通过NGINX代理保护WSS

我用的是OpenNebula。 当我尝试将流量代理到安全连接时，websocket的代理存在问题

我试过了

nginx.conf

map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}     

upstream sunstone {
    server 127.0.0.1:9869;
}

upstream websocketproxy {
    server 127.0.0.1:29876;
}

server {
    listen *:80;
    server_name example.com;
    rewrite ^(.*)$ https://example.com$1 permanent;
}

server {
    listen 443 ssl http2 deferred;
    ssl on;
    ssl_session_timeout 24h;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    access_log  /var/log/nginx/opennebula-sunstone-access.log;
    error_log  /var/log/nginx/opennebula-sunstone-error.log;

    client_max_body_size 1G;

    location / {
        proxy_pass http://sunstone;
        proxy_redirect     off;
        log_not_found      off;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   Host $http_host;
        proxy_set_header   X-Forwarded-FOR $proxy_add_x_forwarded_for;
    }

    location /websockify {
        proxy_pass http://websocketproxy;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

default_server.conf

map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}     

upstream sunstone {
    server 127.0.0.1:9869;
}

upstream websocketproxy {
    server 127.0.0.1:29876;
}

server {
    listen *:80;
    server_name example.com;
    rewrite ^(.*)$ https://example.com$1 permanent;
}

server {
    listen 443 ssl http2 deferred;
    ssl on;
    ssl_session_timeout 24h;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    access_log  /var/log/nginx/opennebula-sunstone-access.log;
    error_log  /var/log/nginx/opennebula-sunstone-error.log;

    client_max_body_size 1G;

    location / {
        proxy_pass http://sunstone;
        proxy_redirect     off;
        log_not_found      off;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   Host $http_host;
        proxy_set_header   X-Forwarded-FOR $proxy_add_x_forwarded_for;
    }

    location /websockify {
        proxy_pass http://websocketproxy;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

当我试图打开VNC控制台时，得到这些错误

Msg: noVNC ready: native WebSockets, canvas rendering
VM1479:37 WebSocket connection to 'wss://example.com:29876/?token=azy36gz3k4ibsuxsphwg' failed: Error in connection establishment: net::ERR_CONNECTION_RESET
WebSocket on-error event
WebSocket on-close event
Msg: Server disconnected (code: 1006)

在OpenNebula

sunstone server.conf

中设置下一个：

:vnc_proxy_port: 29876
:vnc_proxy_support_wss: yes
:vnc_proxy_cert: /etc/letsencrypt/live/example.com/fullchain.pem;
:vnc_proxy_key: /etc/letsencrypt/live/example.com/privkey.pem
:vnc_proxy_ipv6: false
:vnc_request_password: false

---

如何转发加密wss？

您找到解决方案了吗，我也有同样的问题！？是的，伙计）确保oneadmin用户可以访问您的证书文件夹。更改sunstone-server.conf后，您需要

chown-R oneadmin:oneadmin/etc/letsencrypt

停止opennebula sunstone服务，然后重新启动opennebula novnc并再次启动opennebula sunstone