Show Posts
1
Web Proxy Filtering and Caching / Nginx proxy - grPC possible?
« on: March 20, 2024, 08:26:21 pm »
Hi,
I would like to reverse proxy my local Netbird installation. I cannot find an option to forward grPC, which is supported in nginx since 1.13 (OPNsense has 1.24)
How do I do stuff like grpc_set_header? Template for reference:
Thank you!
I would like to reverse proxy my local Netbird installation. I cannot find an option to forward grPC, which is supported in nginx since 1.13 (OPNsense has 1.24)
How do I do stuff like grpc_set_header? Template for reference:
Code: [Select]
upstream dashboard {
# insert the http port of your dashboard container here
server 127.0.0.1:8011;
# Improve performance by keeping some connections alive.
keepalive 10;
}
upstream signal {
# insert the grpc port of your signal container here
server 127.0.0.1:10000;
}
upstream management {
# insert the grpc+http port of your signal container here
server 127.0.0.1:8012;
}
server {
# HTTP server config
listen 80;
server_name _;
# 301 redirect to HTTPS
location / {
return 301 https://$host$request_uri;
}
}
server {
# HTTPS server config
listen 443 ssl http2;
server_name _;
# This is necessary so that grpc connections do not get closed early
# see https://stackoverflow.com/a/67805465
client_header_timeout 1d;
client_body_timeout 1d;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;
grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Proxy dashboard
location / {
proxy_pass http://dashboard;
}
# Proxy Signal
location /signalexchange.SignalExchange/ {
grpc_pass grpc://signal;
#grpc_ssl_verify off;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}
# Proxy Management http endpoint
location /api {
proxy_pass http://management;
}
# Proxy Management grpc endpoint
location /management.ManagementService/ {
grpc_pass grpc://management;
#grpc_ssl_verify off;
grpc_read_timeout 1d;
grpc_send_timeout 1d;
grpc_socket_keepalive on;
}
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/certs/ssl-cert-snakeoil.pem;
}Thank you!
. I am also using OpenVPN, but would like to improve the way I am using VPN. Basically, I want my homelab services (home automation, bitwarden to name the most important) to be accessible "on demand" without having to connect manually. Or in other words, as soon as I am connecting to something that ends with ".home" which is my local domain, this specific traffic should go through an IPSec tunnel. I think there is a name for this, but I am not sure. As far as I know this is not possible with openVPN, but I'd be happy to learn better.