Khai NguyenSoftware engineer, web and mobile. This is just the start of my journey.

Blogs / 8-12 minutes read

Khai Phuoc Nguyen (Jack)· nginx, docker, aws, aws ec2

Using Nginx with Docker for Reverse Proxying Services on an EC2 Instance

Prerequisites

  • An AWS EC2 instance running a supported Linux distribution (e.g., Ubuntu, CentOS).
  • Docker and Docker Compose installed on your EC2 instance.
  • A registered domain name pointing to the public IP address of your EC2 instance.
  • SSL certificates obtained from Let’s Encrpty (or any other certificate authority).

Step 1: Secure Your EC2 Instance

Before proceeding, ensure your EC2 instance is secured:

  • Update your system with the latest security patches.
  • Configure the Security Group to allow only necessary ports (80 for HTTP, 443 for HTTPS, and 22 for SSH).
  • Set up a firewall (like ufw for Ubuntu) to manage access to different services.

Step 2: Create a Docker Network

docker network create your-network-name

This network enables container-to-container communication within Docker.

Step 3: Prepare Configuration Files

Create a directory for Nginx and Docker Compose configuration:

mkdir nginx-docker && cd nginx-docker
touch nginx.conf docker-compose.yml

Step 4: Configure Docker Compose

Here’s a modified docker-compose.yml suitable for an EC2 setup:

version: "3.8"
services:
  nginx:
    image: nginx
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - /etc/letsencrypt:/etc/letsencrypt
    restart: unless-stopped
    networks:
      - anetwork

networks:
  anetwork:
    name: your-network-name
    driver: bridge

This configuration will start Nginx and expose it on the standard web ports.

Step 5: Set Up Nginx Configuration

Your nginx.conf should be similar to the original guide but ensure it’s adapted for services running on your EC2 or other Docker containers:

events {}

http {
    server {
        listen 80;
        server_name subdomain-1.example.com subdomain-2.example.com subdomain-3.example.com;
        return 301 https://$server_name$request_uri;
    }

    server {
        listen 443 ssl;
        server_name subdomain-1.example.com;
        ssl_certificate /etc/letsencrypt/live/subdomain-1.example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/subdomain-1.example.com/privkey.pem;

        location / {
            proxy_pass http://app:8080;
            proxy_set_header Host $host;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_cache_bypass $http_upgrade;
            proxy_http_version 1.1;
        }
    }

    server {
        listen 443 ssl;
        server_name subdomain-2.example.com;
        ssl_certificate /etc/letsencrypt/live/subdomain-2.example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/subdomain-2.example.com/privkey.pem;

        location / {
            proxy_pass http://api:3001;
            proxy_set_header Host $host;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_cache_bypass $http_upgrade;
            proxy_http_version 1.1;
        }
    }

    server {
        listen 443 ssl;
        server_name subdomain-3.example.com;
        ssl_certificate /etc/letsencrypt/live/subdomain-3.example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/subdomain-3.example.com/privkey.pem;

        location / {
            proxy_pass http://localhost:3030;
            proxy_set_header Host $host;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_cache_bypass $http_upgrade;
            proxy_http_version 1.1;
        }
    }
}

Step 6: Start the Services

Deploy your containers:

docker-compose up -d

Step 7: Test the Setup

Ensure that your services are correctly set up by visiting your domain names in a browser. This will test SSL setup and reverse proxy functionality.

Step 8: Renew SSL Certificates

To handle SSL certificate renewal:

docker run --rm -v /etc/letsencrypt:/etc/letsencrypt certbot/certbot renew --dry-run

Consider setting up a cron job on the host to automate this process.

Additional Tips for Scaling and Maintenance

  • Monitoring: Set up monitoring tools like Prometheus or cAdvisor to monitor the health and performance of your Docker containers.
  • Logging: Configure centralized logging using tools like ELK Stack or Fluentd to manage logs from multiple containers.
  • Scaling: Consider using Docker Swarm or Kubernetes if scaling beyond a single instance is needed.

By following this guide, you can deploy Nginx as a reverse proxy within a Docker setup on an EC2 instance, ensuring efficient management of traffic and enhanced security for your web applications.

Open original