Hallo ,
I am currently in the process of reverse proxying a subdomain (client-domain-portal.rexx-systems.com) to another domain (client-domain.com) and have encountered some difficulties that I hope you can assist me with.
For clarity:
- I have used “client-domain-portal” as a placeholder for the actual subdomain name in this context.
- rexx-systems.com is a job portal and is an third party service provider. client-domain.com uses its services.
Our primary domain, client-domain.com, is hosted on HubSpot. The challenge arises when I attempt to reverse proxy from “client-domain-portal.rexx-systems.com” to the HubSpot-hosted domain, as these two domains are distinct. My initial assumption was that it might not be feasible to reverse proxy “client-domain-portal.rexx-systems.com” to a subdomain of “client-domain.com” (like jobs.client-domain.com).
To troubleshoot, I tried to add the equivalent subdomain (client-domain-portal.client-domain.com) to the HubSpot Domain Manager without directly connecting it. Unfortunately, this attempt wasn’t successful. I also attempted to add “client-domain-portal.rexx-systems.com” as suggested on Hubspot offical documentation for reverse proxy support. In this documentation: I read that the “added to HubSpot but not directly connected” domain must match the domain being requested through the reverse proxy, but this too was met with the same hurdle.
Considering the above, I would greatly appreciate if you could provide guidance on how to structure the Nginx configuration file in this particular scenario and clarify which domains are permissible to add.
For your reference, the HubSpot CNAME is something like XXXXXX67.sites-proxy.hscoscdn10.net.
The following is a summary of how I understand it, please correct me, if I am wrong:
- Domain ownership verification via pre-provisioning an SSL certificate is a crucial step: no direct domain connection ==> only the “pre-provisioning DNS records” have to be added to the DNS provider.
- the origin connection (proxy connection) is a HubSpot CNAME.
Host = X-HS-Public-Host = the content host domain “added to HubSpot Domain Manager but not directly connected” = HubSpot domain where content will be served from. ==> HubSpot systems are ‘aware’ of the domain.
Based on that
server {
location /karrieres {
proxy_set_header Host $http_host;
proxy_pass_request_headers on;
proxy_pass https://XXXXXX67.sites-proxy.hscoscdn10.net;
proxy_set_header Accept-Encoding "";
ssi on;
proxy_set_header X-HS-Public-Host https://client-domain-portal.rexx-systems.com;
proxy_ssl_server_name on;
proxy_ssl_name https://client-domain-portal.rexx-systems.com;
proxy_set_header X-HubSpot-Trust-Forwarded-For true;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-HubSpot-Client-IP $proxy_protocol_addr;
}
}
Should I change $http_host to the content host domain?
Is it right to have X-HS-Public-Host and proxy_ssl_name set to the same domain?
For testing purposes, I am using an Nginx Docker image for reverse proxying. I am wondering if this could be the source of the current issues? It is worth noting that the reverse proxy operates as expected when I direct client-domain-portal.rexx-systems.com to localhost.
My initial plan was to deploy the Docker image on Google Cloud Run. However, based on some recent findings, I am now considering Amazon CloudFront or AWS EC2/ELB as possible alternatives. Google Cloud CDN or Google Cloud Load Balancing are also on the table, but cost considerations will be a deciding factor.
If anything is unclear, please do not hesitate to ask me.
Thank you in advance for your time and assistance. I look forward to your expert guidance on this matter.
Best regards,
Abdalrohman Alsalkhadi