EMQX behind Nginx ssl proxy

452 Views Asked by At

I have a cluster of three EMQX nodes. Nginx is used as a load balancer. The problem is I can connect the load balancer using WSS protocol and get MQTT topics, however, can't connect the cluster with MQTT.

I read this article https://www.emqx.io/docs/en/v5.0/deploy/cluster/lb.html#configure-haproxy-nginx-in-emqx and created stream section in my nginx.conf as it was described in the article. My Nginx is built with stream_ssl_module. Config looks like given below:

stream {
    log_format basic '$proxy_protocol_addr - $remote_addr [$time_local] '
                     '$protocol $status $bytes_sent $bytes_received '
                     '$session_time';
    access_log  /var/log/nginx/access.log  basic;

    upstream emqx-tcp {
        zone tcp_servers 64k;
        hash $remote_addr;
        server emqx-01.node-01:1883;
        server emqx-02.node-02:1883;
        server emqx-03.node-03:1883;
    }

    server {
        listen 8883 ssl;
        #status_zone tcp_server;

        proxy_pass emqx-tcp;
        proxy_buffer_size 4k;
        ssl_handshake_timeout 10s;

        ssl_certificate /certs/domain.name.crt;
        ssl_certificate_key /certs/domain.name.key;
    }
}

In emqx.conf on every EMQX node I have section for tcp listener:

listeners.tcp.default {
    bind = "0.0.0.0:1883"
    proxy_protocol = true
}

When I'm trying to connect mqtt, I get following records in nginx/access.log:

- - my.ip.addr.ess [10/Jul/2023:13:49:10 +0000] TCP 200 0 79 3.428
- - my.ip.addr.ess [10/Jul/2023:13:49:15 +0000] TCP 200 0 79 3.435
- - my.ip.addr.ess [10/Jul/2023:13:50:01 +0000] TCP 200 0 79 3.478
- - my.ip.addr.ess [10/Jul/2023:13:50:07 +0000] TCP 200 0 79 3.424

And while I'm getting this records, in my MQTT client (MQTT Explorer app) I'm receiving message "Disconnected from server".

UPD: Here is HTTP proxy config, which is used for WSS connections and works fine:

upstream emqx-ws {
    least_conn;
    server emqx-01.node-01:8083 weight=1;
    server emqx-02.node-02:8083 weight=1;
    server emqx-03.node-03:8083 weight=1;
}

server {
    listen 9022 ssl;
    server_name     domain.name;

    ssl_certificate /certs/domain.name.crt;
    ssl_certificate_key /certs/domain.name.key;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real_IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;

        proxy_pass http://emqx-ws/mqtt;
    }
}

I've read everything I could find covering this topic but couldn't make this work.

0

There are 0 best solutions below