Nginx configure SSL load balancer

Question

I have a Docker Server where I have installed GitLab from sameersbn/docker-gitlab

I have a nginx container that listen to 443:433 and 80:80, I will use this one to load balance HTTP and HTTPs (with signed cert) requests

nginx.conf

worker_processes auto;

events { worker_connections 1024; }

http {

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;


    upstream gitlab {
        server gitlab:10080;
    }

    server {
        listen 80;
        listen 443 ssl;
        server_name www.domain.tld;

        ssl on;
        ssl_certificate         /usr/local/share/ca-certificates/domain.crt;
        ssl_certificate_key     /usr/local/share/ca-certificates/domain.key;
        ssl_trusted_certificate /usr/local/share/ca-certificates/GandiStandardSSLCA2.pem;

        ssl_session_timeout 5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
        ssl_prefer_server_ciphers on;

        root /usr/share/nginx/html;

        location /git/ {
            proxy_pass http://gitlab;
            proxy_set_header X-Forwarded-Ssl on;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

Without SSL, working url to acces gitlab is http://www.domain.tld:10080/git

With SSL, I want the url to be https://www.domain.tld/git

Using this nginx load balancer configuration

When I go on http://www.domain.tld/git

400 Bad Request

The plain HTTP request was sent to HTTPS port

When i go on https://www.domain.tld/git

ERR_CONNECTION_REFUSED

These are my first signed certificate, how is this supposed to work ?

Anatoly Anatoly · Accepted Answer · 2015-07-11T19:11:19

To solve the problem there are 2 steps required:

make Nginx redirect HTTP to HTTPS
Make Gitlab to listen port 80 via HTTP

Why to make Gitlab to listen port 80? This technique called SSL offload that prevent redundant HTTPS encryption/decryption to happen between upstream and web-server. It is rarely required and only makes sense in case of different hosts with complex security requirements.

Nginx

server {
   listen         80;
   server_name    www.domain.tld;
   return         301 https://$server_name$request_uri;
}

server {
   listen         443 ssl;
   server_name    www.domain.tld;

   [....]

}

Gitlab

vi ./gitlab/config.yml
gitlab_url: "http://server1.example.com" # http rather than https

Nginx configure SSL load balancer

1 Answers