<div dir="ltr"><div>Hi Sergey, Liam!</div><div><br></div><div>Thank you for your answers, they are really helpful!</div><div>I did not think of such kinds of solutions, they should both work fine for my use case.</div><div><br></div><div>Have a great day</div><div><br></div><div>Sébastien</div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Le mer. 23 avr. 2025 à 15:44, Liam Crilly via nginx <<a href="mailto:nginx@nginx.org">nginx@nginx.org</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Alternative approach would be to use error_page to catch the 5xx response (502 I think)<br>
when there are no available upstream servers and then, from a named location, proxy_pass<br>
with HTTPS to the same upstream group.<br>
<br>
Modifying the original sample config below.<br>
There is a blog post for similar use case here[1] but it is quite old ;)<br>
<br>
Cheers,<br>
Liam.<br>
<br>
[1] <a href="https://blog.nginx.org/blog/capturing-5xx-errors-debug-server" rel="noreferrer" target="_blank">https://blog.nginx.org/blog/capturing-5xx-errors-debug-server</a><br>
<br>
---<br>
<br>
upstream main_upstream {<br>
server <ip here>:80<br>
server <ip here>:80<br>
<etc><br>
}<br>
<br>
upstream secondary_upstream {<br>
server <ip here>:443<br>
server <ip here>:443<br>
<etc><br>
}<br>
<br>
location / {<br>
proxy_pass <a href="http://main_upstream" rel="noreferrer" target="_blank">http://main_upstream</a>;<br>
error_page 502 @try_secondary;<br>
<etc><br>
}<br>
<br>
location @try_secondary {<br>
proxy_pass <a href="https://secondary_upstream" rel="noreferrer" target="_blank">https://secondary_upstream</a>;<br>
<etc><br>
}<br>
<br>
________________________________________<br>
From: nginx <<a href="mailto:nginx-bounces@nginx.org" target="_blank">nginx-bounces@nginx.org</a>> on behalf of Sergey A. Osokin <<a href="mailto:osa@freebsd.org.ru" target="_blank">osa@freebsd.org.ru</a>><br>
Sent: 23 April 2025 14:26<br>
To: Sébastien Rebecchi <<a href="mailto:srebecchi@kameleoon.com" target="_blank">srebecchi@kameleoon.com</a>><br>
Cc: nginx mailing list <<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a>><br>
Subject: Re: use a secondary upstream as backup<br>
<br>
CAUTION: This email has been sent from an external source. Do not click links, open attachments, or provide sensitive business information unless you can verify the sender’s legitimacy.<br>
<br>
<br>
Hi Sébastien,<br>
hope you're doing well.<br>
<br>
Thanks for the question.<br>
<br>
On Wed, Apr 23, 2025 at 12:07:21PM +0200, Sébastien Rebecchi via nginx wrote:<br>
> backup, meaning NGINX will only use them if all primary servers fail.<br>
><br>
> In my case, I have some servers running over HTTP and would like to<br>
> configure HTTPS servers as backups. However, since an upstream can only use<br>
> one protocol, this setup isn't currently possible.<br>
<br>
[...]<br>
<br>
The solution you may help and you may want to try to implement is "double"<br>
proxy, where:<br>
- at first, nginx is proxy to the loopback upstream, i.e. to itself<br>
- on the second step nginx proxies from loopback to an original upstream<br>
<br>
So, the original upstream block will look like this:<br>
<br>
upstream insecure {<br>
server A.B.C.D:80; # http server<br>
server <a href="http://127.0.0.1:8999" rel="noreferrer" target="_blank">127.0.0.1:8999</a>;<br>
<br>
<other directives here><br>
}<br>
<br>
upstream secure {<br>
server E.F.G.H:443; # https<br>
<br>
<other directives here><br>
}<br>
<br>
<other servers here><br>
<br>
server {<br>
listen <a href="http://127.0.0.1:8999" rel="noreferrer" target="_blank">127.0.0.1:8999</a>;<br>
<br>
location / {<br>
proxy_pass <a href="https://secure" rel="noreferrer" target="_blank">https://secure</a>;<br>
<br>
<other directives here><br>
}<br>
}<br>
<br>
> Is there a feature like this planned, or one that could be considered for<br>
> future development?<br>
<br>
I don't think such feature is planned at the moment, just because all<br>
servers defined in the same upstream should be configured equally.<br>
<br>
Hope that helps.<br>
Thank you.<br>
<br>
--<br>
Sergey A. Osokin<br>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="https://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">https://mailman.nginx.org/mailman/listinfo/nginx</a><br>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="https://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">https://mailman.nginx.org/mailman/listinfo/nginx</a><br>
</blockquote></div></div>