Nginx, proxy passing to Apache, and SSL
- by Vic
I have Nginx and Apache set up with Nginx proxy-passing everything to Apache except static resources. I have a server set up for port 80 like so:
server {
listen 80;
server_name *.example1.com *.example2.com;
[...]
location ~* \.(?:ico|css|js|gif|jpe?g|png|pdf|te?xt)$ {
access_log off;
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
add_header Vary: Accept-Encoding;
}
location / {
proxy_pass http://127.0.0.1:8080;
include /etc/nginx/conf.d/proxy.conf;
}
}
And since we have multiple ssl sites (with different ssl certificates) I have a server{} block for each of them like so:
server {
listen 443 ssl;
server_name *.example1.com;
[...]
location ~* \.(?:ico|css|js|gif|jpe?g|png|pdf|te?xt)$ {
access_log off;
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
add_header Vary: Accept-Encoding;
}
location / {
proxy_pass https://127.0.0.1:8443;
include /etc/nginx/conf.d/proxy.conf;
proxy_set_header X-Forwarded-Port 443;
proxy_set_header X-Forwarded-Proto https;
}
}
server {
listen 443 ssl;
server_name *.example2.com;
[...]
location ~* \.(?:ico|css|js|gif|jpe?g|png|pdf|te?xt)$ {
access_log off;
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
add_header Vary: Accept-Encoding;
}
location / {
proxy_pass https://127.0.0.1:8445;
include /etc/nginx/conf.d/proxy.conf;
proxy_set_header X-Forwarded-Port 443;
proxy_set_header X-Forwarded-Proto https;
}
}
First of all, I think there is a very obvious problem here, which is that I'm double-encrypting everything, first at the nginx level and then again by Apache. To make everything worse, I just started using Amazon's Elastic Load Balancer, so I added the certificate to the ELB and now SSL encryption is happening three times. That's gotta be horrible for performance.
What is the sane way to handle this? Should I be forwarding https on the ELB - http on nginx - http on apache?
Secondly, there is so much duplication above. Is the best method to not repeat myself to put all of the static asset handling in an include file and just include it in the server?
