Expose only dashboard via nginx reverse proxy

Dashboard
1

Hello,

Is it possible to expose Nodered's UI Dashboard via an nginx reverse proxy? I want to have something like:

LAN:
192.168.1.10 <--- Nodered instance
192.168.1.10/ui <--- Nodered UI Dashboard
192.168.1.11/nodered <-- nginx reverse proxy pointing to 192.168.1.10/ui

Internet:
mydomain.com/my-nodered <-- nginx reverse proxy pointing to 192.168.1.10/ui exposed on internet (behind Authelia auth)

I understand that there's some websocket connections that happen between the UI and Nodered. Wondering if I can just expose the /ui folder directly and everything will still work?

2

Yes, you can do that, you just need to only proxy the /ui path. You will also need to proxy websockets though even for just the Dashboard because the ws connection is from the browser to Node-RED.

3

Thanks! Will give it a try once I've finished the flow, and paste my results here.

4

It works!

Here's the config I used:

  location ~/my-nodered/?(.*)?$ {
    if ($request_uri ~ /my-nodered$ ) {
      add_header Content-Type text/html;
      return 200 '<meta http-equiv="refresh" content="0; URL=$uri/" />';
    }

    # If not using Authelia, a cookie can be checked to use as "authentication". Comment out if not needed
    set $valid_cookie 0;
    if ($cookie_mySecretCookieName = "mySecretCookieValue") {
      set $valid_cookie 1;
    }
    # Redirect if cookie not set. Comment out if not needed
    if ($valid_cookie = 0) {
      return 302 https://my-domain.com;
    }

    # For websockets
    proxy_set_header Connection "upgrade";
    proxy_set_header Upgrade $http_upgrade;
    proxy_cache_bypass  $http_upgrade;
    proxy_set_header X-Real-IP $remote_addr;
    
    proxy_buffering off;
    proxy_pass_request_headers on;

    # Point to NodeRed:
    proxy_pass http://192.168.1.10;
    rewrite ^/my-nodered/(.*)$ /ui/$1 break;

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # Authelia configs:
    include conf.d/proxy.config;
    include conf.d/auth.config;
  }

Note that this is part of a larger config.

3 Likes
5

How have I missed that! I'll be trying that out shortly - it might finally solve my end-to-end security example for uibuilder with NGINX as the proxy.

Thanks for sharing that, very useful.

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.