Welcome to Nginx Page loading instead of testing interface

[inshanrxxx1]

Hi,

I have deployed the project on my VPS using this guide . When trying to access on my domain I am getting the "Welcome to Nginx" page instead of the testing page as seen in internet.nl

I also have apache2 serving other websites so I edited the docker local.env file with the following and did a reverse proxy to point my subdomain to localhost:8080 :

The containers are running

[bwbroersma]

This is due to passing Host: localhost by nginx to the remote proxy, if you add the correct Host header (with proxy_set_header Host scan.example.org) it would work, where scan.example.org is the value of the INTERNETNL_DOMAINNAME variable. See the example of how the port-expose works in development:

Internet.nl/docker/port-expose/nginx_templates/port-expose.conf.template

Lines 2 to 13 in 6fbee2b

	server {
	listen 8080;
	listen [::]:8080;
	server_name _;
	location / {
	proxy_set_header Host ${INTERNETNL_DOMAINNAME};
	proxy_ssl_name ${INTERNETNL_DOMAINNAME};
	proxy_ssl_server_name on;
	proxy_ssl_verify off;
	proxy_pass https://webserver:443;
	}

In your case it might be better for performance reasons to rewrite the app.conf.template to not do the TLS part (otherwise it happens twice), but that's a bit more complicated and it will be less easy to update, so if it's not high usage the few % extra CPU of double TLS will not be a problem and I would not recommend to go that route.

Related:

• Disable nginx conf.d/default.conf / localhost #1884

[inshanrxxx1]

Thank you for reaching out @bwbroersma

So my VPS is using apache 2(httpd),

I added a subdomain lets say(scan.example.org) and I set the INTERNETNL_DOMAINNAME variable in the host.env file .
I also updated the apache2 proxy config located at

1. /etc/apache2/conf.d/userdata/std/2_4/(cpanel_username)/scan.example.org/node.conf
2. /etc/apache2/conf.d/userdata/ssl/2_4/(cpanel_username)/scan.example.org/node.conf

with the snippet below

ProxyRequests off
<Proxy *>
  Order deny,allow
  Allow from all
</Proxy>
<Location />
  RequestHeader set Host "scan.example.org"
  ProxyPass http://localhost:8080/
  ProxyPassReverse http://localhost:8080/
</Location>

After adding RequestHeader set Host "scan.example.org" to the proxy config file, I rebuilt and reloaded the httpd service but I'm still getting the "Welcome to Nginx" page

This is the config i added in /opt/Internet.nl/docker/local.env

WEBSERVER_PORT=0.0.0.0:8080:80
WEBSERVER_PORT_TLS=0.0.0.0:4443:443
WEBSERVER_PORT_IPV6=::0:8080:80
WEBSERVER_PORT_IPV6_TLS=::0:4443:443
UNBOUND_PORT_TCP=0.0.0.0:533:53/tcp
UNBOUND_PORT_UDP=0.0.0.0:533:53/udp
UNBOUND_PORT_IPV6_TCP=::0:533:53/tcp
UNBOUND_PORT_IPV6_UDP=::0:533:53/udp

This is due to passing Host: localhost by nginx to the remote proxy, if you add the correct Host header (with proxy_set_header Host scan.example.org) it would work, where scan.example.org is the value of the INTERNETNL_DOMAINNAME variable. See the example of how the port-expose works in development:

Internet.nl/docker/port-expose/nginx_templates/port-expose.conf.template

Lines 2 to 13 in 6fbee2b

server {
listen 8080;
listen [::]:8080;
server_name _;

 location / { 
     proxy_set_header Host ${INTERNETNL_DOMAINNAME}; 
     proxy_ssl_name ${INTERNETNL_DOMAINNAME}; 
     proxy_ssl_server_name on; 
     proxy_ssl_verify off; 
     proxy_pass https://webserver:443; 
 } 

In your case it might be better for performance reasons to rewrite the app.conf.template to not do the TLS part (otherwise it happens twice), but that's a bit more complicated and it will be less easy to update, so if it's not high usage the few % extra CPU of double TLS will not be a problem and I would not recommend to go that route.

Related:

• Disable nginx conf.d/default.conf / localhost #1884

[bwbroersma]

My Apache httpd config skills are a bit rusty. I see however you connect to 8080, which won't work since the container redirects this to https.

I did a quick test with Apache httpd, and with this sample host.env:

INTERNETNL_DOMAINNAME=scan.example.org
COMPOSE_PROJECT_NAME=internetnl-prod
IPV6_IP_PUBLIC=::1
IPV4_IP_PUBLIC=127.0.0.1

ALLOWED_HOSTS=127.0.0.1,::1,localhost,.scan.example.org,scan.example.org

# external exposure is only needed if you want to also run the connection test
# otherwise binding to 127.0.0.1 and ::1 will also work
UNBOUND_PORT_TCP=0.0.0.0:53:53/tcp
UNBOUND_PORT_UDP=0.0.0.0:53:53/udp
UNBOUND_PORT_IPV6_TCP=::0:53:53/tcp
UNBOUND_PORT_IPV6_UDP=::0:53:53/udp

WEBSERVER_PORT=127.0.0.1:8080:80
WEBSERVER_PORT_TLS=0.0.0.0:4443:443
WEBSERVER_PORT_IPV6=::1:8080:80
WEBSERVER_PORT_IPV6_TLS=::1:4443:443

(note this will publicly open port 4443 on IPv4!)

env -i docker compose --env-file=docker/defaults.env --env-file=docker/host.env up --wait --no-build

And a minimal httpd.conf consisting of:

Listen 80
LoadModule mpm_event_module modules/mod_mpm_event.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule ssl_module modules/mod_ssl.so
SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
User www-data
Group www-data
ErrorLog /proc/self/fd/2
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog /proc/self/fd/1 common
<Location />
  ProxyPreserveHost On
  ProxyPass https://172.17.0.1:4443
</Location>

docker run --rm -it -p 8080:80 -v $PWD/httpd.conf:/usr/local/apache2/conf/httpd.conf --name tmpapache httpd:2.4.65-alpine

curl http://127.0.0.1:8080 -H 'Host: scan.example.org'

Note all the corners I cut here, e.g. listening to all external traffic, stripping TLS, etc. But it's a Proof of Concept to proxy from Apache to nginx.

If you run Apache httpd native (and not in a container) you can use ProxyPass https://127.0.0.1:4443 in httpd.conf and WEBSERVER_PORT_TLS=127.0.0.1:4443:443 in host.env, of course you should only proxy https traffic to 4443, and http traffic to 8080.

[inshanrxxx1]

Hi @bwbroersma I sent a email yesterday. Not sure if it was received, maybe it went to your spam. Is it possible that we can connect privately to discuss consultation services?