Documentation - example or discussion forum for proxy with straight ssl passthrough (maybe stream)

[HeneryH]

Is your feature request related to a problem? Please describe

A clear and concise description of what the problem is. Ex. I'm always frustrated when ...
I've been running reverse proxies and am finally getting better at the various configurations. Now I have a server behind the proxy that handles ssl itself on 443 so I need my reverse proxy to simply pass that connection through unchanged based on the server_name.

Problem = (either no example code) | (no community forum to ask questions) | (I really don't understand how to learn this myself from the source)

Describe the solution you'd like

A clear and concise description of what you want to happen.
I think that the stream template is what I want. Can we get a sample of how to instantiate a server block for streams?
Is there a forum to ask these types of questions?

Describe alternatives you've considered

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[alessfg]

At a very basic/generic level, you can find sample playbooks under the molecule directory. If you are looking for a stream template, you can look at the example here https://github.com/nginxinc/ansible-role-nginx-config/blob/main/molecule/default/converge.yml#L488-L520.

Documentation is a (rather slow) WIP, but it's on the roadmap. For now, GitHub issues is the best place to ask configuration questions.

[x4FF3]

Hi, this should be adressed now...i have a working config with 0.3.3 which i wanted to update to 0.6.0. i now have a week into it, but cannot get it to work...

actually i dont get it. this is such a nice ansible role. but basically wasted, because i will avoid this now and write my configs again manually...

[alessfg]

That is sad to hear! I totally understand your reasoning and I'll hopefully be able to create better documentation sometime in the near future. The "core" NGINX role is pretty much there in terms of docs/distinct scenarios showing various use cases. I hope to move onto this role shortly after.

[creshal]

I do hope "sometime in the neat future" happens soon. As is, I have two choices:

• Read the excellent general nginx documentation and write myself a 15 lines long jinja2 template that does exactly what I want
• Try to understand this 15,000 lines long monstrosity of spaghetti conditionals to figure out why I'm getting a nonsensical, unsearchable generic error like {"msg": "obj must be a list of dicts or a nested dict"} to write more lines of yaml thank I would've written lines of nginx config, which nobody else will understand the implications of anyway, because they won't have read the 15,000 lines ansible role either

[alessfg]

There is never going to be a very easy way to document how this template works. For now, I have added a few more test scenarios covering some of the more popular use cases (which should hopefully help a few folks out there), but that is obviously not enough.

You are right though, you could create a simple template for your specific use case, but the template here is meant to cover all specific use cases. That being said, you can also use this role to:

• Push a pre-written config to your NGINX instances https://github.com/nginxinc/ansible-role-nginx-config/blob/main/defaults/main/upload.yml
• Use your own template file https://github.com/nginxinc/ansible-role-nginx-config/blob/main/defaults/main/template.yml#L15

You can do both of the above easily enough with your own Ansible tasks, so maybe that's the best path of action for your use case.

Re your second point, Jinja2 is notoriously hard to debug, and there is no way to parse errors/raise exceptions without building custom exceptions/plugins/code or parsing all the variables beforehand within an Ansible task. Both options would require a rather extensive coding effort to properly implement. I have very limited bandwidth, and with some exceptions, most of the work done on these Ansible roles is done on a best effort basis on my end. PRs are always welcome though!