Using IBM Cloud Direct Link to connect to IBM Cloud Object Storage

Installing your Nginx reverse proxy

NginX is a mature, compact, and fast open source web server that excels at specialized tasks, including the reverse proxy server role.

The instructions and configuration information that follows (for setting up an NginX reverse proxy server) can work after you adapt it to your environment. If you get stuck or need additional information, see the reverse proxy portion of the Nginx documentation or search stackoverflow for examples.

1. Provision your VSI or bare metal servers with minimal RHEL or CentOS Linux build (recommended).
2. For each VSI, enable the following security group rules on the public interface: allow_http, allow_https, allow_outbound, allow_ssh
3. For each VSI, enable allow_all and allow_outbound rules on the private interface; select Save.
4. Using PuTTY in Windows or your desktop's terminal program, ssh into your new server as root.
5. Upgrade your operating system OS (yum update).
6. Install the EPEL repository (yum install epel-release).
7. Install NginX (yum install nginx).
8. Start NginX (nginx) and open your server's IP address in a browser.
9. The default location of nginx.conf is /etc/nginx. Create a safe copy.
10. Move the sample nginx.conf configuration file into /etc/nginx.
11. Purchase SSL certificates through the IBM Cloud console or run the command yum install easy-rsa and see your favorite online docs for tips on creating self-signed certificates.
12. Add your certificate information to the configuration file, nginx.conf.
13. Test the modified NginX configuration with the command nginx -t.
14. If your test passes, restart nginx with the command nginx -s quit; sleep 3; nginx.
15. Your client can now submit COS requests to the IPs or URLs of the NginX (proxy) server.

Notes:

• The solution assumes that Direct Link was ordered and properly deployed, although it can be tested without it.
• Optional memory or disk cache can be used with proxy_cache.
• A longer proxy_read_timeout value might be needed for larger file transfers.
• Use keepalive or Pacemaker for High Availability (automatic failover).

Configuration file: nginx.conf

The sample configuration file is shown in the following section. You can copy and paste it.

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   5;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  10m;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_intercept_errors on;

    # IBM COS Endpoints
    # US
    server {
        listen       443 ssl http2;
        server_name  us-cos.myibmcloud.com;
        ssl_certificate "/etc/pki/tls/certs/star.myibmcloud.com.pem";
        ssl_certificate_key "/etc/pki/tls/private/star.myibmcloud.com.key";
        location / {
            proxy_set_header Host $server_name;
            proxy_pass https://s3-api.us-geo.objectstorage.service.networklayer.com;
        }
    }

    # Dallas
    server {
        listen       443 ssl http2;
        server_name  dal-cos.myibmcloud.com;
        ssl_certificate "/etc/pki/tls/certs/star.myibmcloud.com.pem";
        ssl_certificate_key "/etc/pki/tls/private/star.myibmcloud.com.key";
        location / {
            proxy_set_header Host $server_name;
            proxy_pass https://s3-api.dal-us-geo.objectstorage.service.networklayer.com;
        }
    }
}

See Endpoints and storage locations for a list of private endpoints for use in these proxy_pass entries.

Tips:

• To boost scale and resiliency, deploy multiple proxy servers that are associated with different endpoints.
• Use round-robin DNS on the client side for rudimentary failover and load-balancing capabilities.
• Proxy servers can be placed behind a Virtual Router Appliance (VRA) for protection and centralized logging.