Configuring NGINX

Below is a description of how to configure NGINX as a reverse proxy for Intrexx.

If you want to create your own configurations for web front ends (Nginx, IIS, Apache, HAProxy, TrafficServer, etc.), please note the following:

HTTPS

  • Access via HTTPS only

  • Redirect from HTTP to HTTPS

Blocked URLs

  • Hidden files and directories starting with .. Exception: /.well-known/

  • /WEB-INF/ (recursive)

  • /web.config

  • /bin/ (recursively)

1. Customize the configuration file

When upgrading, replace the following line in the NGINX configuration file:

location ~ (css|download|images|include|is|script|temp|thirdparty|userfiles) {

by the following line

location ~ ^(/css|/fonts|/images|/include|/script|/thirdparty|/userfiles|/download|/is) {

This typically affects Nginx configuration files created with Intrexx 20.09, 20.03 OU3, 19.09, 19.03 OU13, or earlier versions.

Intrexx Version 12.0.1

The adjustments for Intrexx 12.0.1 are related to the changes in access permissions for the "userfiles" directory ("<portal-directory> \external\htmlroot\userfiles"), where, if configured accordingly, portal users can upload image files and download them from there as well.

For more information on this topic, see the " Portal Properties - Security - Upload/Download" section.

Up through Intrexx 12.0.0, image files were made available via the Fronten web server (reverse proxy). Starting with Intrexx 12.0.1, this is done using the web server (Tomcat) integrated into Intrexx. For this reason, the "userfiles" directory must be removed from the configuration file.

For more information about the front-end web server (reverse proxy) and Embedded Tomcat, see the section " Using the Front-End Web Server (Reverse Proxy)."

When upgrading, replace the following line in the NGINX configuration file:

location ~ (css|download|images|include|is|script|temp|thirdparty|userfiles) {

by the following line

location ~ ^(/css|/fonts|/images|/include|/script|/thirdparty) {

This typically affects Nginx configuration files created with Intrexx 20.09, 20.03 OU3, 19.09, 19.03 OU13, or earlier versions.

NGINX is configured using configuration files. After you have downloaded the Intrexx setup files, you will find three template files for configuring NGINX. You can use these as a basis for configuring your NGINX.

You can find the template files at the following path: <INTREXX-ROOT>/samples/web-tls-configuration/nginx/

The names of the template files are portal-intranet.conf, portal-internet.conf, and portal-remote.conf

Note: In addition to the settings in the "portal-intranet.conf" file, the "portal-internet.conf" file also contains a section for configuring OCSP stapling.

You can use the expandable links below to view the files and get an overview.

Copy 
#
# This file may be used as a basic template for running Intrexx behind Nginx.
#
#  Nginx performs the required TLS encryption and serves certain static files.
#
#  TODO tags indicate which directives have to be modified in your configuration.
#


# Define the upstream connections.
#
#  TODO: Ensure that the upstream name (here "backend") is
#  unique for all virtual servers that run under this Nginx
#  instance.
#
upstream backend {
    # Address and port of the Intrexx Portal Service
    #
    #  TODO: Configure the actual address and port of your Intrexx
    #  Portal Service web connector.
    #
    server localhost:1337;
}


# Redirect all unencrypted HTTP requests to HTTPS.
#
#  TODO: Change the server name and redirect URL.
#
server {
    listen      80;
    server_name intrexx.example.org;
    rewrite     ^ https://intrexx.example.org$request_uri? permanent;
    rewrite_log on;
}


# Reverse proxy with TLS offloading for the Intrexx Portal Service.
#
server {
    listen            443 ssl;
    server_name       intrexx.example.org;
    keepalive_timeout 70s;

    # Use dedicated access and error logs.
    #
    #  TODO: If you want to have dedicated access and error logs for
    #  your Intrexx portal then uncomment the directives below and
    #  change the paths to fit your needs.
    #
    #access_log /var/log/nginx/intrexx.example.org-access.log;
    #error_log  /var/log/nginx/intrexx.example.org-error.log error;

    # SSL keys, certificates and optional DHE group
    #
    #  Note: Here the term "modern compatibility" refers to configurations
    #  that support TLSv1.3 only, while intermediate compatibility supports
    #  both TLSv1.3 and TLSv1.2.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS for additional
    #  information about which one to choose according to your requirements.
    #
    #  TODO: Configure the actual paths to your certificate and key files.
    #  For intermediate compatibility copy the provided Diffie-Hellman
    #  parameters file to an appropriate location specified with the
    #  ssl_dhparam directive.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS#Forward_Secrecy.
    #
    #  The file specified by ssl_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate. The root certificate may be
    #  left out for SSL handshake optimization.
    #
    #  The file specified by ssl_trusted_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate.
    #
    #  As the Diffie-Hellman parameters file you might want to use one of the
    #  ffdhe*.pem files from samples/web-tls-configuration/nginx/.
    #
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate (for OCSP)
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_password_file
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
    #  https://tools.ietf.org/html/rfc7919
    #
    ssl_certificate         /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_trusted_certificate /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_certificate_key     /etc/ssl/localcerts/intrexx.example.org.key;
    #ssl_password_file       /etc/ssl/localcerts/intrexx.example.org.password;
    ssl_dhparam             /etc/ssl/localcerts/ffdhe4096.pem;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 30m;
    ssl_session_tickets on;

    # Configure the TLS protocols
    #
    #  TODO: Choose one of modern or intermediate compatibility below.
    #

    # Modern compatibility (TLSv1.3 only)
    #
    #  TODO: For modern compatibility uncomment the line below.
    #
    ssl_protocols TLSv1.3;

    # Intermediate compatibility
    #
    #  TODO: For modern compatibility comment out the three lines below.
    #
    #ssl_protocols TLSv1.2 TLSv1.3;
    #ssl_prefer_server_ciphers on;
    #ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

    add_header Strict-Transport-Security max-age=63072000; # two years
    add_header X-Frame-Options SAMEORIGIN;

    # The root path of the Intrexx web application.
    #
    #  TODO: Specify the path to your portal's htmlroot directory.
    #
    root /opt/intrexx/org/intrexx.example.org/external/htmlroot;

    # serve favicon and robots.txt
    location ~ (/favicon.ico|/robots.txt) {
        try_files $uri =404;
    }

    # hide hidden files and directories
    location ~ /\. {
        return 404;
    }

    # hide WEB-INF
    location /WEB-INF/ {
        deny all;
        return 404;
    }

    # hide IIS web.config
    location ~* /web.config {
        deny all;
        return 404;
    }

    # hide the bin directory
    location /bin/ {
        deny all;
        return 404;
    }

    # Static files that should be served by Nginx.
    #
    location ~ ^(/css|/fonts|/images|/include|/script|/thirdparty) {
        sendfile           on;
        sendfile_max_chunk 1m;
        try_files          $uri =404;
    }

    # Delegate WebSocket requests to the Intrexx Portal Service.
    #
    location /ws/ {
        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "Upgrade";
    }

    # Delegate requests to the Intrexx Portal Service.
    #
    location / {
        proxy_pass http://backend;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Clear potentially unsafe headers. These may be enabled if the backend
        # is configured to handle them correctly and in a safe manner.
        proxy_set_header Forwarded         "";
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host:$server_port;
        proxy_set_header X-Original-URL    "";

        # Security token to authenticate the reverse proxy with the backend.
        proxy_set_header X-SecToken "";

        # For security reasons we do not pass X-User and X-Domain to the backend by default,
        # since these headers might be interpreted by the External Authentication Filter as
        # authenticated user information.
        proxy_set_header X-User   "";
        proxy_set_header X-Domain "";

        # additional security sensitive headers
        proxy_set_header X-KrbTicket   "";
        proxy_set_header X-AccountName "";

        # Set the maximum allowed size of the client request body. The value 0 disables
        # this limit check.
        # http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
        client_max_body_size 2048m;
    }
}
Copy 
#
# This file may be used as a basic template for running Intrexx behind Nginx.
#
#  Nginx performs the required TLS encryption and serves certain static files.
#
#  TODO tags indicate which directives have to be modified in your configuration.
#


# Define the upstream connections.
#
#  TODO: Ensure that the upstream name (here "backend") is
#  unique for all virtual servers that run under this Nginx
#  instance.
#
upstream backend {
    # Address and port of the Intrexx Portal Service
    #
    #  TODO: Configure the actual address and port of your Intrexx
    #  Portal Service web connector.
    #
    server localhost:1337;
}


# Redirect all unencrypted HTTP requests to HTTPS.
#
#  TODO: Change the server name and redirect URL.
#
server {
    listen      80;
    server_name intrexx.example.org;
    rewrite     ^ https://intrexx.example.org$request_uri? permanent;
    rewrite_log on;
}


# Reverse proxy with TLS offloading for the Intrexx Portal Service.
#
server {
    listen            443 ssl;
    server_name       intrexx.example.org;
    keepalive_timeout 70s;

    # Use dedicated access and error logs.
    #
    #  TODO: If you want to have dedicated access and error logs for
    #  your Intrexx portal then uncomment the directives below and
    #  change the paths to fit your needs.
    #
    #access_log /var/log/nginx/intrexx.example.org-access.log;
    #error_log  /var/log/nginx/intrexx.example.org-error.log error;

    # SSL keys, certificates and optional DHE group
    #
    #  Note: Here the term "modern compatibility" refers to configurations
    #  that support TLSv1.3 only, while intermediate compatibility supports
    #  both TLSv1.3 and TLSv1.2.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS for additional
    #  information about which one to choose according to your requirements.
    #
    #  TODO: Configure the actual paths to your certificate and key files.
    #  For intermediate compatibility copy the provided Diffie-Hellman
    #  parameters file to an appropriate location specified with the
    #  ssl_dhparam directive.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS#Forward_Secrecy.
    #
    #  The file specified by ssl_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate. The root certificate may be
    #  left out for SSL handshake optimization.
    #
    #  The file specified by ssl_trusted_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate.
    #
    #  As the Diffie-Hellman parameters file you might want to use one of the
    #  ffdhe*.pem files from samples/web-tls-configuration/nginx/.
    #
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate (for OCSP)
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_password_file
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
    #  https://tools.ietf.org/html/rfc7919
    #
    ssl_certificate         /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_trusted_certificate /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_certificate_key     /etc/ssl/localcerts/intrexx.example.org.key;
    #ssl_password_file       /etc/ssl/localcerts/intrexx.example.org.password;
    ssl_dhparam             /etc/ssl/localcerts/ffdhe4096.pem;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 30m;
    ssl_session_tickets on;

    # Enable or disable OCSP Stapling
    #
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling_verify
    #  http://nginx.org/en/docs/http/ngx_http_core_module.html#resolver
    #
    ssl_stapling        on;
    ssl_stapling_verify on;
    resolver            9.9.9.9 8.8.8.8 valid=300s;

    # Configure the TLS protocols
    #
    #  TODO: Choose one of modern or intermediate compatibility below.
    #

    # Modern compatibility (TLSv1.3 only)
    #
    #  TODO: For modern compatibility uncomment the line below.
    #
    ssl_protocols TLSv1.3;

    # Intermediate compatibility
    #
    #  TODO: For modern compatibility comment out the three lines below.
    #
    #ssl_protocols TLSv1.2 TLSv1.3;
    #ssl_prefer_server_ciphers on;
    #ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

    add_header Strict-Transport-Security max-age=63072000; # two years
    add_header X-Frame-Options SAMEORIGIN;

    # The root path of the Intrexx web application.
    #
    #  TODO: Specify the path to your portal's htmlroot directory.
    #
    root /opt/intrexx/org/intrexx.example.org/external/htmlroot;

    # serve favicon and robots.txt
    location ~ (/favicon.ico|/robots.txt) {
        try_files $uri =404;
    }

    # hide hidden files and directories
    location ~ /\. {
        return 404;
    }

    # hide WEB-INF
    location /WEB-INF/ {
        deny all;
        return 404;
    }

    # hide IIS web.config
    location ~* /web.config {
        deny all;
        return 404;
    }

    # hide the bin directory
    location /bin/ {
        deny all;
        return 404;
    }

    # Static files that should be served by Nginx.
    #
    location ~ ^(/css|/fonts|/images|/include|/script|/thirdparty) {
        sendfile           on;
        sendfile_max_chunk 1m;
        try_files          $uri =404;
    }

    # Delegate WebSocket requests to the Intrexx Portal Service.
    #
    location /ws/ {
        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "Upgrade";
    }

    # Delegate requests to the Intrexx Portal Service.
    #
    location / {
        proxy_pass http://backend;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Clear potentially unsafe headers. These may be enabled if the backend
        # is configured to handle them correctly and in a safe manner.
        proxy_set_header Forwarded         "";
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host:$server_port;
        proxy_set_header X-Original-URL    "";

        # Security token to authenticate the reverse proxy with the backend.
        proxy_set_header X-SecToken "";

        # For security reasons we do not pass X-User and X-Domain to the backend by default,
        # since these headers might be interpreted by the External Authentication Filter as
        # authenticated user information.
        proxy_set_header X-User   "";
        proxy_set_header X-Domain "";

        # additional security sensitive headers
        proxy_set_header X-KrbTicket   "";
        proxy_set_header X-AccountName "";

        # Set the maximum allowed size of the client request body. The value 0 disables
        # this limit check.
        # http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
        client_max_body_size 2048m;
    }
}

Copy 
#
# This file may be used as a basic template for running Intrexx behind Nginx
# when Intrexx and Nginx reside on different machines.
#
#  Nginx performs the required TLS encryption.
#
#  TODO tags indicate which directives have to be modified in your configuration.
#


# Define the upstream connections.
#
#  TODO: Ensure that the upstream name (here "backend") is
#  unique for all virtual servers that run under this Nginx
#  instance.
#
upstream backend {
    # Address and port of the Intrexx Portal Service
    #
    #  TODO: Configure the actual address and port of your Intrexx
    #  Portal Service web connector.
    #
    server localhost:1337;
}


# Redirect all unencrypted HTTP requests to HTTPS.
#
#  TODO: Change the server name and redirect URL.
#
server {
    listen      80;
    server_name intrexx.example.org;
    rewrite     ^ https://intrexx.example.org$request_uri? permanent;
    rewrite_log on;
}


# Reverse proxy with TLS offloading for the Intrexx Portal Service.
#
server {
    listen            443 ssl;
    server_name       intrexx.example.org;
    keepalive_timeout 70s;

    # Use dedicated access and error logs.
    #
    #  TODO: If you want to have dedicated access and error logs for
    #  your Intrexx portal then uncomment the directives below and
    #  change the paths to fit your needs.
    #
    #access_log /var/log/nginx/intrexx.example.org-access.log;
    #error_log  /var/log/nginx/intrexx.example.org-error.log error;

    # SSL keys, certificates and optional DHE group
    #
    #  Note: Here the term "modern compatibility" refers to configurations
    #  that support TLSv1.3 only, while intermediate compatibility supports
    #  both TLSv1.3 and TLSv1.2.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS for additional
    #  information about which one to choose according to your requirements.
    #
    #  TODO: Configure the actual paths to your certificate and key files.
    #  For intermediate compatibility copy the provided Diffie-Hellman
    #  parameters file to an appropriate location specified with the
    #  ssl_dhparam directive.
    #  See https://wiki.mozilla.org/Security/Server_Side_TLS#Forward_Secrecy.
    #
    #  The file specified by ssl_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate. The root certificate may be
    #  left out for SSL handshake optimization.
    #
    #  The file specified by ssl_trusted_certificate should contain the certificate
    #  chain starting with your server certificate, following the intermediate
    #  certificates, up to the root certificate.
    #
    #  As the Diffie-Hellman parameters file you might want to use one of the
    #  ffdhe*.pem files from samples/web-tls-configuration/nginx/.
    #
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate (for OCSP)
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_password_file
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
    #  https://tools.ietf.org/html/rfc7919
    #
    ssl_certificate         /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_trusted_certificate /etc/ssl/localcerts/intrexx.example.org.pem;
    ssl_certificate_key     /etc/ssl/localcerts/intrexx.example.org.key;
    #ssl_password_file       /etc/ssl/localcerts/intrexx.example.org.password;
    ssl_dhparam             /etc/ssl/localcerts/ffdhe4096.pem;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 30m;
    ssl_session_tickets on;

    # Enable or disable OCSP Stapling
    #
    #  TODO: Enable it (optionally)
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
    #  http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling_verify
    #  http://nginx.org/en/docs/http/ngx_http_core_module.html#resolver
    #
    #ssl_stapling        on;
    #ssl_stapling_verify on;
    #resolver            9.9.9.9 8.8.8.8 valid=300s;

    # Configure the TLS protocols
    #
    #  TODO: Choose one of modern or intermediate compatibility below.
    #

    # Modern compatibility (TLSv1.3 only)
    #
    #  TODO: For modern compatibility uncomment the line below.
    #
    ssl_protocols TLSv1.3;

    # Intermediate compatibility
    #
    #  TODO: For modern compatibility comment out the three lines below.
    #
    #ssl_protocols TLSv1.2 TLSv1.3;
    #ssl_prefer_server_ciphers on;
    #ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

    add_header Strict-Transport-Security max-age=63072000; # two years
    add_header X-Frame-Options SAMEORIGIN;

    # hide hidden files and directories
    location ~ /\. {
        return 404;
    }

    # hide WEB-INF
    location /WEB-INF/ {
        deny all;
        return 404;
    }

    # hide IIS web.config
    location ~* /web.config {
        deny all;
        return 404;
    }

    # hide the bin directory
    location /bin/ {
        deny all;
        return 404;
    }

    # This is a secret key (security token) that is shared between
    # this Nginx configuration and the Intrexx portal. It prevents
    # direct connections to the portal's HTTP connector which could
    # be a security risk.
    #
    #  TODO: Create the security token as a string only known to this
    #  configuration and the Intrexx portal (here we use the placeholder
    #  INSERT_SECURITY_TOKEN_HERE for it). Insert it below.
    #
    #  TODO: Make the corresponding in the portal's web configuration
    #  file external/htmlroot/WEB-INF/web.xml.
    #
    #  1.) Set the following property to allow remote connections.
    #
    #  connector.security.header.receiveOnNonLoopbackInterface = true
    #
    #  2.) Enable the security token by changing the following property.
    #
    #  connector.security.header.secToken.disabled
    #    -> connector.security.header.secToken.enabled
    #
    #  3.) Configure the shared security token.
    #
    #  <init-param>
    #      <param-name>connector.security.token.1</param-name>
    #      <param-value>INSERT_SECURITY_TOKEN_HERE</param-value>
    #  </init-param>
    #
    set $ix_sec_token "INSERT_SECURITY_TOKEN_HERE";

    # Delegate WebSocket requests to the Intrexx Portal Service.
    #
    location /ws/ {
        proxy_pass         http://backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "Upgrade";
        proxy_set_header   X-SecToken $ix_sec_token;
    }

    # Delegate requests to the Intrexx Portal Service.
    #
    location / {
        proxy_pass http://backend;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Clear potentially unsafe headers. These may be enabled if the backend
        # is configured to handle them correctly and in a safe manner.
        proxy_set_header Forwarded         "";
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host:$server_port;
        proxy_set_header X-Original-URL    "";

        # Security token to authenticate the reverse proxy with the backend.
        proxy_set_header X-SecToken $ix_sec_token;

        # For security reasons we do not pass X-User and X-Domain to the backend by default,
        # since these headers might be interpreted by the External Authentication Filter as
        # authenticated user information.
        proxy_set_header X-User   "";
        proxy_set_header X-Domain "";

        # additional security sensitive headers
        proxy_set_header X-KrbTicket   "";
        proxy_set_header X-AccountName "";

        # Set the maximum allowed size of the client request body. The value 0 disables
        # this limit check.
        # http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
        client_max_body_size 2048m;
    }
}

Open the file in an editor of your choice to make the necessary changes.

TODOs

You'll find configuration instructions in the file. These are each marked with "TODO."
Key tasks are:

  • the Web Connector and port information

  • Specify the server name (fully qualified domain name) and port

  • Information About SSL

  • Path to the certificate file (*.cer or *.pem) and the private key

It is also important to specify the correct path to the portal's "external/htmlroot" directory.

  1. To do this, open "Portal > Portal Properties > Front-End Web Server (Reverse Proxy/Load Balancer) > Front-End Web Server."

    Name

    Description

    NGINX Virtual Host

    "NGINX Virtual Host" refers to the embedded Tomcat. NGINX establishes a connection to the Intrexx portal service via the virtual host. Usually, you should enter "localhost" here. (An exception may apply if NGINX is installed on a different server than Intrexx. (In that case, the Intrexx server should be specified here.)

    NGINX Configuration File

    You can generate the NGINX configuration file using Intrexx.

    Enter the path to the directory where you want to create the NGINX configuration file.
    Example: /myfolder/portal.example.com.conf
    Next, copy the NGINX configuration file to the desired location under /etc/nginx.
    Example: /etc/nginx/sites-available/portal.example.com.conf

    Embedded Tomcat Port

    This displays the port you used in the previous version of Intrexx. You can leave this port as is.

    Note: For a new installation, port 1337 is the default setting here.

    Portal Base URL

    The base URL must be specified here.
    The first part consists of the minutes. Please note that "https" is specified here. The second part consists of specifying the hostname that you have defined in the NGINX configuration file. Note that a trailing slash (/) is included. It is essential that you enter the correct information so that your portal can be accessed in the browser.

  2. Click "OK."
    Intrexx generates the configuration file. The information entered in the input fields is then written to the configuration file. The file will be saved in the specified directory.

2. Place the configuration file in the "sites-available" directory

Place the configuration file in the "sites-available" directory.

Note: Depending on your Linux distribution and the installation package you selected, the "sites-available" directory may not be available.

Typically, the "sites-available/site-enabled" directories are present when you install Nginx from the repositories of Debian-based distributions. If you install Nginx from the Nginx repository, those directories do not exist. In this case, only conf.d/ is present. The same applies to other Linux distributions, such as CentOS. Here, too, conf.d/ is present.

In this case, find out how the configuration file needs to be set up for your Linux distribution.

3. Create a symbolic link to the configuration file

Create a symbolic link from `sites-enabled` to the `sites-available` file. Be sure to use the full paths.

Note: When using symlinks, be sure to create them directly in the desired directory.

Example: "ln -s /etc/nginx/sites-available/host.example.org.conf"

4. Restart NGINX

Restart NGINX.

NGINX and Intrexx on Different Servers (NGINX on a Remote Machine)

  1. If NGINX is running on a different server than Intrexx, you must comment out the following blocks in the configuration file:

    Root Directive (The root path of the Intrexx web application.)

    • Settings for favicon and robots.txt (serve favicon and robots.txt)

    • Setting for static files (Static files that should be served by Nginx)

    You must comment out these blocks to prevent NGINX from serving the static files, since it does not have access to the portal's remote htmlroot.

  2. In the "web.xml" file (<Portal Directory>\external\htmlroot\WEB-INF\web.xml), you must set the "NonLoopback" parameter to "true".

    <init-param>
     <description>
          Allow receiving security-sensitive headers on non-loopback network interfaces.
          Values: true or false (default).
     </description>
     <param-name>
          connector.security.header.receiveOnNonLoopbackInterface
     </param-name>
     <param-value>
          true
     </param-value>
</init-param>

For more information on this topic, see the sample configuration file portal-remote.conf.

Configuring WebSockets

To use WebSockets with NGINX, you must specify in the NGINX configuration file which URLs should be forwarded to the backend via the WebSocket protocol. In the default configuration, this looks like this:

...

# Delegate WebSocket requests to the Intrexx Portal Service.

#

location /ws/ {

proxy_pass https://backend;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection "Upgrade";

}

# Delegate requests to the Intrexx Portal Service.

#

location / {

proxy_pass https://backend;

...

 

Note: When upgrading from an earlier version of Intrexx, the existing configuration file must be modified accordingly to enable the use of WebSockets.

For more information on WebSockets, see the WebSockets chapter.