Setting up an NGINX Reverse Proxy with SSL

A reverse proxy is a function of a web server that allows it to forward requests onto other web servers. Typically they are set up in combination with a wildcard SSL certificate, allowing each subdomain to go to a different server. Apache2 and NGINX can both function as reverse proxies, but NGINX is much easier to set up!

Installing NGINX

Install using apt

First, install nginx using apt:

sudo apt install nginx

Testing with telnet

Telnet is great for testing TCP ports. NGINX listens on TCP port 80 by default, so we can test it with telnet:

telnet 127.0.0.1 80

If the server is responding correctly, you should see an output similar to below:

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

Configuring NGINX

NGINX configuration files are stored in /etc/nginx/ - the site configuration files are stored in sites-available/, then these are enabled by creating a symbolic link to them in sites-enabled/

Disabling the default site configuration file

Now that we know the server is running, we are going to disable the default NGINX configuration file. This is so that we can create a new one that is more focused around the reverse proxy abilities of NGINX.

To remove the default configuration file, run this command:

sudo rm /etc/nginx/sites-enabled/default

Creating a new site configuration file

We will now create a new site configuration file, using our domain name as the file name:

sudo nano /etc/nginx/sites-available/YOUR.DOMAIN

Here is an example template, which retains NGINX's default site configuration for the root domain and does reverse proxy for a subdomain to a Proxmox server:

# We are defining our Let's Encrypt certificate here
# If your NGINX server will serve multiple domains, you will instead need to place it within the 443 definition
ssl_certificate /etc/letsencrypt/live/YOUR.DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/YOUR.DOMAIN/privkey.pem;

# Required when reverse proxying to a Proxmox server
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# This will forward all HTTP requests to HTTPS
server {
	listen 80;
	listen [::]:80;
	server_name *.YOUR.DOMAIN;
	rewrite ^ https://$host$request_uri? permanent;
}

# This will serve NGINX's default web page, via HTTPS
server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name YOUR.DOMAIN;
	
	# Define the web root
	root /var/www/html;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.nginx-debian.html;

	location / {
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
	}
}

# This subdomain will reverse proxy requests to a Proxmox web interface
server {
	listen 443 ssl;
	listen [::]:443 ssl;
	server_name proxmox.YOUR.DOMAIN;

        location / {
                proxy_pass              https://YOUR.PROXMOX.IP.ADDRESS:8006;
                proxy_set_header        Upgrade $http_upgrade;
                proxy_set_header        Connection "upgrade";
        }
}

Once modified to suit your setup, use Control-S to save and Control-C to quit nano.

Enabling the new configuration file

We now have a new configuration file, and we are going to enable it by creating a symbolic link:

sudo ln -s /etc/nginx/sites-available/YOUR.DOMAIN /etc/nginx/sites-enabled/YOUR.DOMAIN

Testing the configuration

We can now run nginx -t in order to test the new configuration file:

sudo nginx -t

Assuming all is well, you should see an output similar to below:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Restarting NGINX

Once we've confirmed that the configuration file tests successfully, we can apply it by restarting the NGINX service:

sudo systemctl restart nginx

Testing port 443 with telnet

We already know that NGINX was listening on TCP port 80, but since we have just enabled SSL, we want to make sure that it's also listening on port 443:

telnet 127.0.0.1 443

The output should be similar to before:

Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.