GRPC and Reverse Proxy

[patsch9]

Hello,

is it possible to route the GRPC port via a reverse proxy?
I can't get it to work at the moment.
My environment would look like this:

Gateway -- (connects) --> https://grpc.mydomain.com -- Cloudflare Tunnel --(SSL)--> Nginx --> http://192.168.1.2:50055

Alternatively also tested:
Gateway -- (connects) --> https://grpc.mydomain.com -- Cloudflare Tunnel --> http://192.168.1.2:50055

At the moment I am facing the problem that the grpc endpoint only seems to accept requests via http/0.9. But the reverse proxies all speak at least http/1.1

Does anyone have an idea?

Greetings
Patrick

[teon]

@patsch9 We are using GRPC reverse proxy on NGINX, for example here are my snipplet for oroxy but for Core GRPC is identical. What is important with NGINX (which doesn't support /path/s/in/url/for/grpc) - you need a dedicated port to do reverse proxy on the / path. And then in configs add the https://domain.com:444/ Iwith port).

server {
    listen 444 http2;

    server_name enrollment.domain.com;

    access_log /var/log/nginx/proxy-grpc.log;
    error_log /var/log/nginx/proxy-grpc.e.log;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;

    client_max_body_size 200m;

    location / {
	   grpc_pass grpc://proxy-grpc;
	   grpc_socket_keepalive on;
	   grpc_read_timeout 3000s; # These are recommended everywhere, but I haven't had any success
	   grpc_send_timeout 3000s; # 
	   grpc_next_upstream_timeout 0; 

	   proxy_request_buffering off;
	   proxy_buffering off;
	   proxy_connect_timeout  3000s;
	   proxy_send_timeout  3000s;
	   proxy_read_timeout  3000s;
	   proxy_socket_keepalive on;

	   keepalive_timeout 90s;
	   send_timeout 90s;

	   client_body_timeout 3000s;
    }
}

Hope that helps

[teon]

@patsch9 Also what is important CORE needs the CA of GRPC proxy, so in your config add:

DEFGUARD_PROXY_GRPC_CA=/path/to/keys/ca.pem (like: /etc/letsencrypt/..../chain.pem).

[patsch9]

Thank you, i will try it 👍