We use nginx as reverse proxy in front of our Ignition gateway. This has two reasons:
- We want to use port 80 respectively 443 to access Ignition.
- We want to run the Ignition gateway not as root user but instead with a normal user (better security) on our linux host. This is not possible with port 80 or 443.
Our current nginx configuration (for port 80) looks like the following:
upstream ignition_http {
keepalive 20;
server 127.0.0.1:8088;
}
server {
listen 80;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_pass http://ignition_http;
}
}
The configuration works fine and if I start a vision client or a designer it communicates without any errors with the Ignition server.
The problem is, that requests from remote clients are shown on the gateway as local requests.
As you can see on the image above, the jetty webserver of Ignition interprets the request as coming from localhost. This is because of the nginx reverse proxy configuration. Unfortunately jetty does not make use of the X-Forwarded http headers of nginx (see jetty configuration above).
Ignition security settings like Security Zones based on ip addresses will not work!
According to the following resources an option has to be set in the jetty server:
- linux - Proxying from nginx to Jetty - Server Fault
- nginx - https to http reverse proxy on Jetty 9 - Server Fault
The option useForwardedForHeader has to be set to true.
How can I adjust the internal jetty configuration of Ignition?
I guess that the file /usr/local/bin/ignition/webserver/webdefault.xml is not the right config file, since this is only used to configure settings for jetty web applications but not the server itself.
Any help would be greatly appreciated.