Add SSL to streams #3789

jbowring · 2024-06-02T20:01:14Z

Support for SSL for streams with TCP forwarding enabled. Uses the same web interface as creating a new Proxy Host for adding SSL.

Details

An Nginx stream config created with this SSL feature looks like this:

# ------------------------------------------------------------
# 1883 TCP: 1 UDP: 1
# ------------------------------------------------------------

server {
  listen 1883 ssl;
  listen [::]:1883 ssl;

  # Let's Encrypt SSL
  include conf.d/include/ssl-cache-stream.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-9/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-9/privkey.pem;

  proxy_pass google.com:443;

  # Custom
  include /data/nginx/custom/server_stream[.]conf;
  include /data/nginx/custom/server_stream_tcp[.]conf;
}

server {
  listen 1883 udp;
  listen [::]:1883 udp;

  proxy_pass google.com:443;

  # Custom
  include /data/nginx/custom/server_stream[.]conf;
  include /data/nginx/custom/server_stream_udp[.]conf;
}

Nginx doesn't allow stream and http blocks to share an SSL cache, so all streams have a separate SSL cache defined in ssl-cache-stream.conf:

ssl_session_cache shared:SSL_stream:50m;

Use a DNS Challenge is forced as streams cannot perform HTTP authentication for issuing certificates.

Streams do not have ___domain names associated with them in the database or displayed in the UI, as streams are not proxied by hostname but exclusively by port.

jbowring · 2024-06-03T12:29:41Z

Related: #3368 #2542 #1829 #795

RobertPosluszny · 2024-07-17T19:56:07Z

@jbowring Do you have plans to update this PR with future releases?

jbowring · 2024-07-23T07:46:41Z

@RobertPosluszny thanks for testing this PR and your feedback. I think I've found the issue you described and fixed it, please check and let me know!

I'll do some more testing myself and then update this PR with a pull from the develop branch.

jbowring · 2024-07-23T07:47:26Z

@jc21 what else needs to be done before this PR can be merged? Thanks.

RobertPosluszny · 2024-07-25T13:48:33Z

@jbowring looks like the issue of editing stream settings after creation was resolved! Thanks!

JanzenJohn · 2024-09-29T11:19:02Z

When testing the linked CI image the following error is shown in the browser console when trying to create a stream

TypeError: e[t] is undefined
    r https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    190 https://MY-DOMAIN/js/14.bundle.14.js?v=2.11.3:1
    190 https://MY-DOMAIN/js/14.bundle.14.js?v=2.11.3:1
    r https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    promise callback*showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    click ui.action@https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    dispatch https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    handle https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    add https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    on https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegate https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    _ensureElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    View https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    constructor https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showEmpty https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    promise callback*onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    O https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    render https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    ae https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    show https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showChildView https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showAppContent https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:310
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    promise callback*showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    Ze https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    s https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
[main.bundle.js:1:1930](https://MY-DOMAIN/js/main.bundle.js?v=2.11.3)
    oe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    (Async: promise callback)
    showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    click @ui.action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    dispatch https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    handle https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    (Async: EventListener.handleEvent)
    add https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    on https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegate https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    _ensureElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    View https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    constructor https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showEmpty https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    (Async: promise callback)
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    O https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    render https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    ae https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    show https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showChildView https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showAppContent https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:310
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    (Async: promise callback)
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    Ze https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    s https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
Uncaught (in promise) TypeError: e[t] is undefined
    r https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    190 https://MY-DOMAIN/js/14.bundle.14.js?v=2.11.3:1
    190 https://MY-DOMAIN/js/14.bundle.14.js?v=2.11.3:1
    r https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    promise callback*showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    click ui.action@https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    dispatch https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    handle https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    add https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    on https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegate https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    _ensureElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    View https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    constructor https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showEmpty https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    promise callback*onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    O https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    render https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    ae https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    show https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showChildView https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showAppContent https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:310
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    promise callback*showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    Ze https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    s https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
[main.bundle.js:1:356](https://MY-DOMAIN/js/main.bundle.js?v=2.11.3)
    oe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:1
    (Async: promise callback)
    showNginxStreamForm https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    click @ui.action https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    dispatch https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    handle https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    (Async: EventListener.handleEvent)
    add https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    each https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:16
    xe https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    on https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegate https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    delegateEvents https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    setElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    _ensureElement https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    View https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    constructor https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showEmpty https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    (Async: promise callback)
    onRender https://MY-DOMAIN/js/9.bundle.9.js?v=2.11.3:1
    O https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    render https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    ae https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    show https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showChildView https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showAppContent https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:310
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    (Async: promise callback)
    showNginxStream https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:27
    Ze https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    i https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3
    s https://MY-DOMAIN/js/main.bundle.js?v=2.11.3:3

RobertPosluszny · 2024-10-16T16:15:49Z

@jbowring any way to update this PR to keep in line with the latest updates? Is there a way I can help keep that in line until this PR gets merged into develop or latest?

aaron-neal · 2024-10-24T07:32:06Z

This would be such a useful feature for anyone trying to secure their MQTT servers to the outside world, thanks for doing it, would be amazing to see this eventually merged to main.

jbowring · 2024-10-31T21:03:48Z

@RobertPosluszny sorry I've been unable to maintain this for a while. I've added you as a collaborator to my repository; feel free to keep it up to date and update this pull request.

alphalove · 2024-11-28T14:16:40Z

Hello, like a lot of people I'd really like to get SSL for MQTT working within NPM.

The dock image mentioned above at jc21/nginx-proxy-manager:github-pr-3789, it no longer there. I a way I can get this docker image?

Thanks in advance!

jbowring · 2024-12-01T23:05:54Z

The image built above (build 7) doesn’t actually work, there’s an issue with the schema somewhere. I’ll update it when I’ve fixed the problem. Please don’t use it in the meantime.

alphalove · 2024-12-02T05:42:10Z

@jbowring - thanks for your effort on integrating SSL for streams, its really appreciated. This will be a great feature for NPM. Given the number of open pull requests, looks like being the NPM maintainer might be a full time job!

oblom86 · 2025-01-11T09:32:22Z

I am new in Nginx stream. I want get something like that:
connect to sstp.example.com:443 and stream to the 192.168.0.60:443;
connect to www.example.com:443 and proxy to the 192.168.0.50:443;
Will it work?

alphalove · 2025-01-11T13:02:15Z

I am new in Nginx stream. I want get something like that: connect to sstp.example.com:443 and stream to the 192.168.0.60:443; connect to www.example.com:443 and proxy to the 192.168.0.50:443; Will it work?

I use this for securing MQTT streams, along side a bunch of other web services, but I believe, what your asking for will work. The sstp. sub-___domain can proxy to something different than www.

I really wish the excellent addition would be merged into the main branch!

oblom86 · 2025-01-11T14:05:29Z

I use this for securing MQTT streams, along side a bunch of other web services, but I believe, what your asking for will work. The sstp. sub-___domain can proxy to something different than www.

I really wish the excellent addition would be merged into the main branch!

What would the configuration look like? Do I need to set up a 'Proxy Hosts' to localhost and then reroute with 'Streams'? Like that?

stuzer05 · 2025-01-28T17:00:21Z

Will this be merged?

alphalove · 2025-02-01T13:22:00Z

Will this be merged?

Let's hope so. Looks like a perfect addition to current NPM functionality. Unfortunately, I'm not sure how we persuade the NPM maintainer to add this PR over any others.

JanzenJohn · 2025-02-03T16:01:05Z

Docker Image for build 13 is available on DockerHub as nginxproxymanager/nginx-proxy-manager-dev:pr-3789

Note: ensure you backup your NPM instance before testing this image! Especially if there are database changes Note: this is a different docker image namespace than the official image

I get the error SQLITE_ERROR: no such column: domain_names, I thought the schema is fixed in this version?

mkerost · 2025-02-03T16:45:57Z

Will this be merged?

Unfortunately, I'm not sure how we persuade the NPM maintainer to add this PR over any others.

Buy some coffee for the maintainer (see github homepage) and mention this feature. No guarantees but a little extra caffeine can't hurt, no?

nginxproxymanagerci · 2025-02-04T06:59:43Z

Docker Image for build 14 is available on
DockerHub
as nginxproxymanager/nginx-proxy-manager-dev:pr-3789

Note: ensure you backup your NPM instance before testing this image! Especially if there are database changes
Note: this is a different docker image namespace than the official image

jc21 · 2025-02-04T08:20:27Z

I've rebased this PR with latest changes and pushed to the stream-ssl branch.

You may test with this docker image:

nginxproxymanager/nginx-proxy-manager-dev:stream-ssl

but beware, this contains a database migration and you won't be able to go back to the latest code very easily, so you really should back up your database, data and letsencrypt folders before using this image.

I would like to write an integration test for this before merging but I can't seem to think of a simple use case. I may just have to use openssl to test the ciphers but it won't be a full end to end test.

alphalove · 2025-02-04T08:53:51Z

I've rebased this PR with latest changes and pushed to the stream-ssl branch.

You may test with this docker image:
nginxproxymanager/nginx-proxy-manager-dev:stream-ssl
but beware, this contains a database migration and you won't be able to go back to the latest code very easily, so you really should back up your database, data and letsencrypt folders before using this image.

I would like to write an integration test for this before merging but I can't seem to think of a simple use case. I may just have to use openssl to test the ciphers but it won't be a full end to end test.

That's awesome news, I will update and test. Thank you very much!

jc21 · 2025-02-05T08:03:29Z

Closing this PR and about to merge #4344

jbowring · 2025-02-12T20:59:08Z

Thanks for merging this @jc21 and thank you for your efforts in maintaining NPM!

jbowring added 4 commits June 2, 2024 20:32

Add SSL certificate to TCP streams if certificate in database

b8b80d3

Add SSL tab to stream UI

0cf7ed9

Add SSL column to streams table UI

1d3d5be

Add certificate to streams database model

7307515

braian87b mentioned this pull request Jul 10, 2024

Add SSL and Host support for streams #1829

Open

Fix whitespace in nginx stream config

ae1255d

jbowring force-pushed the stream-ssl branch from 7a2a6b4 to ae1255d Compare July 22, 2024 19:58

Fix stream update not persisting

207dbb2

Merge branch 'NginxProxyManager:develop' into stream-ssl

d3526de

jbowring force-pushed the stream-ssl branch from 76c728a to d3526de Compare December 1, 2024 22:28

jbowring force-pushed the stream-ssl branch from 82bc051 to 13e0f8b Compare December 2, 2024 21:18

Merge branch 'NginxProxyManager:develop' into stream-ssl

e4c1013

jbowring force-pushed the stream-ssl branch from 13e0f8b to e4c1013 Compare December 2, 2024 21:30

Merge branch 'develop' into stream-ssl

a262ad1

jc21 mentioned this pull request Feb 5, 2025

SSL for Streams - 2025 #4344

Merged

jc21 closed this Feb 5, 2025

Add SSL to streams #3789

Add SSL to streams #3789

Uh oh!

Conversation

jbowring commented Jun 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Uh oh!

jbowring commented Jun 3, 2024

Uh oh!

RobertPosluszny commented Jul 17, 2024

Uh oh!

jbowring commented Jul 23, 2024

Uh oh!

jbowring commented Jul 23, 2024

Uh oh!

RobertPosluszny commented Jul 25, 2024

Uh oh!

JanzenJohn commented Sep 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RobertPosluszny commented Oct 16, 2024

Uh oh!

aaron-neal commented Oct 24, 2024

Uh oh!

jbowring commented Oct 31, 2024

Uh oh!

alphalove commented Nov 28, 2024

Uh oh!

jbowring commented Dec 1, 2024

Uh oh!

alphalove commented Dec 2, 2024

Uh oh!

oblom86 commented Jan 11, 2025

Uh oh!

alphalove commented Jan 11, 2025

Uh oh!

oblom86 commented Jan 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stuzer05 commented Jan 28, 2025

Uh oh!

alphalove commented Feb 1, 2025

Uh oh!

JanzenJohn commented Feb 3, 2025

Uh oh!

mkerost commented Feb 3, 2025

Uh oh!

nginxproxymanagerci bot commented Feb 4, 2025

Uh oh!

jc21 commented Feb 4, 2025

Uh oh!

alphalove commented Feb 4, 2025

Uh oh!

jc21 commented Feb 5, 2025

Uh oh!

jbowring commented Feb 12, 2025

Uh oh!

Uh oh!

jbowring commented Jun 2, 2024 •

edited

Loading

JanzenJohn commented Sep 29, 2024 •

edited

Loading

oblom86 commented Jan 11, 2025 •

edited

Loading