Skip to main content

nginx configuration for trusted networks

If the server is not exposed to the internet and is operated on a trusted network, the REST interace and the administration site may be exposed via HTTP without basic authentication

The following chapters describe modification to the default nginx configuration

HTTP​

To expose the REST interface and the administration site via HTTP, the lines 77-84 have to be replaced with the content of following Listing

location ~* ^/asignrkhsm/ {
	auth_basic "RKHSM API";
	auth_basic_user_file /etc/nginx/.htpasswdapi;

	rewrite "(?i)/asignrkhsm/(.*)" /$1 break;
	proxy_pass http://rkapi;
	#limit_req zone=ip burst=12 nodelay;
	add_header Retry-After $retry_after always;
}

location / {
	auth_basic "Administrationsseite";
	auth_basic_user_file /etc/nginx/.htpasswd;
	proxy_pass http://webinterface;
}

location ~* ^/api/v1/status {
	auth_basic off;
	proxy_pass http://webinterface;
}

Basic Authentication​

To disable basic authentication, all lines starting with

  • auth_basic
  • auth_basic_user_file can be deleted