hey guys,
it's a never ending story - configure a nginx reverse proxy for proxmox within a subdirectory. found some threads with other solutions than the originally intended nginx with subdirectory. but it's not possible in my case because using the existing nginx proxy is a given fact.
we have one nginx reverse proxy to serve different (web)services to outside the company network. all this services running on different hosts and must be served external within a subdirectory. so the only possibility to do this with proxmox, is to work with a subdirectory too. i think i'm got it working but only the console don't work. it is ok for me, because i only need the webinterface for some basic administration tasks. and only in that case there is any trouble with the company vpn gateway.
with this configuration when the new console window opens, the complete webgui is opened in this window. probably it's an issue with the used location/rewrite config and the request is not included in the rules. this is the corresponding logfile entry:
maybe here are some guys interested in that configuration? (scroll down for the proxmox related part)
and maybe here are some guys with more know how to configure nginx than me and can help get the console working? (and fix some unlovely settings i've googled and used with trial and error method.)
regards
stefan
p.s. don't be confused about the double use of the string "px". in a hostname i used it as an acronym of "proxy" and in an URL is used it as an acronym for "proxmox"
it's a never ending story - configure a nginx reverse proxy for proxmox within a subdirectory. found some threads with other solutions than the originally intended nginx with subdirectory. but it's not possible in my case because using the existing nginx proxy is a given fact.
we have one nginx reverse proxy to serve different (web)services to outside the company network. all this services running on different hosts and must be served external within a subdirectory. so the only possibility to do this with proxmox, is to work with a subdirectory too. i think i'm got it working but only the console don't work. it is ok for me, because i only need the webinterface for some basic administration tasks. and only in that case there is any trouble with the company vpn gateway.
with this configuration when the new console window opens, the complete webgui is opened in this window. probably it's an issue with the used location/rewrite config and the request is not included in the rules. this is the corresponding logfile entry:
Code:
10.10.10.10 - - [26/Dec/2019:08:52:12 +0100] "GET /px/?console=kvm&novnc=1&vmid=1077&vmname=webserver26&node=p1&resize=off&cmd= HTTP/1.1" 200 855 "https://px.mydomain.tld/px/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/78.0.3904.108 Chrome/78.0.3904.108 Safari/537.36"maybe here are some guys interested in that configuration? (scroll down for the proxmox related part)
and maybe here are some guys with more know how to configure nginx than me and can help get the console working? (and fix some unlovely settings i've googled and used with trial and error method.)
regards
stefan
p.s. don't be confused about the double use of the string "px". in a hostname i used it as an acronym of "proxy" and in an URL is used it as an acronym for "proxmox"
Code:
server {
listen 80;
server_name px.mydomain.tld px.internal.mydomain.tld;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
# let's encrypt
location ^~ /.well-known/acme-challenge/ {
proxy_pass http://localhost:60001;
}
}
upstream proxmox {
ip_hash;
server p1.internal.mydomain.tld:8006;
server p2.internal.mydomain.tld:8006;
server p3.internal.mydomain.tld:8006;
}
server {
listen 443 ssl;
server_name px.mydomain.tld px.internal.mydomain.tld;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
ssl_certificate /etc/letsencrypt/live/px.mydomain.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/px.mydomain.tld/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/px.mydomain.tld/chain.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_ecdh_curve secp384r1;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;
resolver 10.10.10.1 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
# guacamole
location /gu/ {
proxy_pass http://gu.internal.mydomain.tld:8080/guacamole/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_cookie_path /guacamole/ /;
}
# end guacamole
# [... more configs at this place ...]
# proxmox
location ~/px(.*)$ {
proxy_pass https://proxmox$1;
proxy_buffering off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
add_header X-Frame-Options SAMEORIGIN;
}
location ~ ^/(pve2|api2|pwt|ceph)/ {
rewrite ^/$1/$ /px/$1/$2 break;
proxy_pass https://proxmox$2;
}
location ~* ^/proxmox.*\.js$ {
proxy_pass https://proxmox$1;
}
location ~* ^/favicon.*\.ico$ {
proxy_pass https://proxmox$1;
}
# ende proxmox
}
