I'm trying to set up the following:
┌──────────────────┐ ┌────────────────────┐ ┌─────────┐
│ │ │ │ │ │
│ Router │ │ │ │Server 1 │
│ NAT │Port forward│ │ │ │
│ │ ────────► │ Server 0 │ │HTTP > │
│ │ │ │ │HTTPS │
│ │ │ 1.example.com ───────────► │redirect │
│ │ │ 2.example.com ────┐ └─────────┘
└──────────────────┘ └────────────────────┘ │ 192.168.178.8
192.168.178.4 │
│ ┌─────────┐
│ │ │
│ │ │
│ │Server 2 │
└─► │ │
│HTTP only│
│ │
└─────────┘
192.168.178.7
I want server 0 to act as a fully transparent proxy that only forwards the traffic. So that the clients don't establish TLS connection with server 0, but directly with server 1/2 and the HTTP-01 challenge based automated certificate generation and renewal on server 1/2 still works.
Edit: If you are concerned about the connection between your reverse proxy (that terminates the SSL tunnel) and the content server being unsecured, although this does work and is secure, you might be better off configuring upstream SSL or a secure tunnel like SSH or IPSEC between the content server and your reverse proxy.
I got it working:
File structure:
nginx.conf
docker-compose.yml
http_server_name.js
Documentation:
ngx_http_upstream_module
ngx_http_map_module
ngx_stream_proxy_module
Edit:
Read this blog post for more info