Question

Can't Create Reverse Proxy from Droplet to App Platform

I am unable to setup a reverse proxy from my nginx docker container in a droplet to the URL generated from the App platform.

I’m able to ping https://foo-bar-doo24.ondigitalocean.app/ from the browser, from the droplet and inside the container using bin/sh but when I test the proxy I see these errors in the log file: #20: *4 connect() to [###:####:##::##]:443 failed (101: Network unreachable) while connecting to upstream - 403 error #20: *4 upstream server temporarily disabled while connecting to upstream, - 421 error

And on the client side I’m receiving a CORS error: https://foo.com/' from origin 'https://foo.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

This is what my nginx config file looks like:

server {
  listen 443 ssl;
  http2 on;

  server_name foo.com;

  ssl_certificate /etc/ssl/cert.pem;
  ssl_certificate_key /etc/ssl/key.pem;
  ssl_client_certificate /etc/ssl/ssl.crt;
  ssl_verify_client on;

  ssl_buffer_size 8k;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;

  location / {
    proxy_pass https://foo-bar-doo24.ondigitalocean.app/;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Proto https;

    proxy_buffer_size 16k;
    proxy_buffers 4 32k;
    proxy_busy_buffers_size 64k;

    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    send_timeout 60s;
  }
}

If anyone could shed some light on what I’m doing wrong it would be immensely helpful! Thank you!


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby Iliev
Site Moderator
Site Moderator badge
July 1, 2024

Hi there,

I’ve seen a similar question in the past regarding the same issue, here is the discussion that covers some of the blockers that you might hit along the way:

https://www.digitalocean.com/community/questions/nginx-proxy-server-to-app-platform-app-is-getting-a-403-access-denied-cloudflare-error

One of the users reported the following:

Instead of setting the Host header I simply just added a new custom header X-Host and set it to $host. This gets passed properly to my API running in a docker container.

Let me know how it goes!

Bobby

KFSys
Site Moderator
Site Moderator badge
July 1, 2024

Heya,

Are you sure that’s the exact link you need to configure? Opening it up on my end it seems to be dead.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Become a contributor for community

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

DigitalOcean Documentation

Full documentation for every DigitalOcean product.

Resources for startups and SMBs

The Wave has everything you need to know about building a business, from raising funding to marketing your product.

Get our newsletter

Stay up to date by signing up for DigitalOcean’s Infrastructure as a Newsletter.

New accounts only. By submitting your email you agree to our Privacy Policy

The developer cloud

Scale up as you grow — whether you're running one virtual machine or ten thousand.

Get started for free

Sign up and get $200 in credit for your first 60 days with DigitalOcean.*

*This promotional offer applies to new accounts only.