reverse proxy and nested locations

[Maxim Dounin]

Hello!

On Mon, Oct 07, 2013 at 10:31:15PM +0200, Wolfgang Hennerbichler wrote:

> Hi list, 
> 
> I'd like to have an elegant reverse proxy configuration, where I 
> allow specific sub-URIs behind the reverse-proxy-URL for 
> specific IP Adresses. My intended configuration looks like this:  
> 
>   # TRAC
>   location /trac {
>     proxy_pass https://my.web.server:443/trac/;
>     location /trac/project {
>       allow 10.32.1.146;
>       allow 10.64.0.6;
>       deny all;
>     }   
>   }
> 
> However, the location /trac/project does not inherit the 
> proxy-pass directive. It works if I add 'proxy_pass 
> https://my.web.server:443/trac/;' in the location /trac/project. 
> This is redundant and I don't like that. 

The idea is that a request handler (proxy_pass in your case) is 
always explicitly set for a location.  Hence handlers are not 
inherited.

If you want to drop something redundant, than I would recommend to 
drop an URI part in proxy_pass intead.  Something like this should 
do what you need:

    location /trac/ {
        proxy_pass https://my.web.server;
    }

    location /trac/project/ {
        proxy_pass https://my.web.server;
        allow ...
        deny all;
    }

-- 
Maxim Dounin
http://nginx.org/en/donation.html