Hello!

On Thu, Dec 05, 2019 at 06:51:17AM -0500, lucaprete wrote:

> I'm using nginx in form of container (docker.io/nginx), version
> 1.17.3-alpine
> I'm trying to setup my nginx to do TLS auth and then forward packets to
> another host in the network.
> As part of this I also have to support some probes that continuously monitor
> a secondary location, same server, same port.
>
> This is my configuration
>
> ```
> server {
> listen 443 ssl;
> server_name mydomain.com;
>
> ssl_certificate /etc/nginx/certs/tls.crt;
> ssl_certificate_key /etc/nginx/certs/tls.key;
>
> ssl_client_certificate /etc/nginx/ca_certs/ca.crt;
> ssl_verify_client optional;
> ssl_verify_depth 2;
>
> location = /healthz {
> return 200 'the app is alive!';
> }
>
> location = / {
> if ($ssl_client_verify != SUCCESS) {
> return 403;
> }
>
> proxy_pass http://other-host:8080;
> proxy_set_header Host $host;
> proxy_set_header X-Real-IP $remote_addr;
> proxy_set_header SSL_Client $ssl_client_s_dn;
> proxy_set_header SSL_Client_Verify $ssl_client_verify;
> }
> }
> ```
>
> First of all, as soon as I load the configuration I get the following
> error:
>
> ```
> 2019/12/05 10:22:35 [emerg] 1#1: invalid condition "!=" in
> /etc/nginx/conf.d/mydomain.conf:36
> nginx: [emerg] invalid condition "!=" in /etc/nginx/conf.d/mydomain.conf:36
> ```
>
> I find this if directive on any possible tutorial. I'm really not sure
> what's wrong here...
>
> Also, even if I remove the if clause (just to see if otherwise it would
> work) I get another error:
>
> ```
> 2019/12/05 11:10:20 [emerg] 1#1: invalid number of arguments in
> "proxy_set_header" directive in /etc/nginx/conf.d/mydomain.conf:41
> nginx: [emerg] invalid number of arguments in "proxy_set_header" directive
> in /etc/nginx/conf.d/mydomain.conf:41
> ```

It looks like the configuration you are trying to put is passed
through shell variable expansion, resulting in a completely broken
configuration as seen by nginx. That is,

> if ($ssl_client_verify != SUCCESS) {

becomes

if ( != SUCCESS) {

which would result in the error message you see, and

> proxy_set_header Host $host;

results in

proxy_set_header Host ;

which obviously have invalid number of aguments. You have to find
where the configuration is broken and fix it.

[...]

> Sorry if I posted in the same thread three different issues... I just
> thought it would have made sense to post them together.

Sure. Clearly this is just one issue with configuration
deployment.

--
Maxim Dounin
http://mdounin.ru/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx