HTTPS with Nginx Possible?

[jlpoolen]

I have an instance of martin running on a Debian (v. 12 "bookworm") server:

jlpoole@debian1:~/martin/rust/martin$ git --no-pager log -1
commit 68aca37ba216e3b2f98b1a6a57743568ae36378a (HEAD -> main, origin/main, origin/HEAD)
Author: Yuri Astrakhan <[email protected]>
Date:   Thu Jun 13 18:33:29 2024 -0400

If I set up an HTML page and reference a JSON style sheet and the JSON style sheet specifies "localhost" instead of the server name, i.e. "debian1", then I can, on the same Debian server in an instance of Firefox, view a rendered map using HTTPS. I cannot, however, access the page from another machine -- I get a CORS error. Moreover, if I alter the url value in the style sheet to the server name in place of "localhost", then I receive a CORS error in Firefox on the Debian server.

Question: Is it possible to run nginx on a server in front of the martin tile server and be able to access the map HTML page via HTTPS from another server?

Here are my notes:

Steps to make nginx.conf work after downloading from GitHub at:
https://raw.githubusercontent.com/maplibre/martin/main/demo/frontend/nginx.conf

Start up attempt 1) no changes to nginx.conf
start-up errors out:

Jul 03 08:03:18 debian1 nginx[1182238]: 2024/07/03 08:03:18 [emerg] 1182238#1182238: host not found in upstream "tiles:3000" in /etc/nginx/nginx.conf:46
Jul 03 08:03:18 debian1 nginx[1182238]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jul 03 08:03:18 debian1 systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE

Change 1

    upstream tiles_upstream {
        #server tiles:3000;
	server debian1:3000;
    }

start up attempt 2) success on same server, but fail on remote server.

Access Attempts 1:
A) on debian1 with Firefox: https://debian1/test/martin_map_SSL_2.html#14.12/44.9384/-123.02344 works
B) remote laptop with Firefox: https://debian1/test/martin_map_SSL_2.html#14.12/44.9384/-123.02344 fails with:

 `Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:3000/jlptiles. (Reason: CORS request did not succeed). Status code: (null).`

Status of nginx configuration file:

root@debian1:/etc/nginx# diff nginx.conf.GitHub nginx.conf.GitHub.MINIMAL_MODIFICATIONS
46c46,47
<         server tiles:3000;
---
>         #server tiles:3000;
>       server debian1:3000;
root@debian1:/etc/nginx# date; diff nginx.conf.GitHub nginx.conf.GitHub.MINIMAL_MODIFICATIONS
Wed Jul  3 09:05:55 AM PDT 2024
46c46,47
<         server tiles:3000;
---
>         #server tiles:3000;
>       server debian1:3000;
root@debian1:/etc/nginx# 

martin_map_SSL_2.html portions:

    ...
    15       <link rel="stylesheet" type="text/css" href="https://debian1/test/maplibre-gl.css"> 
    16       <script src="https://debian1/test/maplibre-gl.js"></script>
    ...
    44    <script>
    45      var map = new maplibregl.Map({
    46          container: 'map',
    47          style: 'https://debian1/test/martin_style_SSL_debian1.json',
    48          hash: true,
    49          center: [-123.02121, 44.935], // starting position [lng, lat] Salem, OR
    50          zoom: 16, // starting zoom
    51          maplibreLogo: true
    52      });
    53      map.scrollZoom.enable();
    54   </script>
    ...

JSON, martin_style_SSL_debian1.json, style:

    jlpoole@debian1:/usr/share/nginx/html/test$ head -n 27 martin_style_SSL_debian1.json|nl
     1  {
     2    "version": 8,
     3    "name": "Test MapLibre Martin Style",
     4    "metadata": {"maputnik:renderer": "mlgljs"},
     5    "center": [-122.98, 44.95],
     6    "zoom": 14,
     7    "bearing": 0,
     8    "pitch": 0,
     9    "sources": {
    10      "jlptiles": {
    11        "type": "vector",
    12        "scheme": "xyz",
    13        "url": "http://localhost:3000/jlptiles"
    14      },
    15      "attribution": {
    16        "attribution": "<a href=\"https://www.openmaptiles.org/\" target=\"_blank\">&copy; OpenMapTiles</a> <a href=\"https://www.openstreetmap.org/copyright\" target=\"_blank\">&copy; OpenStreetMap contributors</a>",
    17        "type": "vector"
    18      }
    19    },
    20    "sprite": [
    21      {
    22        "id": "default",
    23        "url": "https://debian1/test/sprite_dir/sprite"
    24      }
    25    ],
    26   "glyphs":"https://debian1/test/fontspbf/{fontstack}/{range}.pbf",
    27    "layers": [
    ...
jlpoole@debian1:/usr/share/nginx/html/test$ 

martin_3.config:

    mbtiles:
  sources: 
    jlptiles: ./tiles.mbtiles
fonts: ./fonts
#listen_addresses: 'debian1:3000'

martin server console:

    jlpoole@debian1:/usr/share/nginx/html/test$ ./martin -c martin_3.config 
[2024-07-03T00:54:09Z INFO  martin] Starting Martin v0.13.0
[2024-07-03T00:54:09Z INFO  martin] Using martin_3.config
[2024-07-03T00:54:09Z INFO  martin::config] Initializing main cache with maximum size 536870912B
[2024-07-03T00:54:09Z INFO  martin::file_config] Configured source jlptiles from /usr/share/nginx/html/test/tiles.mbtiles
[2024-07-03T00:54:09Z INFO  martin::fonts] Configured font Noto Sans Bold Italic with 2840 glyphs (0000-FFFD) from ./fonts/NotoSans-BoldItalic.ttf
[2024-07-03T00:54:09Z INFO  martin::fonts] Configured font Noto Sans Italic with 2840 glyphs (0000-FFFD) from ./fonts/NotoSans-Italic.ttf
[2024-07-03T00:54:09Z INFO  martin::fonts] Configured font Noto Sans Regular with 2840 glyphs (0000-FFFD) from ./fonts/NotoSans-Regular.ttf
[2024-07-03T00:54:09Z INFO  martin::fonts] Configured font Noto Sans Bold with 2840 glyphs (0000-FFFD) from ./fonts/NotoSans-Bold.ttf
[2024-07-03T00:54:09Z WARN  martin::fonts] Ignoring duplicate font Noto Sans Regular from ./fonts/Noto Sans Regular.ttf because it was already configured from ./fonts/NotoSans-Regular.ttf
[2024-07-03T00:54:09Z INFO  martin] Use --save-config to save or print Martin configuration.
[2024-07-03T00:54:09Z INFO  martin] Martin has been started on 0.0.0.0:3000.
[2024-07-03T00:54:09Z INFO  martin] Use http://0.0.0.0:3000/catalog to get the list of available sources.

Also, I have HOST defined as "debian1" in the console where the martin server is started:

	jpoole@debian1:/usr/share/nginx/html/test$ echo $HOST
	debian1
	jlpoole@debian1:/usr/share/nginx/html/test$ 

If I change "localhost" to "debian1" for the url value in the JSON,

	jlpoole@debian1:/usr/share/nginx/html/test$ date;head -n 33  martin_style_SSL_debian1.json|nl|grep url
	Wed Jul  3 10:43:20 AM PDT 2024
	    13        "url": "http://debian1:3000/jlptiles"
	    23        "url": "https://debian1/test/sprite_dir/sprite"
	jlpoole@debian1:/usr/share/nginx/html/test$ 

then in Firefox running on debian1 where I previously succeeded in viewing a rendered map, I get a CORS error:
Blocked loading mixed active content "http://debian1:3000/jlptiles"
So, whether a map renders or not is dependent upon the value of the server name in the JSON url specification.

I tried with the JSON "url" set to "debian1" these two variations of /etc/hosts, and still I get a CORS error:

	jlpoole@debian1:/usr/share/nginx/html/test$ cat -n /etc/hosts
	     1  #127.0.0.1      localhost
	     2  #127.0.0.1      debian1.salemdata.net   debian1 debian1.salemdata.us
	   ...
	    17  192.168.1.142 localhost debian1 debian1.salemdata.us
	    18
	jlpoole@debian1:/usr/share/nginx/html/test$ sudo nano /etc/hosts
	jlpoole@debian1:/usr/share/nginx/html/test$ cat -n /etc/hosts
	     1  127.0.0.1       localhost
	     2  127.0.0.1       debian1.salemdata.net   debian1 debian1.salemdata.us
	 ..
	    17  192.168.1.142 localhost debian1 debian1.salemdata.us
	    18
	jlpoole@debian1:/usr/share/nginx/html/test$ 

What am I missing or what configuration setting is awry?

[jlpoolen]

Also, the version of the JavaScript & css is from:

jlpoole@debian1:/usr/local/src/maplibre-gl-js$ date;git --no-pager log -1
Wed Jul  3 12:00:04 PM PDT 2024
commit f969cce96bdecfb90389e1cde5b6a5614182c4b5 (HEAD -> main, origin/main, origin/HEAD)
Author: Bart Louwers <[email protected]>
Date:   Fri Jun 21 12:28:38 2024 +0200

[nyurik]

i think there are a few unrelated issues here:

• you can setup nginx to work as you entrypoint proxy - all requests should go to your nginxserver, and nginx would forward some of them to the tile server. See https://maplibre.org/martin/run-with-nginx.html for some ideas. You do NOT have to use docker compose - the nginx config would still be fairly similar. Having this setup will not require any CORS because all requests will appear as coming from the same server (from the browser's perspective)
• you can set up https support with nginx following the standard nginx configuration - there is an example of how to do that in the /demo dir, but nginx docs would probably tell you more

[nyurik]

@jlpoolen when you browse in a non-TLS mode, could you look at the network requests - see what connections are actually being made? I suspect you do not use the nginx proxy for tiles (i might be wrong though)

[jlpoolen]

@nyurik You have identified the problem. The JSON style sheet, martin_style_debian1.json, for the port 80 test has is url value set to port 3000 so nginx is completely out of the circuit when using that url.

jlpoole@debian1:/usr/share/nginx/html/test$ date;head -n 14 martin_style_debian1.json |nl|tail -n 6
Thu Jul  4 06:45:59 AM PDT 2024
     9    "sources": {
    10      "jlptiles": {
    11        "type": "vector",
    12        "scheme": "xyz",
    13        "url": "http://debian1:3000/jlptiles"
    14      },
jlpoole@debian1:/usr/share/nginx/html/test$

So specifying "http://debian1:3000" would necessarily bypass the nginx so no proxying would occur, the request would instead go directly to martin. The martin server does accept HTTP requests so for HTTP tests, it responds. I see (below) that the JSON style sheet I used for the HTTPS tests also has HTTP, not HTTPS as the protocol. So you suspicion about not being proxied is correct. The error of my configuration is in the JSON style sheet which should point to port 80 and let nginx use the match of "jlptiles" to redirect (proxy) to the martin service on port 3000.

jlpoole@debian1:/usr/share/nginx/html/test$ date;head -n 14 martin_style_SSL_debian1.json |nl|tail -n 6
Thu Jul  4 06:55:31 AM PDT 2024
     9    "sources": {
    10      "jlptiles": {
    11        "type": "vector",
    12        "scheme": "xyz",
    13        "url": "http://localhost:3000/jlptiles"
    14      },
jlpoole@debian1:/usr/share/nginx/html/test$ 

Thank you! I'll tinker with the configurations and have the JSON style sheet point to the nginx server (for proxying) instead. I'll update this Issue when I have some results to report.

[nyurik]

Don't change config. Your proxy should set several headers when forwarding to to martin, and martin will update the json. See nginx martin book I gave above

[jlpoolen]

The problem I encountered, CORS errors, has been resolved. The problem was that my JSON style file specified a URL for the tiles to point directly to the martin server, when, it should have directed the inquiry through nginx using HTTPS.

I modified my JSON stylesheet for the HTTPS test to:

jlpoole@debian1:/usr/share/nginx/html/test$ date;head -n 14 martin_style_debian1.json |nl|tail -n 6
Thu Jul  4 07:35:22 AM PDT 2024
     9    "sources": {
    10      "jlptiles": {
    11        "type": "vector",
    12        "scheme": "xyz",
    13        "url": "http://debian1/jlptiles/"
    14      },
jlpoole@debian1:/usr/share/nginx/html/test$ 

And when I now make an HTTPS call to the testing page, i.e. https://debian1/test/martin_map_SSL_2.html#14.12/44.94176/-123.02251, I no longer receive CORS error messages and the call for "jlptiles" is given a status of "OK". A map does not render. but I have learned thus far that unless everything in the style sheet is error free, there is a likelihood the map will not render and the error messages in a standard configuration are not identifying problems. I will need to activate some debugging both on the martin server to see what comes in and goes out and then in the MapLibre-gl script (I have the development version which is not minified so I can add some debugging statements). For posterity, here is my Firefox Console from a browser on a remote machine:

Thank you, again, @nyurik