Difference between socket- and port-based connection to outer NGINX?

Product Support Self-hosting
10

@tophee @Lutz, пожалуйста, дайте мне совет, спасибо.
У меня запущено 3 мульти-сайта, на каждом из них отключен HTTPS, и поверх хоста запущен nginx. Конфигурация nginx.conf выглядит так. URL возвращает ошибку 522.

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    lua_shared_dict ssl_certs_cache 1m;

    init_by_lua_block {
        -- Определить функцию для определения SNI-доменов, которые нужно
        -- автоматически обрабатывать и для которых регистрировать новые сертификаты.
        -- По умолчанию не разрешается ни один домен, поэтому это необходимо настроить.
        function allow_domain(domain)
            if domain:find("antivte.com$") then
                return true
            end
            return false
        end

        -- Инициализация экземпляра сервера бэкенд-сертификатов.
        cert_server = (require "resty.ssl-cert-server").new({
            backend = '127.0.0.1:8999',
            allow_domain = allow_domain
        })
    }

    # HTTPS-сервер
    server {
        listen 443 ssl;

        # Работает также с портом HTTPS, отличным от стандартного.
        listen 8443 ssl;

        server_name bbs.antivte.com;  # <--- измените это

        # Динамический обработчик для выдачи или возврата сертификатов для SNI-доменов.
        ssl_certificate_by_lua_block {
            cert_server:ssl_certificate()
        }

        # Резервный сертификат, требуемый nginx, допустим самоподписанный.
        # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
        #   -subj '/CN=sni-support-required-for-valid-ssl' \
        #   -keyout /etc/nginx/certs/fallback-self-signed.key \
        #   -out /etc/nginx/certs/fallback-self-signed.crt
        ssl_certificate /etc/nginx/certs/fallback-self-signed.crt;
        ssl_certificate_key /etc/nginx/certs/fallback-self-signed.key;


        location / {
                proxy_pass http://unix:/var/discourse/shared/bbs/nginx.http.sock:;
                proxy_set_header Host $http_host;
                proxy_http_version 1.1;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
        }
    }

    # HTTP-сервер
    server {
        listen 80;
        server_name bbs.antivte.com;  # <--- измените это
        return 301 https://$host$request_uri;

        # Конечная точка, используемая для проверки домена с Let's Encrypt.
        location /.well-known/acme-challenge/ {
            content_by_lua_block {
                cert_server:challenge_server()
            }
        }
    }


    # HTTPS-сервер
    server {
        listen 443 ssl;

        # Работает также с портом HTTPS, отличным от стандартного.
        listen 8443 ssl;

        server_name ytb.antivte.com;  # <--- измените это

        # Динамический обработчик для выдачи или возврата сертификатов для SNI-доменов.
        ssl_certificate_by_lua_block {
            cert_server:ssl_certificate()
        }

        # Резервный сертификат, требуемый nginx, допустим самоподписанный.
        # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
        #   -subj '/CN=sni-support-required-for-valid-ssl' \
        #   -keyout /etc/nginx/certs/fallback-self-signed.key \
        #   -out /etc/nginx/certs/fallback-self-signed.crt
        ssl_certificate /etc/nginx/certs/fallback-self-signed.crt;
        ssl_certificate_key /etc/nginx/certs/fallback-self-signed.key;

        location / {
                proxy_pass http://unix:/var/discourse/shared/ytb/nginx.http.sock:;
                proxy_set_header Host $http_host;
                proxy_http_version 1.1;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
        }        
    }

    # HTTP-сервер
    server {
        listen 80;
        server_name ytb.antivte.com;  # <--- измените это
        return 301 https://$host$request_uri;

        # Конечная точка, используемая для проверки домена с Let's Encrypt.
        location /.well-known/acme-challenge/ {
            content_by_lua_block {
                cert_server:challenge_server()
            }
        }
    }
 
    # HTTPS-сервер
    server {
        listen 443 ssl;

        # Работает также с портом HTTPS, отличным от стандартного.
        listen 8443 ssl;

        server_name cp.antivte.com;  # <--- измените это

        # Динамический обработчик для выдачи или возврата сертификатов для SNI-доменов.
        ssl_certificate_by_lua_block {
            cert_server:ssl_certificate()
        }

        # Резервный сертификат, требуемый nginx, допустим самоподписанный.
        # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
        #   -subj '/CN=sni-support-required-for-valid-ssl' \
        #   -keyout /etc/nginx/certs/fallback-self-signed.key \
        #   -out /etc/nginx/certs/fallback-self-signed.crt
        ssl_certificate /etc/nginx/certs/fallback-self-signed.crt;
        ssl_certificate_key /etc/nginx/certs/fallback-self-signed.key;

        location / {
                proxy_pass http://unix:/var/discourse/shared/cp/nginx.http.sock:;
                proxy_set_header Host $http_host;
                proxy_http_version 1.1;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
        }
    }

    # HTTP-сервер
    server {
        listen 80;
        server_name cp.antivte.com;  # <--- измените это
        return 301 https://$host$request_uri;

        # Конечная точка, используемая для проверки домена с Let's Encrypt.
        location /.well-known/acme-challenge/ {
            content_by_lua_block {
                cert_server:challenge_server()
            }
        }
    }   
}

А этот вариант работает корректно:

root@docker-s-1vcpu-2gb-sgp1-01:/var/discourse# curl --unix-socket /var/discourse/shared/bbs/nginx.http.sock http:/images/json<!DOCTYPE html>
<html lang="en-US">
<head>
  <meta charset="utf-8">
  <title>Discourse</title>
  <meta name="description" content="">
  <meta name="generator" content="Discourse 2.4.0.beta9 - https://github.com/discourse/discourse version 86fb08d04a841b1967e2bb5ec879a07dc6210eee">
<link rel="icon" type="image/png" href="http://bbs.antivte.com/uploads/default/optimized/1X/_129430568242d1b7f853bb13ebea28b3f6af4e7_2_32x32.png">
<link rel="apple-touch-icon" type="image/png" href="http://bbs.antivte.com/uploads/default/optimized/1X/_129430568242d1b7f853bb13ebea28b3f6af4e7_2_180x180.png">
<meta name="theme-color" content="#ffffff">
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, user-scalable=yes, viewport-fit=cover">

<script type="application/ld+json">{"@context":"http://schema.org","@type":"WebSite","url":"http://bbs.antivte.com","potentialAction":{"@type":"SearchAction","target":"http://bbs.antivte.com/search?q={search_term_string}","query-input":"required name=search_term_string"}}</script>
<link rel="search" type="application/opensearchdescription+xml" href="http://bbs.antivte.com/opensearch.xml" title="Discourse Search">

    <link href="/stylesheets/desktop_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="desktop" data-theme-id="2"/>


  <link href="/stylesheets/desktop_theme_2_1dbc8b6a9b9bc0ce8633dbac246d040d6b9e3f6d.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="2"/>

  <link href="/stylesheets/discourse-details_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="discourse-details" data-theme-id="2"/>
  
  
  <link href="/stylesheets/discourse-local-dates_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="discourse-local-dates" data-theme-id="2"/>
  
  <link href="/stylesheets/discourse-presence_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="discourse-presence" data-theme-id="2"/>
  
  <link href="/stylesheets/lazy-yt_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="lazy-yt" data-theme-id="2"/>
  
  <link href="/stylesheets/poll_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="poll" data-theme-id="2"/>
  
  <link href="/stylesheets/poll_desktop_cf66a5b18273cc17f4c0a96847c93ecda0519dc8.css?__ws=bbs.antivte.com" media="all" rel="stylesheet" data-target="poll_desktop" data-theme-id="2"/>

  

  
  
  
</head>
<body >
  
  
  <section id='main'>
    
  <header class="d-header">
    <div class="wrap">
      <div class="contents">
        <div class="header-row">
          <div class="logo-wrapper">
            <a href="/">
                <img src="http://bbs.antivte.com/images/discourse-logo-sketch.png" alt="Discourse" id="site-logo">
            </a>
          </div>
            <div class='auth-buttons'>
                <a href="/signup" class='btn btn-primary btn-small signup-button'>Sign Up</a>
              <a href="/login" class='btn btn-primary btn-small login-button btn-icon-text'><svg class="fa d-icon svg-icon svg-node" aria-hidden="true"><svg id="user" viewBox="0 0 448 512">
    <path d="M224 256c70.7 0 128-57.3 128-128S294.7 0 224 0 96 57.3 96 128s57.3 128 128 128zm89.6 32h-16.7c-22.2 10.2-46.9 16-72.9 16s-50.6-5.8-72.9-16h-16.7C60.2 288 0 348.2 0 422.4V464c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48v-41.6c0-74.2-60.2-134.4-134.4-134.4z"/>
  </svg></svg>
Log In</a>
            </div>
        </div>
      </div>
    </div>
  </header>

    <div id="main-outlet" class="wrap not-found-container">
      <div class="page-not-found">
  <h1 class="title">Oops! That page doesn’t exist or is private.</h1>

</div>



<div class="row page-not-found-topics">
  <div class="popular-topics">
    <h2 class="popular-topics-title">Popular</h2>
    <a href="/top" class="btn btn-default">More&hellip;</a>
  </div>
  <div class="recent-topics">
    <h2 class="recent-topics-title">Recent</h2>
      <div class='not-found-topic'>
        <a href="/t/welcome-to-discourse/7">Welcome to Discourse</a>
      </div>
    <a href="/latest" class="btn btn-default">More&hellip;</a>
  </div>
</div>


  <div class="row">
    <div class="page-not-found-search">
      <h2>Search this site</h2>
      <p>
        <form action='/search' id='discourse-search'>
          <input type="text" name="q" value="">
          <button class="btn btn-primary">Search</button>
        </form>
      </p>
    </div>
  </div>

  <link rel="preload" href="/assets/onpopstate-handler-09bc9d995084d732c7f6dfaadcd21404e817fc736165b7b893bc2dd040749aae.js" as="script">
<script src="/assets/onpopstate-handler-09bc9d995084d732c7f6dfaadcd21404e817fc736165b7b893bc2dd040749aae.js"></script>


    </div>
  </section>
  
  
  
  
</body>
</html>
root@docker-s-1vcpu-2gb-sgp1-01:/var/discourse#