upstream server port defaults to port 80 even for https: proxy_pass

[Neil Craig]

Hi

I'm building a multi-tenant caching reverse proxy based on NGINX and i've hit an issue today.

Essentially the issue boils down to the default for the port of an upstream server being 80 even when the proxy_pass to the upstream is https. It'd seem reasonable to me to amend the default port to 80 for http proxy_pass and 443 for https proxy_pass. Users would still be free to define their own port manually. I also think that this would fit the principal of least surprise - i believe that most users would expect the upstream server to use :443 if they specify https in their proxy_pass.

The other option would be to use a variable, e.g. $server_port but NGINX doesn't seem to support variables in upstreams right now - that would be useful for other reasons too.

I'd be keen to hear any workarounds if they exist and i would love to hear your thoughts on this. Happy to explain my use case in more detail if needed, i avoided writing it down just to keep the ticket more succinct.

Cheers
Neil

[Maxim Dounin]

You mean, when using a separate upstream block, like in the following example:

    upstream foo {
        server 127.0.0.1;
    }

    server {
        location / {
            proxy_pass https://foo;
        }

        ...
    }

that is, with proxy_pass https://... referring to an explicitly defined upstream block?

Unfortunately, it is hardly possible to know in advance how a particular upstream block will be used in the configuration, and predict the default port accordingly. When nginx knows the protocol in advance, as in

    proxy_pass https://localhost;

when proxy_pass is used with an IP address or a domain name, default port is selected according to the protocol used.

A simple solution for upstream blocks would be to always use ports in the server directives. And may be simply requiring ports to be always specified may reduce confusion here.

[Neil Craig]

Sorry for the delay Max, i never get emails from this tracker.

Yes, i do indeed mean as per above and i see your point.

Wouldn't it be a better default for the upstream to use 443 if the scheme is https: (and 80 if it's http:) if the port on the upstream server is not explicitly defined? I am assuming that the upstream knows the scheme with which it's called/used? (maybe i'm wrong on that). Or are you saying that's already the case? The docs say :80 will be used if no port is specified:
"...If a port is not specified, the port 80 is used..." (​http://nginx.org/en/docs/http/ngx_http_upstream_module.html#server)

Cheers

[Maxim Dounin]

The scheme is not know when the upstream{} block is created and its internal structures are initialized. (Moreover, the same upstream{} block can be used with multiple protocols, though this is not likely to be used in practice.)

[Neil Craig]

OK, I see. So when the upstream is called, there's no parameter/arg passed which could specify the port? Seems like that would be the only way.