Nginx – Running multiple website domains on Wildfly

javajbossnginx

Suppose I have many websites with different domain names, domain1.com, domain2.com, etc. I have setup the correct virtualhosts configuration for these sites in wildfly. The correct DNS entries are also in place. How do I route requests to my server for these domains to wildfly?

Do I simply run wildfly on ports 80 and 443? Something tells me this is a bad idea as wildfly does not run on these ports by default. To run wildfly on those ports require binding to those ports as a privileged user and then switching to an unprivileged user. The hassle and difficulty of doing this suggests that this isn't right.
Do I run wildfly behind nginx or apache2? My app spins up websites and virtualhost config dynamically. Can I just forward all requests to wildfly and let it deal with it?
???

Best Answer

Option 1 is possible, but as you correctly predicted it is not a preferred approach. In order to run on port 80 or 443, you need a privileged user and you are directly exposing the java server to the public, making it easier to get into trouble.
So fire up nginx, define the domains there and configure upstream and proxy_pass for reverse proxy to your wildfly instances. You get loadbalancing for free, you can handle ssl on nginx instead of wildfly and the whole setup is just so much easier to maintain and scale. You can either setup dedicated wildfly cluster for each domain and have a separate upstream definition, or you can start with a single instance with separate webcontexts e.g.

upstream jboss {
    server 192.168.33.11:8080;
}
server {
    listen 443;
    server_name example.com;

    location / {
         proxy_pass http://jboss/webapp1;
    }
} 
server {
    listen 443;
    server_name otherdomain.com;
    #pass the request to another .war dewployed on jboss
    location / {
         proxy_pass http://jboss/webapp2;
    }
}

You can find more info on nginx website

Related Solutions

Nginx – How to run multiple Nginx instances on different port

Okay, I found a solution.

What I did was run a 'master' server, as root, on port 80. From there I add server blocks for each server on their ports with a proxy_pass directive to the server.

  server {
    listen      80;
    charset     utf-8;
    server_name domain1.com;
    location / {
        proxy_pass http://domain1.com:2345;
  }
  server {
    listen      80;
    charset     utf-8;
    server_name domain2.com;
    location / {
        proxy_pass http://domain2.com:2346;
  }

Perhaps there is a more elegant solution but this seems to work well.

Java – How to run Wildfly best

Leaving the deployment scanner on is a security risk.

Set scan-enabled="false" like so:

 <subsystem xmlns="urn:jboss:domain:deployment-scanner:1.1">
     <deployment-scanner path="deployments" relative-to="jboss.server.base.dir" scan-enabled="false"/>
 </subsystem>

How you start and stop JBoss is really up to you and how you like to manage your server. There are more important things to consider when running JBoss or WildFly in production. This blog post goes over some stuff for JBoss 5. Some things have changed since then, but there is some still relevant stuff there.

One thing I notice is that you are serving requests over port 8080, directly from WildFly. There is a blog post here about securing JBoss EAP 6 , which will still apply to WildFly. The preferred way to do this, however, would be to front your server with a web server or load balancer (Apache or Nginx would do) and completely lock down your WildFly host from any external requests apart from those coming from Apache.

This is a huge topic, to be quite honest, so you will need to spend a lot of time analysing risk and making sure you understand things before potentially leaving security holes in production.

Best Answer

Related Solutions

Nginx – How to run multiple Nginx instances on different port

Java – How to run Wildfly best

Related Topic