Nginx - serve flask python on https and another port without https
<p>What I'm trying to accomplish.
Have a domain on https. Check. it's working ok using the following config. The flask app runs on port 1337 -> nginx takes it -> serves it though https. Everything is working nicely</p>

<p>Now I want to run another app, on port 1338 let's say. But if I do this, the browser (chrome) automatically redirects it to https.
I want: <a href="http://domain.com:1338" rel="nofollow">http://domain.com:1338</a>  .... to run ok
I get: <a href="https://domain.com:1338" rel="nofollow">https://domain.com:1338</a> ... error certificate</p>

<p>My question is: how can I make the other app (on port 1338) either work with https:// or to work with http://</p>

<p>Here's my config...</p>

<pre><code>server {
        listen 80 default_server;
        listen [::]:80 default_server;


        root /home/cleverbots;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name _;



        # SSL configuration
        #
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;

        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        # Disable preloading HSTS for now.  You can use the commented out header line that includes
        # the "preload" directive if you understand the implications.
        #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        ssl_dhparam /xxxxxx/dhparam.pem;




        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }


        location / {
                try_files $uri @tornado;
        }

        location @tornado {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1337;
        }



}
</code></pre>

<p>The answer to your question depends on what exactly you want the user experience to be.</p>

<p>As I understand your goal, you only have one domain (example.com). Your first app, (I'm going to call it <code>app1337</code>) is running on port 1337 and you can access in a browser at <a href="https://example.com/" rel="nofollow">https://example.com/</a>. Now you want to add another app (<code>app1338</code>) that you want to be able to access at <a href="https://example.com:1338/" rel="nofollow">https://example.com:1338/</a>. The problem here is that only one service can run on a given port on a given interface. This can work, but means that you have to be really careful to make sure that your flask app <em>only</em> listens on loopback (127.0.0.1) and Nginx only listens on your Ethernet interface. If not, you'll get "socket already in use" errors. I would recommend instead using something else like 8338 in Nginx to avoid this confusion.</p>

<p>The fastest solution I can see would be to leave your existing server block exactly as is. Duplicate the entire thing, and in the new block:</p>

<ol>
<li>Change the 2 <code>listen 443</code> lines to the port you want to use in browser
(8338).</li>
<li>Remove the <code>listen 80</code> lines or, if you want to serve the app on both ssl and non-ssl,  change the port to the non-ssl port you want to use.</li>
<li>Change your <code>proxy_pass</code> line to point to your second flask app.</li>
</ol>

<p>Like Keenan, I would recommend you use subdomains to sort your traffic. Something like <a href="https://app1337.example.com/" rel="nofollow">https://app1337.example.com/</a> and <a href="https://app1338.example.com/" rel="nofollow">https://app1338.example.com/</a> to make for a better user experience. To do this, duplicate the server block as above, but this time leave the ports the same, but change the "server_name" directive in each block to match the domain. Remove all of the "default_server" parts from the listen directives.</p>

<p>As an example:</p>

<pre><code>server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name app1337.example.com;

        # SSL configuration 
        # Certificate and key for "app1337.example.com"
        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        # The rest of the ssl stuff is common and can be moved to a shared file and included
        # in whatever blocks it is needed.
        include sslcommon.conf;

        root /home/cleverbots;
        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }

        location / {
                try_files $uri @tornado;
        }

        location @tornado {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1337;
        }
}
server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name app1338.example.com;

        # SSL configuration 
        # Certificate and key for "app1338.example.com"
        ssl_certificate     /xxxxxxxxxx.crt;
        ssl_certificate_key /xxxxxxxxxx.key;

        # The rest of the ssl stuff is common and can be moved to a shared file and included
        # in whatever blocks it is needed.
        include sslcommon.conf;

        ## This might be different for app1338
        root /home/cleverbots;
        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        ## This might be different for app1338
        location /static/ {
               expires 30d;
               add_header Last-Modified $sent_http_Expires;
               alias /home/my_first_app/application/static/;
        }

        location / {
                try_files $uri @app1338;
        }

        location @app1338 {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass       http://127.0.0.1:1338;
        }
}
</code></pre>

python nginx flask