1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
# Netdata via nginx
To pass Netdata via a nginx, use this:
### As a virtual host
```
upstream backend {
# the Netdata server
server 127.0.0.1:19999;
keepalive 64;
}
server {
# nginx listens to this
listen 80;
# the virtual host name of this
server_name netdata.example.com;
location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://backend;
proxy_http_version 1.1;
proxy_pass_request_headers on;
proxy_set_header Connection "keep-alive";
proxy_store off;
}
}
```
### As a subfolder to an existing virtual host
```
upstream netdata {
server 127.0.0.1:19999;
keepalive 64;
}
server {
listen 80;
# the virtual host name of this subfolder should be exposed
#server_name netdata.example.com;
location = /netdata {
return 301 /netdata/;
}
location ~ /netdata/(?<ndpath>.*) {
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_pass_request_headers on;
proxy_set_header Connection "keep-alive";
proxy_store off;
proxy_pass http://netdata/$ndpath$is_args$args;
gzip on;
gzip_proxied any;
gzip_types *;
}
}
```
### As a subfolder for multiple Netdata servers, via one nginx
```
upstream backend-server1 {
server 10.1.1.103:19999;
keepalive 64;
}
upstream backend-server2 {
server 10.1.1.104:19999;
keepalive 64;
}
server {
listen 80;
# the virtual host name of this subfolder should be exposed
#server_name netdata.example.com;
location ~ /netdata/(?<behost>.*)/(?<ndpath>.*) {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_pass_request_headers on;
proxy_set_header Connection "keep-alive";
proxy_store off;
proxy_pass http://backend-$behost/$ndpath$is_args$args;
gzip on;
gzip_proxied any;
gzip_types *;
}
# make sure there is a trailing slash at the browser
# or the URLs will be wrong
location ~ /netdata/(?<behost>.*) {
return 301 /netdata/$behost/;
}
}
```
Of course you can add as many backend servers as you like.
Using the above, you access Netdata on the backend servers, like this:
- `http://nginx.server/netdata/server1/` to reach `backend-server1`
- `http://nginx.server/netdata/server2/` to reach `backend-server2`
### Using TLS communication
In case the Netdata web server has been [configured to use TLS](../web/server/#enabling-tls-support),
you must also encrypt the communication between Nginx and Netdata.
To enable encryption, first [enable SSL on nginx](http://nginx.org/en/docs/http/configuring_https_servers.html) and then put the following in the location section of the Nginx configuration:
```
proxy_set_header X-Forwarded-Proto https;
proxy_pass https://localhost:19999;
```
If nginx is not configured as described here, you will probably receive the error `SSL_ERROR_RX_RECORD_TOO_LONG`.
### Enable authentication
Create an authentication file to enable the nginx basic authentication.
Do not use authentication without SSL/TLS!
If you haven't one you can do the following:
```
printf "yourusername:$(openssl passwd -apr1)" > /etc/nginx/passwords
```
And enable the authentication inside your server directive:
```
server {
# ...
auth_basic "Protected";
auth_basic_user_file passwords;
# ...
}
```
## limit direct access to Netdata
If your nginx is on `localhost`, you can use this to protect your Netdata:
```
[web]
bind to = 127.0.0.1 ::1
```
---
You can also use a unix domain socket. This will also provide a faster route between nginx and Netdata:
```
[web]
bind to = unix:/tmp/netdata.sock
```
_note: Netdata v1.8+ support unix domain sockets_
At the nginx side, use something like this to use the same unix domain socket:
```
upstream backend {
server unix:/tmp/netdata.sock;
keepalive 64;
}
```
---
If your nginx server is not on localhost, you can set:
```
[web]
bind to = *
allow connections from = IP_OF_NGINX_SERVER
```
_note: Netdata v1.9+ support `allow connections from`_
`allow connections from` accepts [Netdata simple patterns](../libnetdata/simple_pattern/) to match against the connection IP address.
## prevent the double access.log
nginx logs accesses and Netdata logs them too. You can prevent Netdata from generating its access log, by setting this in `/etc/netdata/netdata.conf`:
```
[global]
access log = none
```
## SELinux
If you get an 502 Bad Gateway error you might check your nginx error log:
```sh
# cat /var/log/nginx/error.log:
2016/09/09 12:34:05 [crit] 5731#5731: *1 connect() to 127.0.0.1:19999 failed (13: Permission denied) while connecting to upstream, client: 1.2.3.4, server: netdata.example.com, request: "GET / HTTP/2.0", upstream: "http://127.0.0.1:19999/", host: "netdata.example.com"
```
If you see something like the above, chances are high that SELinux prevents nginx from connecting to the backend server. To fix that, just use this policy: `setsebool -P httpd_can_network_connect true`.
[]()
|
