cockpit and nginx reversed proxy

lufy

May 31, 2022

I was trying to make my intranet cockpit web console accessed via Internet, I set up nginx proxy just as other intranet web sites like file server, the cockpit login interface appeared finely in the Internet, but when I tried to logon, it just refreshed, not logged in. After I searching on bing.com, I realized that nginx need a https proxy, not http. I used cockpit's certificate as https certificate. The nginx config file looks like:
server { &nbsp; &nbsp; listen&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;8001 ssl; &nbsp; &nbsp; server_name &nbsp; &nbsp;lufy.top;
&nbsp; &nbsp; ssl_certificate /etc/nginx/conf.d/ws-certs.d/0-self-signed.cert; &nbsp; &nbsp; ssl_certificate_key /etc/nginx/conf.d/ws-certs.d/0-self-signed.key; &nbsp; &nbsp; ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
&nbsp; &nbsp; location / { &nbsp; &nbsp; &nbsp; &nbsp; # Required to proxy the connection to Cockpit &nbsp; &nbsp; &nbsp; &nbsp; proxy_pass https://10.0.1.2:9090; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header Host $host; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header X-Forwarded-Proto $scheme;
&nbsp; &nbsp; &nbsp; &nbsp; # Required for web sockets to function &nbsp; &nbsp; &nbsp; &nbsp; proxy_http_version 1.1; &nbsp; &nbsp; &nbsp; &nbsp; proxy_buffering off; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header Upgrade $http_upgrade; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header Connection "upgrade";
&nbsp; &nbsp; &nbsp; &nbsp; # Pass ETag header from Cockpit to clients. &nbsp; &nbsp; &nbsp; &nbsp; # See: https://github.com/cockpit-project/cockpit/issues/5239 &nbsp; &nbsp; &nbsp; &nbsp; gzip off; &nbsp; &nbsp; } }
Also, some change of cockpit config file is needed:
cat /etc/cockpit/cockpit.conf [WebService] Origins = https://lufy.org:8001 wss://lufy.org ProtocolHeader = X-Forwarded-Proto

cockpit and nginx reversed proxy

Comments (0)

Leave a Comment