github.com
/
distribution
mirror of https://github.com/distribution/distribution
1
0
Fork 0
Code Releases Wiki Activity

Add exemple proxy mistake whith nginx sitting behind an ELB 

closes #970

Signed-off-by: Louis Kottmann <louis.kottmann@gmail.com>
This commit is contained in:
Louis Kottmann 2015-09-14 17:35:01 +02:00
parent b0e94fb154
commit 4075e2bb3d
1 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/nginx.md
View File

@ -31,7 +31,25 @@ We also implement push restriction (to a limited user group) for the sake of the
While this model gives you the ability to use whatever authentication backend you want through the secondary authentication mechanism implemented inside your proxy, it also requires that you move TLS termination from the Registry to the proxy itself.
Furthermore, introducing an extra http layer in your communication pipeline will make it more complex to deploy, maintain, and debug, and will possibly create issues.
Furthermore, introducing an extra http layer in your communication pipeline will make it more complex to deploy, maintain, and debug, and will possibly create issues. Make sure the extra complexity is required.
For instance, Amazon's Elastic Load Balancer (ELB) in HTTPS mode already sets the following client header:
```
X-Real-IP
X-Forwarded-For
X-Forwarded-Proto
```
So if you have an nginx sitting behind it, should remove these lines from the example config below:
```
X-Real-IP $remote_addr; # pass on real client's IP
X-Forwarded-For $proxy_add_x_forwarded_for;
X-Forwarded-Proto $scheme;
```
Otherwise nginx will reset the ELB's values, and the requests will not be routed properly. For more informations, see [#970](https://github.com/docker/distribution/issues/970).
## Setting things up