About nginx

Nginx is a high-performance open source web server software that can also be used for reverse proxy, load balancing, etc., and has the advantages of high performance and low memory consumption.

In this article, we mainly explain the reverse proxy function of nginx and implement the following functions on the server:
1. Reverse proxy for other background services
2. Access background services through domain names
Preliminary preparation:
1. A cloud server (ubuntu20.04 LTS)
2. An available domain name
Note:
1. In this article, because nginx has been installed on the server in advance, the system used in Chapter 2 (Installing nginx) is a brand new local ubuntu system for demonstration, so its IP address is a LAN address.
2. In Chapter 3 (Nginx reverse proxy configuration), the system used is the cloud server ubuntu system, its IP address is a public network address, and the domain name has been used for resolution.
3. If other systems such as CentOS are used, some management commands and operation commands may be different, but the nginx configuration and usage logic are basically the same.

Install nginx

1. Update system packages
sudo apt update
2. Install nginx
sudo apt install nginx -y
The -y option indicates that the default setting for the query during the installation process is yes
After the installation is complete, you can check whether there are two more directory files in the system, /etc/nginx/ and /var/www/html, where:
/etc/nginx/: Contains NGINX configuration files, mainly used to configure the behavior of the nginx server, including listening ports, reverse proxy settings, SSL/TLS configuration, etc.
/var/www/html: The default website root directory of nginx, where HTML pages, JS files and other resources are stored.
In this article, we mainly explain the reverse proxy function of nginx, so /var/www/html is used as the web server function directory of nginx, and we will not make any changes for the time being.
3. Verify whether nginx is installed successfully
Start the nginx service and add it to start automatically when the system starts:
sudo systemctl start nginx
sudo systemctl enable nginx
Check the current status of the nginx service:
sudo systemctl status nginx
By checking the status, you can see that the current nginx service status is running, and it has been enabled and added to the startup. The log output below also shows that it has started successfully.

Use the server IP address in the browser to access the web server function of ngxin:

192.168.3.168:80 or 192.168.3.168 #Default access port 80

This proves that nginx has been installed successfully.

Nginx reverse proxy configuration

In the reverse proxy function, you need to understand the two directories /etc/nginx/sites-available and /etc/nginx/sites-enabled in the nginx configuration file:
sites-available: This directory contains all available virtual host configuration files. Each file usually corresponds to the configuration of a virtual host (a website). Here you can store all the virtual host configuration files that have been created, whether enabled or not.
sites-enabled: This directory contains symbolic links to the currently enabled virtual host configuration files. When nginx starts, it will only read the configuration files in the sites-enabled directory.
In layman's terms: virtual hosts refer to different websites or services running on the same physical server. The available directory stores the configuration files of the virtual hosts we want to proxy, but whether these configuration files are enabled depends on whether we link them to the enabled directory, because the nginx service only reads the enabled directory for settings, which makes adding, editing, and disabling virtual host configurations easier and safer.

This demonstration will use nginx to complete the reverse proxy function for the emqx management console service (EMQX Dashboard, port 18083). (If there is no emqx service, it can also be used for any other application and service, the same principle)

(1) The emqx service has been installed and started on the cloud server, and the EMQX management console can be accessed normally through the ip+port

(2) The server ip has been bound to the domain name, and the domain name has completed DNS resolution

Here, the second-level domain name is required, so the domain name is directly resolved by the second-level domain name

(3) Add a virtual host configuration file

For example, the domain name we use here is keeshow.cn, and we want to access the emqx management console service through mqtt.keeshow.cn.

Add /etc/nginx/sites-available/mqtt.keeshow.cn configuration file, the configuration content is:
server {
listen 80;
listen [::]:80;
server_name mqtt.keeshow.cn;
client_max_body_size 1024m;
location / {
proxy_pass http://127.0.0.1:18083;
proxy_set_header HOST $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
The server block: defines a virtual host for processing requests for a specific domain name and port.
listen:80: listen on port 80 (HTTP default port) on the IPv4 address, [::]:80: listen on port 80 on the IPv6 address. This allows both IPv4 and IPv6 HTTP requests to be processed simultaneously.

server_name: specifies the domain name that the virtual host responds to. This server block is used only when the Host header of the request matches mqtt.keeshow.cn.
client_max_body_size: sets the maximum allowed size of the client request body to 1024MB. This is useful when you need to upload large files to prevent requests from being rejected because they are too large.
location block: defines how requests to the root path (/) are handled.
proxy_pass: proxies all requests to mqtt.keeshow.cn to the local 127.0.0.1:18083. After receiving the request on behalf of nginx, it forwards it to the EMQX Dashboard running on local port 18083.
proxy_set_header: related to request header settings.
HOST $host: Passes the Host header of the client request to the backend server. The $host variable represents the host name requested by the client.
X-Forwarded-Proto $scheme: Passes the protocol (HTTP or HTTPS) used by the client to the backend server. The $scheme variable represents the requested protocol.
X-Real-IP $remote_addr: Passes the client's real IP address to the backend server. The $remote_addr variable represents the client's IP address.
X-Forwarded-For $proxy_add_x_forwarded_for: Passes the client's original IP address and all proxy IP addresses to the backend server. The $proxy_add_x_forwarded_for variable contains the client's IP address and the IP addresses of all proxy servers.
After the creation is complete, you can see the newly added configuration files in the sites-available directory. Similarly, if you need to add other configuration files, you also need to create them in this directory.

Link virtual host configuration file

Link the configuration file in the sites-available directory to the sites-enabled directory:
sudo ln -s /etc/nginx/sites-available/mqtt.keeshow.cn /etc/nginx/sites-enabled/

This link will generate a soft link in the sites-enabled directory and point to the original configuration file in the sites-available directory. Similarly, we can also see the links of other proxied services here, all of which come from the sites-available directory.

After completing the configuration, check whether there are any syntax errors in the configuration:
sudo nginx -t

Restart nginx

#Reload nginx configuration file
sudo systemctl reload nginx
#Restart nginx
sudo systemctl restart nginx

Access through domain name

After completing the above steps, it means that the reverse proxy of nginx has been configured, and the EMQX management console service can be accessed normally through the domain name.

Summary

1. As a reverse proxy server, nginx can help forward client requests to multiple servers or services on the backend, and return the responses of the backend servers to the client.
2. When using a domain name for reverse proxy, the client can only see the domain name, but cannot directly see the real IP address of the backend server. This can hide the real IP address of the backend server, enhancing security and privacy protection.