improved line length for easier reading
This commit is contained in:
@@ -6,8 +6,10 @@ author: "ahmza"
|
||||
draft: false
|
||||
|
||||
tags: ["HomeLab", "Networking", "NGINX", "ReverseProxy"]
|
||||
description: "Learn to setup a quick and easy reverse proxy using NGINX"
|
||||
canonicalURL: "https://blog.ahmza.com/Page%28/posts/Setup-an-NGINX-Reverse-Proxy.md%29"
|
||||
description: "Learn to setup a quick and easy reverse proxy using\
|
||||
NGINX"
|
||||
canonicalURL: "https://blog.ahmza.com/Page%28/posts/Setup-an-NGINX-\
|
||||
Reverse-Proxy.md%29"
|
||||
|
||||
cover:
|
||||
image: "/img/Reverse-Proxy/feature-anim.gif" # image path/url
|
||||
@@ -20,14 +22,14 @@ cover:
|
||||
|
||||
|
||||
# **Introduction**
|
||||
In this post we will go over setting up an *NGINX* reverse proxy to **allow different
|
||||
web services to reach the outside world.** We will also cover setting up **auto
|
||||
renewing SSL certificates.**
|
||||
In this post we will go over setting up an *NGINX* reverse proxy to
|
||||
**allow different web services to reach the outside world.** We will
|
||||
also cover setting up **auto renewing SSL certificates.**
|
||||
|
||||
Why not just port forward the services, it does the same thing Right? Reverse
|
||||
proxies are a great way to expose web services to the outside world in a more
|
||||
secure and customisable manner. **Some of the features that a reverse proxy provides
|
||||
are as follows:**
|
||||
Why not just port forward the services, it does the same thing Right?
|
||||
Reverse proxies are a great way to expose web services to the outside
|
||||
world in a more secure and customisable manner. **Some of the features
|
||||
that a reverse proxy provides are as follows:**
|
||||
|
||||
* **Host multiple services using the same HTTP/HTTPS ports**
|
||||
* **Hides the origin server**
|
||||
@@ -51,17 +53,18 @@ Update packages, then **install** ***NGINX***
|
||||
sudo apt update
|
||||
sudo apt install nginx
|
||||
```
|
||||
Now we want to **enable** ***NGINX*** so the program will start when the server boots
|
||||
Now we want to **enable** ***NGINX*** so the program will start when
|
||||
the server boots
|
||||
``` bash
|
||||
sudo systemctl enable --now nginx
|
||||
```
|
||||
|
||||
# **Firewall**
|
||||
> **Quick Note:** now is a good time to port forward ports 80 and 443 from the router
|
||||
> to the reverse proxy
|
||||
> **Quick Note:** now is a good time to port forward ports 80 and 443
|
||||
> from the router to the reverse proxy
|
||||
|
||||
Ubuntu server comes with a firewall (ufw), so be sure to allow access to *NGINX* and
|
||||
enable it.
|
||||
Ubuntu server comes with a firewall (ufw), so be sure to allow access
|
||||
to *NGINX* and enable it.
|
||||
|
||||
The reverse proxy handles both HTTP and HTTPS so **allow "Nginx Full"**
|
||||
``` bash
|
||||
@@ -92,12 +95,13 @@ server {
|
||||
}
|
||||
}
|
||||
```
|
||||
* **server_name** is the domain name you want use this can include sub-domains
|
||||
* **server_name** is the domain name you want use this can include
|
||||
sub-domains
|
||||
* **proxy_pass is the IP address of the web server**
|
||||
|
||||
## **Enable ***NGINX*** Config**
|
||||
To activate a config file we need to link the file from the **sites-available**
|
||||
folder to **sites-enabled**.
|
||||
To activate a config file we need to link the file from the
|
||||
**sites-available** folder to **sites-enabled**.
|
||||
> **Pro Tip:** make sure to use full paths when creating symlinks
|
||||
``` bash
|
||||
sudo ln -s /etc/nginx/sites-available/blog.conf /etc/nginx/sites-enabled/blog.conf
|
||||
@@ -124,8 +128,8 @@ you should now have a working reverse proxy !!
|
||||
* Make sure **server_name** is set in the config file you created
|
||||
|
||||
## **Installing** ***Certbot***
|
||||
*Certbot* is a tool that requests an SSL certificate and makes sure it is renewed
|
||||
when needed.
|
||||
*Certbot* is a tool that requests an SSL certificate and makes sure it
|
||||
is renewed when needed.
|
||||
**Install** ***Certbot*** as well as the **python ***NGINX*** plug-in**
|
||||
``` bash
|
||||
sudo apt install certbot python3-certbot-nginx
|
||||
@@ -137,12 +141,12 @@ Now all we need to do is **request the certificate** !!
|
||||
``` bash
|
||||
sudo certbot --nginx -d blog.example.com
|
||||
```
|
||||
* **--nginx** specifies we are using NGINX, this will update the config file we created
|
||||
to allow the use of SSL
|
||||
* **--nginx** specifies we are using NGINX, this will update the config
|
||||
file we created to allow the use of SSL
|
||||
* **-d** is the domain name you want to use
|
||||
|
||||
If this is the first time running *Certbot* you will be asked to enter an email as well
|
||||
as agree to terms and services.
|
||||
If this is the first time running *Certbot* you will be asked to enter
|
||||
an email as well as agree to terms and services.
|
||||
|
||||
If the certificate request is successful you will be prompted with
|
||||
|
||||
@@ -157,23 +161,24 @@ change by editing your web server's configuration.
|
||||
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
|
||||
```
|
||||
**If you want all traffic to be SSL encrypted choose option 2**
|
||||
That's it we have SSL certificates installed. You will need a new certificate for each
|
||||
different domain name or subdomain.
|
||||
That's it we have SSL certificates installed. You will need a new
|
||||
certificate for each different domain name or subdomain.
|
||||
|
||||
## **Verify Auto Renewal**
|
||||
All we need to do now is make sure that Certbot can automatically renew certificates.
|
||||
All we need to do now is make sure that Certbot can automatically renew
|
||||
certificates.
|
||||
``` bash
|
||||
sudo certbot renew --dry-run
|
||||
```
|
||||
If you see no errors then you are ready to go.
|
||||
|
||||
# **Conclusion**
|
||||
By following this you have hopefully managed to setup an *NGINX* Reverse proxy to
|
||||
handle incoming HTTP/HTTPS requests as well as configured automatically renewing
|
||||
SSL certificates.
|
||||
By following this you have hopefully managed to setup an *NGINX*
|
||||
Reverse proxy to handle incoming HTTP/HTTPS requests as well as
|
||||
configured automatically renewing SSL certificates.
|
||||
|
||||
This posts barely scratches the surface of what *NGINX* can do, I would highly
|
||||
recommend reading more into this great piece of software !!
|
||||
This posts barely scratches the surface of what *NGINX* can do, I would
|
||||
highly recommend reading more into this great piece of software !!
|
||||
|
||||
My reverse proxy handling non existent traffic
|
||||

|
||||
|
||||
Reference in New Issue
Block a user