Dockerized reverse proxy - docker

Question

I'm planning on hosting three websites on a single host, lets call it raspi-dev:
home.redacted.ca, brew.redacted.ca, www.redacted.ca (or redacted.ca)
To enable this, I'm working with a container which is accepting incoming connections on port 80. Here's a snippet of the reverse proxy config:
server {
server_name brew.redacted.ca;
listen 80;
location / {
proxy_pass http://brewweb;
}
}
brewweb being a container named brewweb. The communication works so far. When navigating to http://brew.redacted.ca, I get exactly what I expect:
"GET / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Firefox/60.0" "-"
The point is to redirect traffic to https. Here's the code from the other webserver:
server {
listen 80;
server_name brew.redacted.ca;
return 301 https://brew.redacted.ca$request_uri;
}
server {
server_name brew.redacted.ca;
root /var/www/brew;
listen 443 ssl;
location / {
try_files $uri $uri/ /index.html =404;
}
ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
}
So it works as intended. You go to http://brew.redacted.ca and it tells you to come back on port 443. However, in the browser, I get a dead link: "Unable to Connect". My assumption right now is that it's because my reverse proxy, which is the only container listening on the host network, can't receive and then forward on the future 443 requests. I'm at a bit of a loss on how to handle this though.. do I get a cert for the reverse proxy??? How would I even do that since it's not even serving up any content itself..
I'm open to all suggestions.

Answer 1

It is your proxy that needs to speak securely to clients, not the hosted applications. I do this on my internal network. I have a docker host running a couple of different developer tools behind a single Nginx reverse proxy.
All SSL/TLS is handled by the proxy server. The web servers that actually serve up the applications are in docker containers only visible to the Nginx proxy container. They communicate with the proxy via http not https.
I'm using a wildcard certificate issued for my main server *.app.co that has SA entries for www.app.co, utility.app.co and another.app.co
Nginx proxy server configuration actually ends up looking something like this:
ssl_certificate redacted.pem
ssl_certificate_key redacted.key
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
server {
listen 80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
server {
listen 443;
server_name www.app.co;
proxy_pass http://www-container
...
}
server {
listen 443 default_server;
server_name www.app.co;
proxy_pass http://www-container
...
}
server {
listen 443;
server_name another.app.co;
proxy_pass http://another-container
...
}