default_server with no IP specified for multiple IP servers

[gmchain@…]

I've encountered a problem whilst configuring a system with multiple IP addresses: default_server directive should be specified for every IP-address used for web connections, no matter if there should be only one default server in the configuration. So, in case of adding a new IP I should alter the configuration to add that IP.

I think it should be more transparent if nginx would look for default servers for IP:port pair first, after that for other suitable default servers and only after that use a first server in list of configured servers.

[Valentin V. Bartenev]

Could you explain which of servers should be a default for *:80 in the case below?

server {
    listen *.8000 default_server;
    listen *.8001;
    listen *.80;

    ...
}
server {
    listen *.8001 default_server;
    listen *.80;
    listen *.8000;

    ...
}

[gmchain@…]

None, in this case responding server should be taken from the servers list, because both default servers aren't configured to be a default server for 80 port.

[Valentin V. Bartenev]

Sorry, but I don't understand the idea how it should work... what did you mean by "other suitable default servers"? Could you provide some examples?

[gmchain@…]

Sure thing, here it is:

server {
    listen 100.50.0.100:80;
}
server {
    listen 100.50.0.200:80;
}
server {
    listen *:80 default_server;
}

Current version of nginx will use the first server as a default one for requests to 100.50.0.100:80 and will use the second server as default for requests to 100.50.0.200.

My idea is to use the third server as default for both IPs.

Another example:

server {
    location 100.50.0.100:80 default_server;
}
server {
    location 100.50.0.200:80;
}
server {
    location *:80 default_server;
}

In this case, default server for IP 100.50.0.100 should be the first one in the configuration, just like how it works already. But, for IP 100.50.0.200, the third server, not the second one, should be default.

[Valentin V. Bartenev]

It's not only about the default server. Currently, the clients connected to 100.50.0.200:80 can't access virtual servers with listen *:80 at all. Each listen directive with unique addr:port value creates completely separate space of virtual servers.

This change will not only break a lot of setups, but can silently introduce security holes.

[Valentin V. Bartenev]

Moreover, while this change will simplify your specific use-case, it will put in trouble all users, who wants the opposite behaviour, that is to separate their ip:port servers from *:port configuration.

[gmchain@…]

Replying to vbart:

Moreover, while this change will simplify your specific use-case, it will put in trouble all users, who wants the opposite behaviour, that is to separate their ip:port servers from *:port configuration.

This can be fixed with a directive, specifying what nginx behavior should be used, an old or a new one.

[grandpajam@…]

A directive would be very nice to have. Currently, the only way I see to set a default server for all interfaces is by including a listen directive for *every* IP address on the system in the default server config, which can be hard to maintain, especially if addresses are dynamic for any reason (DHCP, IPv6 SLAAC, link local, or other reasons).

[Maxim Dounin]

There are no reasons to list all IP addresses in the configuration, it is enough to use

listen 80;
listen 443 ssl;
listen [::]:80;
listen [::]:443 ssl;

to handle all IPv4 and IPv6 connections on ports 80 and 443. Unless you want to use specific per-IP processing. And if you in fact need specific per-IP processing, I would expect this change to be a problem, not a simplification, as already pointed out by Valentin in comment:6.