nginx, access to other servers on internal network - docker

Question

I have a docker network running with this configuration (from docker-compose.yaml):
networks:
network:
driver: bridge
ipam:
driver: default
config:
- subnet: 172.28.1.0/24
(My network is named network)
I have an Angular frontend running in a container on this network (172.28.1.4). The frontend web server is an nginx server.
From the web server I would like calls to various backends (authentication and database) to go directly to these servers without exposing them to the outside world.
I.e to authenticate a user, something like this: httpClient.post('172.28.1.5:8080/_user/login', credentials)
I believe this should be done in the nginx configuration, but I am pretty clueless on how to allow access to 172.28.1.5 from nginx without exposing 172.28.1.5
The servers are visible to each other seen from a Docker perspective
I have tried using a reverse proxy and that works, but I cannot block access to the location from external ips
location ~/_user(/.*)*/?$ {
proxy_pass http://auth_server:8080; //auth_server points to 172.28.1.5
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
The proxy setup. I have changed the names of the servers to clarify their role in the network.
The frontend can call the database_server like this:
http://external.ip.address:443/_api/any_path
Unfortunately, so can anyone else :)
server {
listen 443;
server_name localhost;
location ~/_user(/.*)*/?$ {
proxy_pass http://authentication_server:8080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
location ~/_api(/.*)*/?$ {
proxy_pass http://database_server:80;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
location ~/ {
proxy_pass http://ui_frontend_server:8080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
My docker setup makes this possible as it maps the name "authentication_server" with 172.28.1.3
authentication_server_service:
container_name: authentication_server
build: ../authentication_server/
image: authentication_server_image:latest
networks:
network:
ipv4_address: 172.28.1.3