By default, WSO2 interfaces such as Publisher, Developer portal, and Carbon are accessed via port :9443/publisher, :9443/devportal and :9443/carbon respectively. But I don’t suggest offering endpoints with port numbers to the customer for good reasons. So if you are like me and wanted to set up custom proxy paths such as https://hostname.com/publisher etc. then you need to have a proxy server front-ending the WSO2 API Manager. In this tutorial, we will set up WSO2 with NGINX reverse proxy to map a proxy URL with the actual URL of the WSO2 services allowing the clients to access the services with the proxy URL.
Consider a scenario where you wanted to host WSO2 services such as publisher, developer portal, and carbon console as:
https://tg.com/apim/publisher https://tg.com/apim/devportal https://tg.com/apim/carbon https://tg.com/apim/admin
In the above URLs, ‘apim‘ is the proxy context path of the API Manager.
How to setup WSO2 with NGINX Reverse Proxy
If you are setting up WSO2 for the first time, then jump to this article for installation steps.
Install NGINX Server
Step 1: Install NGINX server by executing the following command
sudo apt-get install nginx
Step 2: Setup SSL certificate. You can either set up a self-signed certificate for the development server or get one from LetsEncrypt for the production server.
Step 3: Create a new NGINX configuration file inside /etc/nginx/conf.d/wso2.conf and copy-paste the below text.
server {
listen 443 ssl default_server;
listen [::]:443 default_server ipv6only=on;
server_name tg.com www.tg.com;
root /var/www/html;
access_log /var/log/nginx/proxy.log;
ssl_certificate /etc/letsencrypt/live/tg.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/tg.com/privkey.pem; #
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
rewrite \w*(carbon|admin|devportal|publisher|oidc)$ $1/ permanent;
location /apim/ {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://tg.com:9443/;
proxy_redirect https://tg.com/authenticationendpoint/ https://tg.com/apim/authenticationendpoint/;
proxy_redirect https://tg.com/oauth2/ https://tg.com/apim/oauth2/;
proxy_redirect https://tg.com/carbon/ https://tg.com/apim/carbon/;
#proxy_redirect https://tg.com/admin/ https://tg.com/apim/admin/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location /api/ {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://tg.com:8243/;
proxy_redirect https://tg.com:8243/(.*) https://tg.com/api/$1;
}
location /carbon/admin/js/csrfPrevention.js {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_read_timeout 5m;
proxy_send_timeout 5m;
proxy_pass https://tg.com/apim/carbon/admin/js/csrfPrevention.js;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location /api/am/publisher/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/publisher/v2;
proxy_redirect https://tg.com:9443/api/am/publisher/v2 https://tg.com/apim/api/am/publisher/v2;
}
location /api/am/admin/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/admin/v2;
proxy_redirect https://tg.com:9443/api/am/admin/v2 https://tg.com/apim/api/am/admin/v2;
}
location /api/am/devportal/v2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/devportal/v2;
proxy_redirect https://tg.com:9443/api/am/devportal/v2 https://tg.com/apim/api/am/devportal/v2;
}
location /oidc {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/oidc;
proxy_redirect https://tg.com:9443/oidc https://tg.com/apim/oidc;
}
location /authenticationendpoint{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/authenticationendpoint;
proxy_redirect https://tg.com:9443/authenticationendpoint https://tg.com/apim/authenticationendpoint;
}
location /oauth2 {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/oauth2;
proxy_redirect https://tg.com:9443/oauth2 https://tg.com/apim/oauth2;
proxy_redirect https://tg.com:9443/authenticationendpoint https://tg.com/apim/authenticationendpoint;
proxy_redirect https://tg.com:9443/devportal https://tg.com/apim/devportal;
proxy_redirect https://tg.com:9443/publisher https://tg.com/apim/publisher;
}
location /logincontext{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/logincontext;
proxy_redirect https://tg.com:9443/logincontext https://tg.com/apim/logincontext;
}
location /commonauth{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/commonauth;
proxy_redirect https://tg.com:9443/commonauth https://tg.com/apim/commonauth;
}
location /api/am/service-catalog/v0{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:9443/api/am/service-catalog/v0;
proxy_redirect https://tg.com:9443/api/am/service-catalog/v0 https://tg.com/apim/api/am/service-catalog/v0;
}
location /uansandbox{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:8443/uansandbox;
proxy_redirect https://tg.com:8443/uansandbox https://tg.com/uansandbox;
}
location /uansandbox/uploadtoken{
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://tg.com:8443/uansandbox/uploadtoken;
proxy_redirect https://tg.com:8443/uansandbox/uploadtoken https://tg.com/uansandbox/uploadtoken;
}}
Step 4: Save the file and execute the below command to ensure the configuration is error-free.
# nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful
Step 5: Restart the NGINX server
# systemctl restart nginx
Update API manager configurations
Step 6: Add the following host entries
127.0.0.1 tg.comStep 7: Update the deployment configuration file as below and add or update with the following configurations.
# vim <API_M>/repository/conf/deployment.toml
[server]
hostname = "tg.com"
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}/apim"
server_role = "default"
node_ip = "127.0.0.1"
mode = "single" #single or ha
proxy_context_path = "/apim"[apim.devportal] url = "https://tg.com/apim/devportal"
[transport.https.properties] proxyPort = 443
Note: Remember to change the hostname, base_path with the suffix of “/apim‘ and proxy_context_path which is ‘/apim‘.
Step 7: Update web.xml.j2 file located at ‘<API_M>//repository/resources/conf/templates/repository/conf/tomcat/carbon/WEB-INF/web.xml.j2‘
And add the below configuration at the same level of <context-param> nodes.
<context-param> <param-name>contextPath</param-name> <param-value>apim</param-value> </context-param>
Step 8: Update the web configuration files under app: { }
#vim <API_M>/repository/deployment/server/jaggeryapps/publisher/site/public/conf/settings.js
context: '/apim/publisher', // Note the leading `/` and no trailing `/`
proxy_context_path: '/apim',
customUrl: { // Dynamically set the redirect origin according to the forwardedHeader host|proxyPort combination
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},#vim <API_M>/repository/deployment/server/jaggeryapps/devportal/site/public/theme/settings.js
context: '/apim/devportal',
proxy_context_path: '/apim',
customUrl: {
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},
#vim <API_M>/repository/deployment/server/jaggeryapps/admin/site/public/conf/settings.js
context: '/apim/admin', // Note the leading `/` and no trailing `/`
proxy_context_path: '/apim',
customUrl: { // Dynamically set the redirect origin according to the forwardedHeader host|proxyPort combination
enabled: true,
forwardedHeader: 'X-Forwarded-Host',
},Step 9: Restart the WSO2 API Manager
#<API_M/bin/api-manager -restart
That’s it! Now go ahead and access all the WSO2 services via the custom proxy URLs.
References:
