Nginx – http3 support for upstream on nginx or any other webserver

My http/https configuration using centos and nginx from the EPEL repo is as follows:

/etc/nginx/nginx.conf

user              nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include           /etc/nginx/mime.types;
    default_type      application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log         /var/log/nginx/access.log  main;
    sendfile           on;
    tcp_nopush         on;
    keepalive_timeout  65;
    gzip  on;

    server {
        listen          80;
        server_name     rproxy.yourdomain.co.uk;
        ## use when niginx listens on a nonstandard port - the port in the rewrite 
        ## rule needs to be the port nginx is actually listening on.
        #rewrite     ^(.*)   https://rproxy.yourdomain.co.uk:80$1 permanent; 
        access_log      /var/www/rproxy.yourdomain.co.uk/log/nginx.access.log;
        error_log       /var/www/rproxy.yourdomain.co.uk/log/nginx_error.log debug;

        location / {
            proxy_pass  http://192.168.xx.x:81;
            proxy_redirect          default;
        }

        error_page  404              /404.html;
        location = /404.html {
            root   /usr/share/nginx/html;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

    }

    server {
        listen          443;
        server_name     rproxy.yourdomain.co.uk;
        ## use when niginx listens on a nonstandard port - the port in the rewrite 
        ## rule needs to be the port nginx is actually listening on.
        #rewrite     ^(.*)   https://rproxy.yourdomain.co.uk:443$1 permanent;
        ssl                             on;
        ssl_certificate                 /etc/pki/tls/certs/ca.crt;
        ssl_certificate_key             /etc/pki/tls/private/ca.key;
        ssl_session_timeout             5m;
        ssl_protocols                   SSLv2 SSLv3 TLSv1;
        ssl_ciphers                     ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
        ssl_prefer_server_ciphers       on;

        access_log      /var/www/rproxy.yourdomain.co.uk/log/nginx.access.log;
        error_log       /var/www/rproxy.yourdomain.co.uk/log/nginx_error.log debug;

        location / {
            proxy_pass  https://192.168.xx.x:444;  
            proxy_redirect          default;
        }

        error_page  404              /404.html;
        location = /404.html {
            root   /usr/share/nginx/html;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

    }

    include /etc/nginx/conf.d/*.conf;
}

/etc/nginx/conf.d/proxy.conf

## $proxy_port setting string is needed when
## nginx is listening on a nonstandard port
#proxy_set_header        Host            $host:$proxy_port;
#proxy_set_header        X-Real-IP       $remote_addr:$proxy_port;
#proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for:$proxy_port;
proxy_set_header        Host            $host;
proxy_set_header        X-Real-IP       $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
client_max_body_size    10m;
client_body_buffer_size 128k;
client_header_buffer_size 64k;
proxy_connect_timeout   90;
proxy_send_timeout      90;
proxy_read_timeout      90;
proxy_buffer_size   16k;
proxy_buffers       32   16k;
proxy_busy_buffers_size 64k;

The link below gives the full details of my centos and nginx configuration:

http://www.zen212739.zen.co.uk/centos5-5/pub-centos-rproxy-nginx-install.txt

I only use one domain for webmail access, but adding another domain to this nginx config should not be too difficult.

Using nginx for an imap proxy is a little more difficult so set up. I am still looking into this myself.

Smtp traffic needs a store and forward mail server. A separate postfix setup would probably be a better option.

I set up a intel atom based centos xen server with a few vm's to essentially the same thing that you are attempting to do.

You won't be able to do what you want. You either:

1. Need to obtain a valid certificate for both domains and use the serverHost directives to redirect off SSL (to http://) if you truly don't want to run SSL on that domain.
2. Need to obtain a second IP address and run the domains on seperate IP addresses.
3. Leave SSL Enabled and serve an invalid certificate for domain1

WHY:

1. A client types https://domain1.com/ in a browser
2. The browser resolves this to a TCP connection to on port 443
3. The magic of the internet routes this connection to your server and hopefully into your web server software
4. The client browser is standing at the front door waiting for the proper 'secret handshake' (SSL Cert.)
5. Your server tries the only handshake it knows (which is wrong)
6. The client's browser informs the client that "This guy at the door of domain1.com... He's not who he says he is. This is sketchy"
7. Today, will click the variant of "Proceed Anyway" that their browser presents
8. IF you disable SSL on domain1.com, the user will be shown the other site (quite confusing for the user)
9. IF you leave SSL enabled on domain1.com, modern browsers and webservers will communicate and show the correct site. (albeit, with a scary warning)

If you intend to host domain1.org @ ip on port 80 and domain2.org at ip on port 443 (so that domain2 does not have HTTP access, it should 'work'). Remove the 443 listener for domain1. You will be prompted if any audacious users type https://domain1.org (and then shown domain2). That setup is essentially Port based virtual hosting.Instead of picking random ports you have picked the two defaults and given them to separate virtual hosts. Ultimately in this setup (WITH SSL laying around) the webserver doesn't really care what domain the browser is asking for in the Host header. The web server just cares about the ip:port combo in port based virtual hosts.