Differences

This shows you the differences between two versions of the page.

--- router:proxy_chain [2025/02/04 10:28] – willy
+++ router:proxy_chain [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-The idea is having TWO NGINX proxy linked by a WireGuard channel.
-==== External NGINX ====
-<file - nginx.conf>
-        server {
-                listen 4443 ssl; # to be changed later
-                location / {
-                        proxy_pass https://10.0.0.1:8443/; # put your WG tunnel address
-                }
-                ssl_certificate /etc/letsencrypt/live/home.mydomain.com/fullchain.pem;
-                ssl_certificate_key /etc/letsencrypt/live/home.mydomain.com/privkey.pem;
-                # add any more certs for other domains
-                include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-                ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
-    proxy_set_header   Host $host;
-    proxy_set_header   X-Real-IP $remote_addr;
-    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Host $server_name;
-    proxy_set_header X-Forwarded-Ssl on;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    proxy_http_version 1.1;
-        }
-</file>
-==== Certificates ====
-Needs to be shared between the internal server and the external server. You cannot use certbot on both, because ports 80&443 of external are redirected to the internal and certbot on external would not work.
-So, on internal zip che certs after any update, edit crontab like:
-<code>
-5 * * * /etc/letsencrypt/certbot-renew.sh && (cd /etc && tar cJf /home/user/certs-copy.tar.xy letsencrypt) &>> /root/certbot.log
-16 * * * /etc/letsencrypt/certbot-renew.sh && (cd /etc && tar cJf /home/user/certs-copy.tar.xy letsencrypt) &>> /root/certbot.log
-</code>
-On external, copy that file over and replace certs, again in crontab:
-<code>
-6 * * * sftp -P 5022 user@127.0.0.1:/home/user/certs-copy.tar.xy /root/certs-copy.tar.xy && cd /etc &&  tar xvf /root/certs-copy.tar.xy && chown root:root -R letsencrypt && /etc/init.d/nginx restart
-16 * * * sftp -P 5022 user@127.0.0.1:/home/user/certs-copy.tar.xy /root/certs-copy.tar.xy && cd /etc &&  tar xvf /root/certs-copy.tar.xy && chown root:root -R letsencrypt && /etc/init.d/nginx restart
-</code>
-Of course, add the external root SSH public key to user file /home/use/.ssh/authorized_keys for passwordless access.

Willy's Wiki

User Tools

Differences