Configure WSO2 con NGINX Reverse Proxy para URL personalizadas

De manera predeterminada, se accede a las interfaces de WSO2 como Publisher, Developer portal y Carbon a través de los puertos :9443/publisher, :9443/devportal y :9443/carbon respectivamente. Pero no sugiero ofrecer terminales con números de puerto al cliente por buenas razones. Por lo tanto, si es como yo y desea configurar rutas de proxy personalizadas, como https://hostname.com/publisher, etc., debe tener un servidor proxy como front-end del Administrador de API de WSO2. En este tutorial, configuraremos WSO2 con el proxy inverso NGINX para asignar una URL de proxy con la URL real de los servicios de WSO2, lo que permitirá a los clientes acceder a los servicios con la URL de proxy.

Considere un escenario en el que desea alojar servicios de WSO2, como el editor, el portal para desarrolladores y la consola de carbono, como:

https://tg.com/apim/publisher
https://tg.com/apim/devportal
https://tg.com/apim/carbon
https://tg.com/apim/admin

En las URL anteriores, ‘apim ‘ es la ruta de contexto del proxy del Administrador de API.

Cómo configurar WSO2 con NGINX Reverse Proxy

Si está configurando WSO2 por primera vez, vaya a este artículo para conocer los pasos de instalación.

Instalar servidor NGINX

Paso 1: Instale el servidor NGINX ejecutando el siguiente comando

sudo apt-get install nginx

Paso 2: Configurar certificado SSL. Puede configurar un certificado autofirmado para el servidor de desarrollo u obtener uno de LetsEncrypt para el servidor de producción.

Paso 3 :Cree un nuevo archivo de configuración de NGINX dentro de /etc/nginx/conf.d/wso2.conf y copie y pegue el siguiente texto.

server {
listen 443 ssl default_server;
listen [::]:443 default_server ipv6only=on;
server_name tg.com www.tg.com;
root /var/www/html;
access_log /var/log/nginx/proxy.log;


ssl_certificate /etc/letsencrypt/live/tg.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/tg.com/privkey.pem; #

ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

rewrite \w*(carbon|admin|devportal|publisher|oidc)$ $1/ permanent;

location /apim/ { 
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;

proxy_pass https://tg.com:9443/;
proxy_redirect https://tg.com/authenticationendpoint/ https://tg.com/apim/authenticationendpoint/;
proxy_redirect https://tg.com/oauth2/ https://tg.com/apim/oauth2/;
proxy_redirect https://tg.com/carbon/ https://tg.com/apim/carbon/;
#proxy_redirect https://tg.com/admin/ https://tg.com/apim/admin/;


proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";


}
location /api/ {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;

proxy_pass https://tg.com:8243/;
proxy_redirect https://tg.com:8243/(.*) https://tg.com/api/$1;

}

location /carbon/admin/js/csrfPrevention.js {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://tg.com/apim/carbon/admin/js/csrfPrevention.js;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}

location /api/am/publisher/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/publisher/v2;
proxy_redirect https://tg.com:9443/api/am/publisher/v2 https://tg.com/apim/api/am/publisher/v2;
}
location /api/am/admin/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/admin/v2;
proxy_redirect https://tg.com:9443/api/am/admin/v2 https://tg.com/apim/api/am/admin/v2;
}
location /api/am/devportal/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/devportal/v2;
proxy_redirect https://tg.com:9443/api/am/devportal/v2 https://tg.com/apim/api/am/devportal/v2;
}

location /oidc {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/oidc;
proxy_redirect https://tg.com:9443/oidc https://tg.com/apim/oidc;
}
location /authenticationendpoint{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/authenticationendpoint;
proxy_redirect https://tg.com:9443/authenticationendpoint https://tg.com/apim/authenticationendpoint;
}

location /oauth2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/oauth2;
proxy_redirect https://tg.com:9443/oauth2 https://tg.com/apim/oauth2;
proxy_redirect https://tg.com:9443/authenticationendpoint https://tg.com/apim/authenticationendpoint;
proxy_redirect https://tg.com:9443/devportal https://tg.com/apim/devportal;
proxy_redirect https://tg.com:9443/publisher https://tg.com/apim/publisher;
}
location /logincontext{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/logincontext;
proxy_redirect https://tg.com:9443/logincontext https://tg.com/apim/logincontext;
}
location /commonauth{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/commonauth;
proxy_redirect https://tg.com:9443/commonauth https://tg.com/apim/commonauth;
}

location /api/am/service-catalog/v0{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/service-catalog/v0;
proxy_redirect https://tg.com:9443/api/am/service-catalog/v0 https://tg.com/apim/api/am/service-catalog/v0;
}
location /uansandbox{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:8443/uansandbox;
proxy_redirect https://tg.com:8443/uansandbox https://tg.com/uansandbox;
}
location /uansandbox/uploadtoken{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:8443/uansandbox/uploadtoken;
proxy_redirect https://tg.com:8443/uansandbox/uploadtoken https://tg.com/uansandbox/uploadtoken;
}

Paso 4: Guarde el archivo y ejecute el siguiente comando para asegurarse de que la configuración no tenga errores.

# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Paso 5: Reinicie el servidor NGINX

# systemctl restart nginx

Actualizar las configuraciones del administrador de API

Paso 6: Agregue las siguientes entradas de host

127.0.0.1 tg.com

Paso 7: Actualice el archivo de configuración de implementación como se muestra a continuación y agregue o actualice con las siguientes configuraciones.

# vim <API_M>/repository/conf/deployment.toml

[server]
hostname = "tg.com"
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}/apim"
server_role = "default"
node_ip = "127.0.0.1"
mode = "single" #single or ha
proxy_context_path = "/apim"

[apim.devportal]
url = "https://tg.com/apim/devportal"

[transport.https.properties]
proxyPort = 443

Nota: Recuerde cambiar el nombre de host, base_path con el sufijo de “/apim ‘ y proxy_context_path que es ‘/apim ‘.

Paso 7: Actualice web.xml.j2 archivo ubicado en ‘//repository/resources/conf/templates/repository/conf/tomcat/carbon/WEB-INF/web.xml.j2 ‘

Y agregue la siguiente configuración al mismo nivel de <context-param> nodos.

<context-param>
<param-name>contextPath</param-name>
<param-value>apim</param-value>
</context-param>

Paso 8: Actualice los archivos de configuración web en aplicación:{ }

#vim /repository/deployment/server/jaggeryapps/publisher/site/public/conf/settings.js

context: '/apim/publisher', // Note the leading `/` and no trailing `/`
proxy_context_path: '/apim',
customUrl: { // Dynamically set the redirect origin according to the forwardedHeader host|proxyPort combination
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},

#vim /repository/deployment/server/jaggeryapps/devportal/site/public/theme/settings.js

context: '/apim/devportal',
proxy_context_path: '/apim',
customUrl: {
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},

#vim /repository/deployment/server/jaggeryapps/admin/site/public/conf/settings.js

context: '/apim/admin', // Note the leading `/` and no trailing `/`
proxy_context_path: '/apim',
customUrl: { // Dynamically set the redirect origin according to the forwardedHeader host|proxyPort combination
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},

Paso 9: Reinicie el Administrador de API de WSO2

#<API_M/bin/api-manager -restart

¡Eso es todo! Ahora continúe y acceda a todos los servicios de WSO2 a través de las URL de proxy personalizadas.

Referencias:

• Configurar WSO2 con NGINX Reverse Proxy
• Razón para agregar la configuración de encabezado X-Forwarded-For.
• Problemas con el proxy inverso para DevPortal y Publisher.