home server. So, my current workaround was that I connected my home server to a VPS via WireGuard and used Nginx Proxy Manager (NPM) to proxy services running on different docker containers to the VPS, so that they are accessible publicly. But now I want to use TLS passthrough for better privacy. But I cannot find any guides for my case.
I need help with 2 issues, basically. Let’s take a look at my passthrough.conf file, which I have included in nginx.conf file.
<span style="color:#323232;">stream {
</span><span style="color:#323232;"> # Listen for incoming TLS connections on service1.domain.me
</span><span style="color:#323232;"> server {
</span><span style="color:#323232;"> listen 443;
</span><span style="color:#323232;"> proxy_pass service1.domain.me;
</span><span style="color:#323232;"> proxy_ssl on;
</span><span style="color:#323232;"> proxy_ssl_protocols TLSv1.2 TLSv1.3;
</span><span style="color:#323232;"> proxy_ssl_name $ssl_preread_server_name;
</span><span style="color:#323232;"> }
</span><span style="color:#323232;">
</span><span style="color:#323232;"> # Listen for incoming TLS connections on service2.domain.me
</span><span style="color:#323232;"># server {
</span><span style="color:#323232;"># listen 443;
</span><span style="color:#323232;"># proxy_pass service2.domain.me;
</span><span style="color:#323232;"># proxy_ssl on;
</span><span style="color:#323232;"># proxy_ssl_protocols TLSv1.2 TLSv1.3;
</span><span style="color:#323232;"># proxy_ssl_name $ssl_preread_server_name;
</span><span style="color:#323232;"># }
</span><span style="color:#323232;">
</span><span style="color:#323232;"> # Define the backend server for service1.domain.me
</span><span style="color:#323232;"> upstream service1.domain.me {
</span><span style="color:#323232;"> server homeserverIP:port;
</span><span style="color:#323232;"> }
</span><span style="color:#323232;">
</span><span style="color:#323232;"> # Define the backend server for service2.domain.me
</span><span style="color:#323232;"># upstream service2.domain.me {
</span><span style="color:#323232;"># server homeserverIP:port;
</span><span style="color:#323232;"># }
</span><span style="color:#323232;">}
</span><span style="color:#323232;">
</span>
The services are running in docker containers on different ports. When I used two server blocks and two upstream blocks, I got this error while testing NGINX config: nginx: [emerg] duplicate “0.0.0.0:443” address and port pair in /etc/nginx/passthrough.conf:13. So, I commented out the other server block and tested it again. The test was successful, but NGINX failed to restart. When I checked the systemctl status I saw: nginx[2480644]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use). This is because I am already hosting multiple WordPress sites on this VPS.
Here’s my nginx.conf file:
<span style="color:#323232;">user www-data;
</span><span style="color:#323232;">worker_processes auto;
</span><span style="color:#323232;">pid /run/nginx.pid;
</span><span style="color:#323232;">include /etc/nginx/modules-enabled/*.conf;
</span><span style="color:#323232;">
</span><span style="color:#323232;">events {
</span><span style="color:#323232;"> worker_connections 768;
</span><span style="color:#323232;">}
</span><span style="color:#323232;">
</span><span style="color:#323232;">http {
</span><span style="color:#323232;">
</span><span style="color:#323232;"> sendfile on;
</span><span style="color:#323232;"> tcp_nopush on;
</span><span style="color:#323232;"> types_hash_max_size 2048;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> include /etc/nginx/mime.types;
</span><span style="color:#323232;"> default_type application/octet-stream;
</span><span style="color:#323232;">
</span><span style="color:#323232;">
</span><span style="color:#323232;"> ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
</span><span style="color:#323232;"> ssl_prefer_server_ciphers on;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> access_log /var/log/nginx/access.log;
</span><span style="color:#323232;"> error_log /var/log/nginx/error.log;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> gzip on;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> gzip_vary on;
</span><span style="color:#323232;"> gzip_proxied any;
</span><span style="color:#323232;"> gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> include /etc/nginx/conf.d/*.conf;
</span><span style="color:#323232;"> include /etc/nginx/sites-enabled/*;
</span><span style="color:#323232;">
</span><span style="color:#323232;"> client_max_body_size 100M;
</span><span style="color:#323232;"> server_tokens off;
</span><span style="color:#323232;">
</span><span style="color:#323232;">}
</span><span style="color:#323232;">
</span><span style="color:#323232;">#include /etc/nginx/passthrough.conf;
</span>
I do not know much about NGINX configuration, any help or article links would help.
Add comment