I have an NGINX development server. I have a large number
of configuration directives which drive various features of the server.
I want to be able to access the server via SSL.
The problem is that I may access the server from different domain names. For example,
inside my LAN I might use 192.168.1.100, but on the Internet (via NAT forwarding) I'd
use my home domain name, or in some specific instances the server's external IP
address.
Since SSL depends on the
hostname the client requested, I want to be able to generate and serve up multiple SSL
certificates based on how the server is being accessed. For example, one certificate's
CN would be "https://192.168.1.100" while another's would be " href="https://www.example.com" rel="nofollow
noreferrer">https://www.example.com" and yet another's might be " href="https://12.34.56.78" rel="nofollow
noreferrer">https://12.34.56.78".
I
think it may be possible to accomplish this by duplicating server blocks like
this:
server {
listen
443 ssl;
server_name 192.168.1.10;
ssl_certificate
/etc/nginx/192.168.1.10.crt;
ssl_certificate_key
/etc/nginx/192.168.1.10.pem;
location / {
root
/var/www/root;
index index.html index.htm;
}
}
server {
listen 443 ssl;
server_name
www.example.com;
ssl_certificate /etc/nginx/www.example.com.crt;
ssl_certificate_key /etc/nginx/www.example.com.pem;
location /
{
root /var/www/root;
index index.html index.htm;
}
}
...
The
problem is that I have several (i.e. more than 10)
location
blocks inside my server configuration because I am
testing multiple configurations, environments and web applications on the same server.
Most of these locations include either a FastCGI pass through and/or an
alias
or rewrite
directive.
Duplicating all of the
location
blocks is not only tedious but could lead to
inconsistencies if I forget to update every single one.
In addition, I have also planned to possibly
use this environment in the future in such a way that would actually use subdomains,
each with different location blocks. So now we end up with something like
this:
- www.example.com uses
location
parameter set
1 - 12.34.56.78 uses
location
parameter set 1 - test.example.com uses
location
parameter set
2 - 192.168.1.100 uses
location
parameter set
2
As long as I
don't use SSL, this isn't an issue since the server will always serve out of the
"default" server block. But SSL seems to require a separate
server
block for each domain name in order to serve the unique
certificates...
Ideally, what I'd like is some
kind of "named grouping/include" where I could write all the
location
blocks in a separate section and then
include them within the server
blocks. My
"ideal" solution if it
existed:
config config1
{
location / {
root /var/www/root;
index index.html
index.htm;
}
location /testapp1 {
include
fastcgi_params;
fastcgi_split_path_info ^(/testapp1)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass
unix:/run/testapp1.sock;
}
}
config config2 {
location / {
root /var/www/root2;
index index.html
index.htm;
}
location /testapp2 {
include
fastcgi_params;
fastcgi_split_path_info ^(/testapp2)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_pass
unix:/run/testapp2.sock;
}
}
server
{
listen 443 ssl;
server_name 192.168.1.100;
ssl_certificate /etc/nginx/192.168.1.10.crt;
ssl_certificate_key
/etc/nginx/192.168.1.10.pem;
include config
config1;
}
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate
/etc/nginx/www.example.com.crt;
ssl_certificate_key
/etc/nginx/www.example.com.pem;
include config
config1;
}
server {
listen 443 ssl;
server_name test.example.com;
ssl_certificate
/etc/nginx/test.example.com.crt;
ssl_certificate_key
/etc/nginx/test.example.com.pem;
include config
config2;
}
...
Comments
Post a Comment