| 1 | # Front nginx SNI passthrough example for a separately deployed Portal nginx. |
| 2 | # This nginx does not deploy Portal and does not terminate TLS for Portal hosts. |
| 3 | # |
| 4 | # Replace: |
| 5 | # portal.example.com - Portal's public root host |
| 6 | # 10.0.0.20:443 - Portal nginx HTTPS/SNI listener |
| 7 | # 127.0.0.1:8443 - your existing HTTPS listener for non-Portal hosts |
| 8 | |
| 9 | events { |
| 10 | worker_connections 4096; |
| 11 | } |
| 12 | |
| 13 | stream { |
| 14 | map $ssl_preread_server_name $tls_upstream { |
| 15 | portal.example.com portal_nginx; |
| 16 | ~^.+\.portal\.example\.com$ portal_nginx; |
| 17 | default existing_https; |
| 18 | } |
| 19 | |
| 20 | upstream portal_nginx { |
| 21 | # Portal's own nginx. TLS is passed through unchanged. |
| 22 | server 10.0.0.20:443; |
| 23 | } |
| 24 | |
| 25 | upstream existing_https { |
| 26 | # Replace with your normal HTTPS upstream, or point default to |
| 27 | # portal_nginx if this front nginx is dedicated to Portal. |
| 28 | server 127.0.0.1:8443; |
| 29 | } |
| 30 | |
| 31 | server { |
| 32 | listen 443; |
| 33 | listen [::]:443; |
| 34 | ssl_preread on; |
| 35 | proxy_pass $tls_upstream; |
| 36 | proxy_connect_timeout 5s; |
| 37 | proxy_timeout 86400s; |
| 38 | } |
| 39 | } |
| 40 | |
| 41 | http { |
| 42 | server { |
| 43 | listen 80; |
| 44 | listen [::]:80; |
| 45 | server_name portal.example.com *.portal.example.com; |
| 46 | return 301 https://$host$request_uri; |
| 47 | } |
| 48 | } |