Varnish with NGINX SSL proxy 502 error Magento 2

Question

I am trying to setup an nginx backend with Varnish and magento 2.3.2. To do that the flow would be: Port 80 is forwaded to 443. 443 proxypass to Varnish Listener on 8080.

Here is the nginx config for port 80:

upstream fastcgi_backend {
# Socket path
 server unix:/run/php/php7.2-fpm.sock;
}
server {
 listen 80;
 server_name magento-test.example.com;
 location ^~ /.well-known/acme-challenge/ {
 allow all;
 root /var/lib/letsencrypt/;
 default_type "text/plain";
 try_files $uri =404;
 }
 return 301 https://magento-test.example.com$request_uri;
}

Then the listener on port 443 with proxypass:

server {
 listen 443 ssl http2;
 server_name magento-test.example.com;
 ssl_certificate ...
 ssl_certificate_key ...
 ssl_trusted_certificate ...
 ssl_dhparam /etc/ssl/certs/dhparam.pem;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL';
 ssl_session_cache shared:SSL:10m;
 ssl_session_timeout 24h;
 keepalive_timeout 300s;
 location / {
 proxy_pass http://127.0.0.1;
 proxy_set_header Host $http_host;
 proxy_set_header X-Forwarded-Host $http_host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header Ssl-Offloaded "1";
 proxy_set_header X-Forwarded-Proto https;
 proxy_set_header X-Forwarded-Port 443;
 #proxy_hide_header X-Varnish;
 #proxy_hide_header Via;
 proxy_set_header X-Forwarded-Proto $scheme;
}
}

And finally the listener on port 8080:

server {
 server_name magento-test.example.com;
 listen 8080;
 set $MAGE_ROOT /var/www/magento-test.example.com;
 set $MAGE_MODE production; # or developer
 include /var/www/magento-test.example.com/nginx.conf.sample;
}

My varnish is configured the following way:

DAEMON_OPTS=" -a :6081 \
 -T localhost:6082 \
 -f /etc/varnish/default.vcl \
 -S /etc/varnish/secret \
 -p feature=+esi_ignore_other_elements \
 -p cli_buffer=16384 \
 -p vcc_allow_inline_c=on \
 -s malloc,256m"

And

backend default {
 .host = "127.0.0.1";
 .port = "8080";
 .first_byte_timeout = 300s;
}

Now i get a 502 error and in the logs I can see the following error:

*35 connect() failed (111: Connection refused) while connecting to upstream, client: xx.xx.xx.xx

If I put the IP in a browser that directs me to a Linksys page (which is what my home router is...)

I tried to remove 127.0.0.1 localhost in the hosts file but still get the same result.

Any idea ?

Answer 1

you need to use varnish port 6081 to proxy https

location / {
 proxy_pass http://127.0.0.1:6081;

user -> nginx:80 -> nginx:443 -> varnish:6081 -> nginx:8080

• Vincent Teyssier: Yep, did that before but forgot to restart the right Varnish daemon... rebooted to be sure and now it's fine, thanks :)