ahmza/blog-ahmza-com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improved line length for easier reading

Browse Source
This commit is contained in:
Hamza Ahmed
2021-12-02 20:25:38 +00:00
parent 635e9db19e
commit 7df29706db
1 changed files with 36 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/posts/Setup-an-NGINX-Reverse-Proxy.md
+36 -31
View File
@@ -6,8 +6,10 @@ author: "ahmza"
draft: false draft: false
tags: ["HomeLab", "Networking", "NGINX", "ReverseProxy"] tags: ["HomeLab", "Networking", "NGINX", "ReverseProxy"]
description: "Learn to setup a quick and easy reverse proxy using NGINX" description: "Learn to setup a quick and easy reverse proxy using\
canonicalURL: "https://blog.ahmza.com/Page%28/posts/Setup-an-NGINX-Reverse-Proxy.md%29" NGINX"
canonicalURL: "https://blog.ahmza.com/Page%28/posts/Setup-an-NGINX-\
Reverse-Proxy.md%29"
cover: cover:
image: "/img/Reverse-Proxy/feature-anim.gif" # image path/url image: "/img/Reverse-Proxy/feature-anim.gif" # image path/url
@@ -20,14 +22,14 @@ cover:
# **Introduction** # **Introduction**
In this post we will go over setting up an *NGINX* reverse proxy to **allow different In this post we will go over setting up an *NGINX* reverse proxy to
web services to reach the outside world.** We will also cover setting up **auto **allow different web services to reach the outside world.** We will
renewing SSL certificates.** also cover setting up **auto renewing SSL certificates.**
Why not just port forward the services, it does the same thing Right? Reverse Why not just port forward the services, it does the same thing Right?
proxies are a great way to expose web services to the outside world in a more Reverse proxies are a great way to expose web services to the outside
secure and customisable manner. **Some of the features that a reverse proxy provides world in a more secure and customisable manner. **Some of the features
are as follows:** that a reverse proxy provides are as follows:**
* **Host multiple services using the same HTTP/HTTPS ports** * **Host multiple services using the same HTTP/HTTPS ports**
* **Hides the origin server** * **Hides the origin server**
@@ -51,17 +53,18 @@ Update packages, then **install** ***NGINX***
sudo apt update sudo apt update
sudo apt install nginx sudo apt install nginx
``` ```
Now we want to **enable** ***NGINX*** so the program will start when the server boots Now we want to **enable** ***NGINX*** so the program will start when
the server boots
``` bash ``` bash
sudo systemctl enable --now nginx sudo systemctl enable --now nginx
``` ```
# **Firewall** # **Firewall**
> **Quick Note:** now is a good time to port forward ports 80 and 443 from the router > **Quick Note:** now is a good time to port forward ports 80 and 443
> to the reverse proxy > from the router to the reverse proxy
Ubuntu server comes with a firewall (ufw), so be sure to allow access to *NGINX* and Ubuntu server comes with a firewall (ufw), so be sure to allow access
enable it. to *NGINX* and enable it.
The reverse proxy handles both HTTP and HTTPS so **allow "Nginx Full"** The reverse proxy handles both HTTP and HTTPS so **allow "Nginx Full"**
``` bash ``` bash
@@ -92,12 +95,13 @@ server {
} }
} }
``` ```
* **server_name** is the domain name you want use this can include sub-domains * **server_name** is the domain name you want use this can include
sub-domains
* **proxy_pass is the IP address of the web server** * **proxy_pass is the IP address of the web server**
## **Enable ***NGINX*** Config** ## **Enable ***NGINX*** Config**
To activate a config file we need to link the file from the **sites-available** To activate a config file we need to link the file from the
folder to **sites-enabled**. **sites-available** folder to **sites-enabled**.
> **Pro Tip:** make sure to use full paths when creating symlinks > **Pro Tip:** make sure to use full paths when creating symlinks
``` bash ``` bash
sudo ln -s /etc/nginx/sites-available/blog.conf /etc/nginx/sites-enabled/blog.conf sudo ln -s /etc/nginx/sites-available/blog.conf /etc/nginx/sites-enabled/blog.conf
@@ -124,8 +128,8 @@ you should now have a working reverse proxy !!
* Make sure **server_name** is set in the config file you created * Make sure **server_name** is set in the config file you created
## **Installing** ***Certbot*** ## **Installing** ***Certbot***
*Certbot* is a tool that requests an SSL certificate and makes sure it is renewed *Certbot* is a tool that requests an SSL certificate and makes sure it
when needed. is renewed when needed.
**Install** ***Certbot*** as well as the **python ***NGINX*** plug-in** **Install** ***Certbot*** as well as the **python ***NGINX*** plug-in**
``` bash ``` bash
sudo apt install certbot python3-certbot-nginx sudo apt install certbot python3-certbot-nginx
@@ -137,12 +141,12 @@ Now all we need to do is **request the certificate** !!
``` bash ``` bash
sudo certbot --nginx -d blog.example.com sudo certbot --nginx -d blog.example.com
``` ```
* **--nginx** specifies we are using NGINX, this will update the config file we created * **--nginx** specifies we are using NGINX, this will update the config
to allow the use of SSL file we created to allow the use of SSL
* **-d** is the domain name you want to use * **-d** is the domain name you want to use
If this is the first time running *Certbot* you will be asked to enter an email as well If this is the first time running *Certbot* you will be asked to enter
as agree to terms and services. an email as well as agree to terms and services.
If the certificate request is successful you will be prompted with If the certificate request is successful you will be prompted with
@@ -157,23 +161,24 @@ change by editing your web server's configuration.
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
``` ```
**If you want all traffic to be SSL encrypted choose option 2** **If you want all traffic to be SSL encrypted choose option 2**
That's it we have SSL certificates installed. You will need a new certificate for each That's it we have SSL certificates installed. You will need a new
different domain name or subdomain. certificate for each different domain name or subdomain.
## **Verify Auto Renewal** ## **Verify Auto Renewal**
All we need to do now is make sure that Certbot can automatically renew certificates. All we need to do now is make sure that Certbot can automatically renew
certificates.
``` bash ``` bash
sudo certbot renew --dry-run sudo certbot renew --dry-run
``` ```
If you see no errors then you are ready to go. If you see no errors then you are ready to go.
# **Conclusion** # **Conclusion**
By following this you have hopefully managed to setup an *NGINX* Reverse proxy to By following this you have hopefully managed to setup an *NGINX*
handle incoming HTTP/HTTPS requests as well as configured automatically renewing Reverse proxy to handle incoming HTTP/HTTPS requests as well as
SSL certificates. configured automatically renewing SSL certificates.
This posts barely scratches the surface of what *NGINX* can do, I would highly This posts barely scratches the surface of what *NGINX* can do, I would
recommend reading more into this great piece of software !! highly recommend reading more into this great piece of software !!
My reverse proxy handling non existent traffic My reverse proxy handling non existent traffic
![neo awakening](/img/gifs/i-know-kung-fu.gif) ![neo awakening](/img/gifs/i-know-kung-fu.gif)