Setting up Nginx as a reverse proxy

As an alternative to Apache, you can run Nginx as a reverse proxy in front of teamspace under Linux. Nginx receives the requests on port 80/443, terminates the SSL certificate and forwards them to the Tomcat (127.0.0.1:8080).

Linux only: This variant is intended exclusively for Linux installations.

Installation & configuration

Install Nginx:

apt install nginx

Navigate to /etc/nginx/sites-available and create the file projectfacts there. Enter the following example configuration and adjust placeholders such as [IP address], URL and the certificate paths:

server {
    listen [IP address]:80;
    server_name [Domain_URL];
    return 301 https://$host$request_uri;
}

server {
    listen [IP address]:443 ssl http2;
    index index.html index.php;
    server_name URL;

    gzip on;
    error_log /var/log/nginx/URL_httpd_error_log;
    access_log /var/log/nginx/URL_httpd_access_log combined;

    ssl_certificate /etc/letsencrypt/live/URL/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/URL/privkey.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_dhparam /etc/nginx/ssl/dhparam;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    add_header Strict-Transport-Security "max-age=63072000" always;

    ssl_stapling on;
    ssl_stapling_verify on;

    location /.well-known/acme-challenge/ {
        proxy_pass http://127.0.0.1:8080/htdocs/.well-known/acme-challenge/;
    }

    location /ws/ {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:8080/ws/;
    }

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://127.0.0.1:8080/;
    }
}

Enable the site (symlink to sites-enabled) and restart the Nginx server.

Common problems

Why don’t the live updates (WebSockets) work? The location /ws/ block forwards the WebSocket connection to the Tomcat. Adopt it together with the Upgrade and Connection headers from the example configuration.

Why does the Let’s Encrypt renewal via the webroot fail? The ACME challenge has to be forwarded to the Tomcat. The location /.well-known/acme-challenge/ block forwards it to http://127.0.0.1:8080/htdocs/.well-known/acme-challenge/.

Common questions & needs

Related topics

• Setting up Apache as a reverse proxy Installation Configuration
• Installing teamspace on Linux Installation Configuration
• Installing teamspace with Docker Installation Configuration