I use the stream module in order to passthrough tls traffic where I cannot reverse proxy, e.g. because I dont have the certificate (local 3CX install) or it breaks stuff (ssl vpn with client cert).
I then forward the "rest" to a different IP on the same host (127.0.0.1) for reverse proxying.
The problem was the the remote_addr was not always 127.0.0.1 and there seemes to be no way to set the "real" remote address.
To circumvent this I enabled the proxy_protocol and used $proxy_protocol_addr.
However this breaks all passthrough websites and I have not found a way to conditionally enable the proxy_protocol only for the "default"
I do all this so I can match on sni and use a single IP for all websites.
I am not hung up on doing it exactly this way, if anyone has an idea how to achieve this in a different/better way, I am all ears.
stream {
map $ssl_preread_server_name $targetBackend {
3cx.example.com 192.168.1.2:443;
vpn.example.com 192.168.1.3:443;
default 127.0.0.1:443;
}
server {
listen 192.168.1.100:443;
proxy_connect_timeout 1;
proxy_timeout 3s;
resolver 192.168.1.1;
proxy_protocol on;
proxy_pass $targetBackend;
ssl_preread on;
}
so... how to make the proxy_protocol conditional (afaik if just does not work in stream context) or solve it another way?
