PowerVC

Proxying PowerVC with NGINX

By Archive User posted Fri March 30, 2018 02:12 PM

  
Have you ever struggled to give your end users access to the PowerVC UI, but don't want to give them real access to the PowerVC host? For example, I've seen a few scenarios recently where we want to make PowerVC UI publicly available, but still need PowerVC itself sitting on an internal private network with connections to the private management infrastructure. There are a number of ways you can go about doing this with port forwarding, iptables rules, etc. But perhaps the easiest way to do this is to set up a very simple light-weight HTTP proxy with NGINX.

Scenario:




User ---> NGINX Proxy Server
Public IP X.X.X.9
Private IP 10.0.0.9 --> PowerVC Server
Private IP 10.0.0.10




  • ONLY http/s traffic is forwarded. The user cannot access the Private IP of PowerVC directly.

  • This supports both the Web UI as well as PowerVC/Openstack APIs

  • PowerVC behaves as if traffic was coming directly from the proxy server, and not from the end user (although that information is included in the headers for logging).



Instructions:




  1. Install nginx. On Ubuntu/Debian, simply run: sudo apt install nginx. On Redhat, run: sudo yum install nginx

  2. nginx should start automatically. If not, run: sudo systemctl start nginx

  3. Remove the default config file: sudo rm /etc/nginx/sites-enabled/default

  4. Install ssl-cert. This will allow automatic generation of self-signed ssl certificates: sudo apt install ssl-cert or sudo yum install ssl-cert.

  5. Add the following configuration file, modifying the 10.0.0.10 IP address to match that of your PowerVC server (paste this entire entry into a bash shell):



sudo cat > /etc/nginx/sites-enabled/pvc << EOM
include snippets/snakeoil.conf;

server { # http
server_name nginx-1-vm;
listen *:80;

location / {
return 302 https://$host$request_uri;
}
}

server { # https
server_name nginx-1-vm;
listen *:443 ssl; # Web UI
listen *:5000 ssl; # API - keystone
listen *:8041 ssl; # API - gnocchi
listen *:8428 ssl; # API - validator
listen *:8774 ssl; # API - nova
listen *:8778 ssl; # API - panko
listen *:9000 ssl; # API - cinder
listen *:9292 ssl; # API - glance
listen *:9696 ssl; # API - neutron
listen *:35357 ssl; # API - keystone

location / {
proxy_pass $scheme://10.0.0.10:$server_port;
proxy_request_buffering off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header Origin $scheme://$host;
proxy_set_header Accept-Encoding "";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 330;
}
}
EOM


Finally, restart nginx (sudo systemctl restart nginx), and point your web browser to http://X.X.X.9 and you should see the PowerVC GUI.

Now for some explanation...



SSL Certificates: We're letting the system autogenerate self-signed certificates. These are the certificates for the nginx web server. You can create your own (just look at the content of snippits/snakeoil.conf for info.)

HTTP: You'll notice that we are listening on port 80. Every inbound request on port 80 gets a 302 response (redirect) to https (443) with the same URL. This just makes it easy to forward any http requests to https. You can turn this off if you don't want http->https redirect.

HTTPS:

  • All traffic will get forwarded to the proxy_pass address. Make sure you modify this address to match the address of your PowerVC server.

  • The server listens on multiple ports - 443 provides web UI access, and the others provide API access. If you do not want API access, just remove the listen clauses for the API ports.
  • The upgrade items are there to ensure the browser can 'upgrade' the connection from https to wss (websockets). Websockets are used by PowerVC to provide the console for the user. Note that wss is still going over port 443. It's just a different protocol.

  • The proxy_read_timeout is set high because PowerVC queries for event changes and waits up to 5 minutes for a response, so we don't want the proxy server timing out.
  • The other items all allow PowerVC to not have to worry that the client is remote.




You can find lots more information about these settings in the NGINX documentation:
http://nginx.org/en/docs/http/ngx_http_proxy_module.html

Enjoy providing your users access to the PowerVC UI without giving them access to the management network!



#privatecloud
#security
0 comments
3 views

Permalink