How to use nginx reverse proxy with Liferay 7.0?

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-19T14:25:50Z

Thanks to all; I'll try asap

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-15T08:11:02Z

An example of a running configuration. Works for me, but your mileage may vary.

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
&nbsp;&nbsp;&nbsp; worker_connections 1024;
}

http {
&nbsp;&nbsp;&nbsp; log_format&nbsp; main&nbsp; '$remote_addr - $remote_user [$time_local] "$request" '
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; '$status $body_bytes_sent "$http_referer" '
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; '"$http_user_agent" "$http_x_forwarded_for"';

&nbsp;&nbsp;&nbsp; access_log&nbsp; /var/log/nginx/access.log&nbsp; main;

&nbsp;&nbsp;&nbsp; sendfile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp; tcp_nopush&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp; tcp_nodelay&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp; keepalive_timeout&nbsp;&nbsp; 65;
&nbsp;&nbsp;&nbsp; types_hash_max_size 2048;
&nbsp;&nbsp;&nbsp; client_max_body_size 100m;

&nbsp;&nbsp;&nbsp; include&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/nginx/mime.types;
&nbsp;&nbsp;&nbsp; default_type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; application/octet-stream;

&nbsp;&nbsp;&nbsp; # Load modular configuration files from the /etc/nginx/conf.d directory.
&nbsp;&nbsp;&nbsp; # See http://nginx.org/en/docs/ngx_core_module.html#include
&nbsp;&nbsp;&nbsp; # for more information.
&nbsp;&nbsp;&nbsp; include /etc/nginx/conf.d/*.conf;


&nbsp;&nbsp;&nbsp; upstream liferay_upstream {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server 127.0.0.1:8080 max_fails=3 fail_timeout=30s;
&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp; server {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 80;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [::]:80;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server_name&nbsp; [yourfqdn];
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return 301&nbsp;&nbsp; https://[yourfqdn]$request_uri;
&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp; server {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 443 ssl http2;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [::]:443 ssl;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server_name&nbsp; [yourfqdn];
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /opt/liferay;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Load configuration files for the default server block.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; include /etc/nginx/default.d/*.conf;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl&nbsp;&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_certificate&nbsp;&nbsp;&nbsp; /etc/nginx/ssl/mydomain.crt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_certificate_key&nbsp;&nbsp;&nbsp; /etc/nginx/ssl/isdms.key;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Use only TLS
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_protocols TLSv1.1 TLSv1.2;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Tell client which ciphers are available
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_prefer_server_ciphers on;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Enable HSTS
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; add_header Strict-Transport-Security "max-age=31536000" always;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Optimize session cache
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_cache&nbsp;&nbsp; shared:SSL:40m;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_timeout 4h;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Enable session tickets
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_session_tickets on;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Remove version number on errors
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server_tokens off;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; location / {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_pass http://liferay_upstream;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header X-Real-IP&nbsp; $remote_addr;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header X-Forwarded-For $remote_addr;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header Host $host;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header X-Real-Port $server_port;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header X-Real-Scheme $scheme;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_set_header X-Forwarded-Proto https;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_read_timeout 180s;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_connect_timeout 10s;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; add_header X-Cached-Status $upstream_cache_status;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gzip_comp_level 3;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gzip_proxied any;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; error_page 404 /404.html;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; location = /40x.html {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; error_page 500 502 503 504 /50x.html;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; location = /50x.html {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }
&nbsp;&nbsp;&nbsp; }

}

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-05T11:56:24Z

Somebody (or something) deleted my previous comment that I made on 2019-02-04 ; here it is again:

I have something like the following for dev/test purposes.

	server {
	listen 80;
	listen [::]:80;
	server_name myserver.mydomain.it;
	return 301 https://$server_name$request_uri;
	}

	upstream liferay7-app-server {
	server localhost:8080 max_fails=3 fail_timeout=30s;
	}


	server {
	# Ensure that HTTP/2 is enabled for the server
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name myserver.mydomain.it;

	ssl on;
	ssl_certificate ssl/star.domain.ca.chained.crt;
	ssl_certificate_key ssl/star.domain.ca.key;

	location / {
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_redirect http:// https://;
	proxy_pass http://liferay7-app-server;
	}

	}

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-05T10:08:28Z

Thanks.
If I'll hava success, I'll share the result here.

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-05T09:53:09Z

Mirto Silvio Busico
Please can you share the Nginx translation?

I didn't leave it out, so that you have something to figure out. Personally, I'm working on Apache httpd typically. I could have provided you with the httpd-config that you quoted. But I'm not that familiar with nginx to provide one sample out of the box.

To correct my statement: I'll leave the translation work to you or anyone else who speaks nginx fluently. Sorry...

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-05T08:55:31Z

Thanks a lot Olaf.
I'm using this Apache configuration

<virtualhost *:443>
&nbsp;&nbsp; ServerAdmin m.busico@ieee.org
&nbsp;&nbsp; ServerName myserver.mydomain.it
&nbsp;&nbsp; ErrorLog /var/log/apache2/error443.log
&nbsp;&nbsp; LogLevel warn
&nbsp;&nbsp; CustomLog /var/log/apache2/access443.log combined
&nbsp;&nbsp; DocumentRoot /var/www/myserver

&nbsp;&nbsp; SSLEngine on

&nbsp;&nbsp; SSLCertificateFile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /etc/ssl/certs/ssl-cert-snakeoil.pem
&nbsp;&nbsp; SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

&nbsp;&nbsp; <filesmatch "\.(cgi|shtml|phtml|php)$">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLOptions +StdEnvVars
&nbsp;&nbsp; </filesmatch>
&nbsp;&nbsp; <directory usr lib cgi-bin>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLOptions +StdEnvVars
&nbsp;&nbsp; </directory>

&nbsp;&nbsp; ProxyRequests Off
&nbsp;&nbsp; ProxyPreserveHost On
&nbsp;&nbsp; ProxyPass / ajp://icons:8009/
&nbsp;&nbsp; ProxyPassReverse / ajp://icons:8009/

</virtualhost>

which works fine; but I need to switch to Nginx (see the P.S.).

Please can you share the Nginx translation?

P.S.
I'm trying to integrate Neo4j in Liferay and I found that Neo4j needs a tcp stream proxy. Nginx support proxyng tcp strams but do not support ajp.
So seems that using Apache as proxy I can have liferay but not Neo4j and using Nginx I can have Neo4j but not Liferay.
Any solution that manages Liferay and Neo4j is good for me.

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-05T05:52:41Z

What David says.
Personally, I prefer to proxy through AJP, rather than through HTTP, because this protocol covers all the issues transparently.

If you stay on HTTP: On Apache httpd, there's a directive named "ProxyPreserveHost" that needs to be included, and it will make Liferay (or tomcat) aware of the differing hostname that it should use to create a URL. I'll leave the translation to the nginx world to you.

RE: How to use nginx reverse proxy with Liferay 7.0?

2019-02-04T19:34:08Z

Although targeting Apache httpd, I think you're facing the same concern from https://community.liferay.com/blogs/-/blogs/fronting-liferay-tomcat-with-apache-httpd-daemon-revisted.

Liferay normally builds URLs from the incoming connection request details; when you are proxying, the incoming URL will have the proxy IP, not the actual client IP.

By configuring to pass the incoming connection details and configuring Liferay to use the headers instead of the request itself, Liferay will construct the URLs correctly.

How to use nginx reverse proxy with Liferay 7.0?

2019-02-04T17:56:12Z

Hi all,
I'm trying to use nginx as a reverse proxy in front of a liferay 7.0

The configuration below

server {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; listen 443 ssl;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_certificate /root/sslcerts/servizi.crt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ssl_certificate_key /root/sslcerts/servizi.key;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; access_log /var/log/nginx/myserver.access.log;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; error_log /var/log/nginx/myserver.error.log;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; root /var/www/reverse;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set $proxy_upstream_name "-";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Add index.php to the list if you are using PHP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; index index.html index.htm index.nginx-debian.html;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; server_name "myserver" "myserver.mydomain.it";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; location / {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; set $proxy_upstream_name "myserver.mydomain.it";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; proxy_pass&nbsp; http://10.220.90.86:8080;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }

}

gives me correctly the home page; but all css is lost and the navigation links are in the form "http://10.220.90.86:8080/[navigation link]" instead of ""myserver.mydomain.it/[navigation link]"

In the instance the virtual host is set to "myserver.mydomain.it"

Anyone knows how to configure nginx reverse proxy?