nginx on reverse proxy

Hi to all,

i want to share with you my experience to use traccar on nginx server with reverse proxy.

I've create a conf file in /etc/nginx/sites-available/traccar:

server {

    server_name traccar.mydomain.com;
    set $root_path "/var/www/traccar";

    root $root_path;

    index index.html index.php;

    location /api/socket {
       include proxy_params;
       proxy_http_version 1.1;
       proxy_cache_bypass $http_upgrade;
       proxy_buffering off;
       proxy_set_header Host $host;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "Upgrade";
       proxy_pass http://localhost:8082/api/socket;

    }

    location / {
       proxy_set_header X-Forwarded-Host $host:$server_port;
       proxy_set_header X-Forwarded-Server $host;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

       proxy_pass http://localhost:8082/;
    }
    location ~ /.well-known {
       #this need for let's enctypt certificate otherwise i receve "not valid" for my domain when let's encrypt generate certificate
       allow all;
       root /var/www/html;
    }

    listen 80;
    if ($scheme = http) {
        # Force redirection to HTTPS.
        return 301 https://$host:443$request_uri;
    }
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    #next rows need for SSL certificate
    ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;

}

then enable the conf file with a symlink:

ln -s /etc/nginx/sites-available/traccar /etc/nginx/sites-enabled/

and restart nginx

service nginx restart 

that's all!

It work great for me!

I hope this should useful for the others!

Cheers,

Lorenzo

Thanks for sharing this.

This is great, thank you!

One little problem I'm encountering - since I'm new to nginx and don't fully understand it, I'm sure you could be of help.

I keep getting the websocket connection error, and assume it has to do with me passing the location. Since I'm not running traccar in "location /", but rather "location /traccar/", I think I messed up the way the /api section is passed on.

		location /traccar/ {
				include snippets/proxy-params.conf;
				proxy_set_header Upgrade $http_upgrade;
				proxy_set_header Connection "upgrade";
				proxy_pass http://192.168.178.246:8082/; 

		}
		location /traccar/api/socket {
				proxy_cache_bypass $http_upgrade;
				proxy_buffering off;
				proxy_http_version 1.1;
				proxy_set_header Upgrade $http_upgrade;
				proxy_set_header Connection "upgrade";
				proxy_pass http://192.168.178.246:8082/api/socket;
		}

try to writing "Upgrade" with uppercase letter. So, this:

proxy_set_header Connection "upgrade";

become

proxy_set_header Connection "Upgrade";

Oh wow. That did it, thanks a lot! No more errors, runs like butter! :D

I'm trying settings to enable cors to consume the backend. any tips?

thank you, traccar works faster with nginx . This should be implemented as a official tutorial for nginx and traccar .

Please provide performance measurements that you did when compared the two.

Hello,

I used "htop" in the command line on my client vps and compare it with apache and nginix and cpu usage is a little bit less consumed with nginix . That server has more then 200 devices. If the client provide me access again or when ai install it on another vps,I will provide video.

We'll need something better than a video. Need over time measurements, so we can actually see the difference. You also said performance is better. CPU usage is completely different thing.

Ok, I will do that.

Thank you

Hello!, thanks for sharing.

I'm getting this messages in the logs:

WARN: Encountered multiple `Host` headers.  Previous `Host` header already seen as `fqdn.site`, new `Host` header has appeared as `fqdn.site`. Might there be a redundant "Host" header definition or something like that?.

Hi,
I was using Lorenzo's config and after a few attempts I think I managed to have it working with ssl client certificates, but only for the web client.
If I'm correct, this means that the tracked device can push their positions to my server without client certificate, but in order to log into the server and check them on the map, the client certificate is still needed.
Let me know if I got it right or if I'm missing something (for me, it looks like it's working).

[...]

        ssl_client_certificate /etc/nginx/client_certs/ca.crt;
        ssl_verify_client optional;
        location /api/socket {
                include proxy_params;
                proxy_http_version 1.1;
                proxy_cache_bypass $http_upgrade;
                proxy_buffering off;
                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
                proxy_pass http://localhost:8082/api/socket;
        }
        location / {
                set $allowed_and_permitted 'nok';
                if ($ssl_client_verify = SUCCESS) {
                        set $allowed_and_permitted 'ok';
                }
                if ($request_method = 'POST') {
                        set $allowed_and_permitted 'ok';
                }
                if ($allowed_and_permitted = 'nok') {
                        return 403;
                }
                proxy_pass http://localhost:8082/;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Host $host:$server_port;
        }

Davide