Configuring the NGINX proxy server for Customizer

At this stage, you will only install the packages. Configuring the NGINX server is explained in later steps.

If you will use NGINX as a stand-alone server, then first you must update the dynamicHosts attribute in the LotusConnections-config.xml file to reflect the URL of the proxy server. On the Deployment Manager, update the LotusConnections-config.xml file with the following setting:

<dynamicHosts enabled="true">
<host href="http://proxy.example.com" ssl_href="https://proxy.example.com"/>
</dynamicHosts>

where proxy.example.com is the host name of your reverse proxy server.

Run the following command on any of the Component Pack servers to check the value:

kubectl get configmap connections-env -o yaml -n connections | grep customizer-interservice-host

If the value is incorrectly set, you can run a Helm upgrade of the connections-env.

The directory might already exist; if it does not exist, create it now. For example, the following command creates a directory called etc/nginx/ssl below the NGINX_INSTALL_DIR directory.

$ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx-selfsigned.key -out /etc/nginx/ssl/nginx-selfsigned.crt

worker_processes  1;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    keepalive_timeout  65;

    server {
        listen       80;
        server_name  localhost;

        
        location / {
            root   html;
            index  index.html index.htm;
        }

        # redirect server error pages to the static page /50x.html
        
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
        
    }
		proxy_redirect          off;
		proxy_set_header        Host            $host;
		proxy_set_header        X-Real-IP       $remote_addr;
		proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_connect_timeout   90;
		proxy_send_timeout      90;
		proxy_read_timeout      90;
		proxy_buffers           32 4k;
		server {
			listen 		443 ssl;
			server_name 127.0.0.1;	
			ssl_certificate Path_to_NGINX-self-signed/nginx-selfsigned.crt;
			ssl_certificate_key Path_to_NGINX-self-signed/nginx-selfsigned.key;
			ssl_session_cache    shared:SSL:1m;
			ssl_session_timeout  5m;

			ssl_ciphers  HIGH:!aNULL:!MD5;
			ssl_prefer_server_ciphers  on;	
			
			location / {
				#Points to the master with mw-proxy. Port should be as below
				proxy_pass http://MW_PROXY_SERVICE:MW_PROXY_PORT;
			}
		}

}

location / {
    location ~ ^/(files/app|files/customizer|communities/service/html/|forums/html|search/web/) {
        proxy_pass http://[MW_PROXY_SERVICE]:[MW_PROXY_PORT];
    }
    
    # If the list is getting too long create another location for other URLs. 
    location ~ ^/(homepage/web/|social|mycontacts) {
    proxy_pass http://[MW_PROXY_SERVICE]:[MW_PROXY_PORT];
    }

    # Explicitly exclude some known high traffic requests that should not be routed via mw-proxy service
    # Add others if you are aware of additional examples in your Connections environment
    location ~ /(profiles/dsx|communities/dsx|profiles/photo.*\.do) {
        proxy_pass https://IHS_SERVER;
    }
    proxy_pass https://IHS_SERVER;
}

events {
    worker_connections 16384;
}

The value shown here is an example; you might need to use a different value for your environment.

sudo systemctl start nginx

? ps -ef | grep nginx
root       4443      1  0 12:04 ?        00:00:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
nginx      4444   4443 47 12:04 ?        00:06:50 nginx: worker process

$ grep 'Max open files' /proc/444{3,4}/limits
/proc/4443/limits:Max open files            16384                16384                files
/proc/4444/limits:Max open files            16384                16384                files

nginx -t

sudo systemctl reload nginx