NGINX detailed configuration

[park0kyung0won]

Hi
I really like OPNSense and I'm using NGINX for reverse proxy
But I can't find how to set options like headers
Adding few lines of custom options in locations field would be good enough
Do you have any plans to add that?

[fabian]

But I can't find how to set options like headers

security headers like content security policy etc. are all in the security headers section and can be assigned to the location.
Other headers are currently not supported (which one are missing because most other headers can be usually set by the application itself?)

Adding few lines of custom options in locations field would be good enough
Do you have any plans to add that?

Definitely no because it can easily break the configuration which may be a huge issue if also the web interface runs on the affected nginx instance.

[park0kyung0won]

How about proxy headers like X-Forwarded-For ?
Some applications behind proxy need that

Can I manually set /etc/nginx/nginx.conf file by ssh login into OPNSense?

[fabian]

How about proxy headers like X-Forwarded-For ?

Should already exist:

https://github.com/opnsense/plugins/blob/master/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf#L98

Some applications behind proxy need that

I know. This is why I have hardcoded in for all proxy upstreams to add it automatically. Is it missing or does something not work? If yes, that's a bug.

Can I manually set /etc/nginx/nginx.conf file by ssh login into OPNSense?

Beside that this file should not exist - the plugin will overwrite it as soon as you change something in the GUI.

[park0kyung0won]

I faced this problem while setting up Openstack noVNC

https://ask.openstack.org/en/question/12606/front-nova-novncproxy-with-nginx/

All these necessary options are already there?

[fabian]

Almost all are automatically added, the only one which has to be manually added is the upgrade. This one can be enabled via a special checkbox for websockets.

See:
https://github.com/opnsense/plugins/blob/master/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf#L96-L99
https://github.com/opnsense/plugins/blob/master/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf#L95-L99

[fabian]

I have looked into it, there is a bug which I've fixed and it is now in review:
https://github.com/opnsense/plugins/pull/925

you can patch it using opnsense-patch -c plugins dcfcd41

[park0kyung0won]

I have looked into it, there is a bug which I've fixed and it is now in review:
https://github.com/opnsense/plugins/pull/925

you can patch it using opnsense-patch -c plugins dcfcd41

Thank you very much
Is this patch merged into production branch?
And from where can I check websocket option?

[fabian]

Is this patch merged into production branch?

not yet, this usually happens before the release is built but it will very likely be in the next release.

And from where can I check websocket option?

Should be in the location configuration.

[bled82]

I don't see the websocket option in location was this ever resolved ?

[fabian]

it's advanced

[bled82]

Thanks.

FYI everyone advanced didn't show for me until I toggled advanced on the Global HTTP Settings tab , might have just been cache but now I see websocket.

Still unable to access novnc over nginx , getting the following errors anyone able to assist ?

[fabian]

This error means your upstream does not serve the web socket (it may not be deployed). Try to check your server config as it does not get a response from the upstream.

[bled82]

upstream works fine when going to server url directly , only failing when using nginx plugin .

[bled82]

@Fabian sorry I had misunderstood what you meant I was able to re-configure my app/service and now websocket works and performance is much better thank you for all your work/help !