Configure Nginx for external portal

This article shows an example of configuring Nginx to access a Service Portal at a designated domain name using a reverse proxy.

начало внимание

Before you start, you need to enable and activate an external portal.

конец внимание

We also recommend configuring Nginx for BRIX with a reverse proxy based on the instructions in the Configure Nginx to use BRIX behind a reverse proxy article.

The following data is used in the example:

/_portal/orders. Name of the workspace with an activated portal.
portal-brix365client.domain.com. The external portal domain name.
brix365client.domain.com. The BRIX application domain name.
192.168.1.10. IP address of the server with the BRIX application.

Below are two reverse proxy configurations for accessing an external portal via a dedicated domain using Nginx as example:

Nginx configuration for proxying to an HTTPS server (Kubernetes)

server {
    listen 80;
    server_name portal-brix365client.domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name portal-brix365client.domain.com;
    set $brix365_host brix365client.domain.com;
    ssl_certificate /etc/letsencrypt/live/portal-brix365client.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/portal-brix365client.domain.com/privkey.pem;

    proxy_http_version 1.1;
    proxy_cache_bypass $http_upgrade;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $brix365_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Origin https://$host;

    proxy_set_header Accept-Encoding "";
    sub_filter_types *;
    sub_filter_once off;
    sub_filter '$brix365_host' '$host';

    # redirect required for working with SAML
    proxy_redirect http://$brix365_host https://$host;

    location / {
        return 301 /_portal/orders;
    }

    location = /index.html {
        return 301 /_portal/orders;
    }

    location /_portal/orders {
        proxy_pass http://192.168.1.10/_portal/orders;
}

    location ~* ^.+.(jpg|jpeg|gif|png|svg|ico|js|woff|woff|woff2|css|po)$ {
        proxy_pass http://192.168.1.10;
}

    location /ws {
        proxy_pass http://192.168.1.10;
}

    location /api {
        proxy_pass http://192.168.1.10;
}

    location /s3brix365 {
        proxy_pass http://192.168.1.10;
}

    location /guard {
        proxy_pass http://192.168.1.10;
}

    location /assets {
        proxy_pass http://192.168.1.10;
}
}

Nginx configuration for proxying to an HTTPS server (Kubernetes)

server {
    listen 80;
    server_name portal-brix65client.domain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name portal-brix365client.domain.com;
    set $brix365_host brix365client.domain.com;
    ssl_certificate /etc/letsencrypt/live/portal-brix365client.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/portal-brix365client.domain.com/privkey.pem;

    proxy_http_version 1.1;
    proxy_cache_bypass $http_upgrade;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $brix365_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Origin https://$host;

    proxy_set_header Accept-Encoding "";
    sub_filter_types *;
    sub_filter_once off;
    sub_filter '$brix365_host' '$host';

    # reqirect required for working with SAML
    proxy_redirect https://$brix365_host https://$host;

    location / {
        return 301 /_portal/orders;
    }

    location = /index.html {
        return 301 /_portal/orders;
    }

    location /_portal/orders {
        proxy_pass https://192.168.1.10/_portal/orders;
}

    location ~* ^.+.(jpg|jpeg|gif|png|svg|ico|js|woff|woff|woff2|css|po)$ {
        proxy_pass https://192.168.1.10;
}

    location /ws {
        proxy_pass https://192.168.1.10;
}

    location /api {
        proxy_pass https://192.168.1.10;
}

    location /s3brix365 {
        proxy_pass https://192.168.1.10;
}

    location /guard {
        proxy_pass https://192.168.1.10;
}

    location /assets {
        proxy_pass https://192.168.1.10;
}
}

During installation or reconfiguration, in the Enter host field, specify brix365client.domain.com as the external domain that BRIX will be available at and enable SSL termination.

начало примечание

Note

The following parameters are required for the web sockets in the application to work correctly:

proxy_http_version 1.1.
proxy_set_header Upgrade $http_upgrade.
proxy_set_header Connection "upgrade".

The sub_filter directive will only work if ngx_http_sub_module is enabled in Nginx.

конец примечание

haproxy-external-portal.html haproxy-elma365.html