Skip to main content

Setting up Nginx + Let's Encrypt reverse proxy in front of Yucca

Introduction​

In this guide I will describe how to set up Nginx and issue a Let's Encrypt SSL certificate that will renew automatically. Nginx will act as a simple web server in front of Yucca for terminating the SSL session and redirecting from port 80 to port 443.
Why install Nginx at all, since Yucca itself can terminate SSL and even has flags for it? That's true, but once you occupy port 443, it will be unavailable to other software and you'll have to use a different one, and there will also be no redirect from HTTP to HTTPS — if that's fine with you, you can safely skip the Nginx installation and configuration section, Step 1, and go straight to Step 2.
I'll perform all the steps on Ubuntu Server 22.04, but everything will work the same way on SUSE, CentOS, Fedora, Debian, and so on. The only difference is that everyone has their own package manager, but I hope you can tell apt from zypper 🙂

Step 0. Preparation​

So, here's what we'll need:

  1. A host with a public IP address
  2. A domain or subdomain pointing to that address
  3. Yucca installed

In this guide I'll use the domain foobar.yuccastream.com, your domain will be different.

nslookup foobar.yuccastream.com
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	foobar.yuccastream.com
Address: 128.140.2.103

nginx1

So, I have Yucca, which is available at http://foobar.yuccastream.com:9910

Step 1. Installing and configuring Nginx​

Install nginx:

sudo apt install nginx

Check http://foobar.yuccastream.com

nginx2

Next, create a configuration file for Yucca:

sudo nano /etc/nginx/conf.d/yucca.conf
warning

You need to replace the domain foobar.yuccastream.com with your own

upstream yucca_upstream {
  server 127.0.0.1:9910 fail_timeout=0;
}

server {
  listen 80;
  server_name foobar.yuccastream.com;
  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://yucca_upstream;
  }
}

Save the file and check that the configuration is correct:

sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

If everything is correct, you will see syntax is ok Reload the nginx configuration:

nginx -s reload

Refresh the page and you'll already see the Yucca web interface at http://foobar.yuccastream.com

nginx3

Step 2. Installing Certbot and issuing a Let's Encrypt certificate​

Install the packages:

sudo apt install certbot python3-certbot-nginx

Issue a certificate for our domain:

warning

You need to replace the domain foobar.yuccastream.com with your own

sudo certbot --nginx -d foobar.yuccastream.com

nginx4

Certbot will ask for an E-mail (1); I recommend entering your real mailbox, in case the certificate is about to expire and fails to renew automatically, Let's Encrypt will send you a notification about it. You'll also need to agree to the terms and conditions (2), (3). Next, certbot will find the correct configuration file with the required domain on its own, configure the SSL section and the redirect, and show you a link at the end. You can see what the result looks like in the file /etc/nginx/conf.d/yucca.conf


upstream yucca_upstream {
  server 127.0.0.1:9910 fail_timeout=0;
}

server {
  server_name foobar.yuccastream.com;
  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://yucca_upstream;
  }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/foobar.yuccastream.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/foobar.yuccastream.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = foobar.yuccastream.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name foobar.yuccastream.com;
    return 404; # managed by Certbot
}

I recommend making sure that certbot has created a timer for renewing the certificate; it should be active:

sudo systemctl status certbot.timer
● certbot.timer - Run certbot twice daily
     Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled)
     Active: active (waiting) since Fri 2023-09-22 11:54:02 UTC; 7min ago
    Trigger: Fri 2023-09-22 14:13:25 UTC; 2h 11min left
   Triggers: ● certbot.service

Sep 22 11:54:02 foobar systemd[1]: Started Run certbot twice daily.

Refresh the page http://foobar.yuccastream.com and you'll see everything already working over HTTPS, and the redirect works too.

nginx5

Step 3. Security configuration​

We've set up access via HTTPS through nginx, but Yucca is still available over HTTP at http://foobar.yuccastream.com:9910. This is due to this default setting:

listen_address = ":9910"

Go to the Yucca configuration file and edit this parameter:

sudo nano /opt/yucca/yucca.toml

Make Yucca listen on localhost only:

listen_address = "127.0.0.1:9910"

And restart the Yucca server:

sudo systemctl restart yucca

Check that now there's nothing at http://foobar.yuccastream.com:9910, while https://foobar.yuccastream.com works fine.