A question about redirect to https with 'lb + apisix'

[Lewisyixin]

Is there any way to redirect from http to https on apisix which behind a lb meanwhile use http to proxy between lb and apisix?
We want to use apisix to replace nginx. Our nginx conf is about below..
Our ssl certs are on lb. lb's 80 port proxy to nginx 80 port and 443 port proxy to nginx 443 port.
We just want to achieve the following conditions:

1. ssl cert just on lb and nginx 443 port is just a http port
2. redirection of https is completed by nginx(because some domain don't want auto redirection)

`server{
listen 80;
server_name www.test.com;
rewrite ^(.*)$ https://$host$1 permanent;
}

server {
listen 443 ;
server_name www.test.com;
}
`

I tried to complete this on apisix but I found that a different of apisix is that mutiple http port can't handle different configs like behand. So is there any to accomplish the goal？

[tzssangglass]

You can have APISIX listen to ports 80 and 443

Then create two routes, where the vars configuration is

curl -i http://127.0.0.1:9080/apisix/admin/routes/1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "uri": "/hello",
    "host": "foo.com",
    "vars": [
        [
            "server_port",
            "==",
            80
        ]
    ]
}'

curl -i http://127.0.0.1:9080/apisix/admin/routes/1  -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "uri": "/hello",
    "host": "foo.com",
    "vars": [
        [
            "server_port",
            "==",
            443
        ]
    ]
}'

The server_port variable is used to determine which listening port the request is coming from, then configure redirect or other plugins on both routes to perform different actions.

[Lewisyixin]

before this, it seems auto redirection didn't work after proxy.
Our real data flow is two way: 1. aliyun slb 80 --> nginx 80 --> apisix 80; 2. aliyun slb 443(with only ssl cert on ) --> nginx 443(http) --> apisix 443(http)
In my opinoin, before I create two routes with different "server_port", this will fall into a redirection loop if I set "http_to_https" to true. But the actual situation seems that "http_to_https" didn't work. Here's the log:

1. I curl from nginx server to apisix, results are as expected that we got a 301 redirection

2. I curl from client to slb, I just got a 200 code

the nginx log show that it proxy a http request to apisix:

and apisix log show that it got a http request

So why request from nginx to apisix didn't get 301? apisix route config is :

[tzssangglass]

I curl from nginx server to apisix, results are as expected that we got a 301 redirection
So why request from nginx to apisix didn't get 301? apisix route config is :

I can't solve your problem, it looks like you are getting the correct response from nginx to APISIX, then the problem may be in the SLB.

[Lewisyixin]

@tzssangglass Another question is that I found setting "http_to_https" must have ssl certs first, or will get error:

In my scene "apisix after slb and redirection is on apsix" , I just don't wan't save ssl certs on apisix. So could SSL cert not be the necessary conditions for http_to_https?

[tzssangglass]

In my scene "apisix after slb and redirection is on apsix" , I just don't wan't save ssl certs on apisix. So could SSL cert not be the necessary conditions for http_to_https?

SSL cert not be the necessary conditions for http_to_https

I'm not sure that SSL cert not exists for sni is return by APISIX, I can't find any message like this in APISIX.

[tzssangglass]

You can give the complete reproduction steps and find where caused the problem is.

[Lewisyixin]

I got this error by using dashboard. Just set a domain and turn on "http_to_https" when creating a route rule will easily reproduce.
I also found this error is returned by dashbord.
https://github.com/apache/apisix-dashboard/blob/88f323285f2bdbafca027da9aef357b2e3eb4008/api/internal/handler/ssl/ssl.go
So should I feedback this in dashboard project?

[tokers]

@Lewisyixin It looks like the problem is caused by the dashboard. I can't transfer the discussion there, @tzssangglass Could you transfer it?