I would like some sort of proxy that is available over the internet that can then route the requests to the apps using the subdomain of the url.
Example url: 12345-app.domain.com
I have added the certificates for domain.com and got the green ticks there.
Experimenting with a simple nginx app that I also host on fly:
server {
listen 443 ssl;
server_name ~^(?<container>[\w-]+)\.domain\.com$;
# These lines cause an issue!!!
ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
location / {
proxy_pass http://$container.internal/;
proxy_set_header X-Forwarded-Host $http_host;
}
}
The logs show that the certificates can’t be found but I can’t remove because nginx will complain about missing certificates.
I’m also seeing this error but not sure how I can bind it to 0.0.0.0:
WARNING The app is not listening on the expected address and will not be reachable by fly-proxy. You can fix this by configuring your app to listen on the following addresses: 0.0.0.0:443
Where do the certification live after being created? Should I be copying them over using the Dockerfile somehow? Here is my very basic Dockerfile:
FROM nginx
COPY nginx.conf /etc/nginx/conf.d/nginx.conf
# Should I be copying the certs over here too?
Sorry, quite a lot to unpack but grateful for any suggestions.
You wouldn’t want to redirect from your nginx proxy back out to your public domain. Instead, you configure your DNS provider to proxy from 12345-app.domain.com to your nginx server, where it listens to the matching server_name and routes that request to one of your internal apps.
I don’t think I am proxying back out to the public domain???
Unfortunately, your approach wouldn’t be suitable for me as the number of subdomains could be in the 1000s so I need a flexible way to pass the request on.
Your approach would involve creating new dns records for each subdomain and a new map in the nginx block.
I don’t know about the rest of your setup, but the normal approach is to run nginx on port 80 without ssl or certificates, and let fly proxy handle that: Custom domains · Fly Docs
So finally managed to resolve this issue. I didn’t realise that Fly terminates the SSL connection before reaching the service so Nginx only needed to listen on port 80.
I did end up using flycast too so thanks for that @khuezy
Yes, my Nginx app is pointing to the .flycast domain of the actual app. I also tried to use the private ip6 address but still the same issue, working fine 99% of the time but sometimes that error shows up.