--- title: "Solving Nested Hyper-V: Centralizing HTTPS Ports and Certificate Forwarding with Nginx" description: "Explains how to set up an Nginx reverse proxy with Docker in a nested Hyper-V environment to centrally manage HTTPS certificates and port forwarding, improving server utilization." canonical_url: "https://blog.markkulab.net/en/post/nginx-https-forwarding" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2023-12-19 01:01:35 +0800" category: "DevOps" tags: ["nginx", "docker", "https", "ssl", "reverse proxy", "devops", "hyper-v", "infra"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # Solving Nested Hyper-V: Centralizing HTTPS Ports and Certificate Forwarding with Nginx ## Background Our company's current server architecture is nested Hyper-V. As we all know, a single machine only has one HTTPS (443) port, so every time we need to scale out a web application under this architecture we have to spin up another VM. That is very inefficient and wastes server resources (CPU, memory, disk, public IP). These days, with one Docker command you can stand up a bunch of services without having to install an OS and configure a heap of environment settings before deploying. Since we cannot move to K8s in the short term, we are using Nginx to simplify the architecture first. ## Benefits * Maximizes server utilization and reduces unnecessary performance overhead. * Easier to back up and takes up less space. * Easier to scale horizontally. * Because our DNS is managed by Cloudflare and the IP is already bound, adding a new domain no longer requires asking the network admin to reconfigure the firewall. ## Network Architecture ![Network architecture diagram](https://blog.markkulab.net/content/markku/posts/nginx-https-forwarding/images/1.png) ## Configuration files needed to build the Nginx container ![Configuration files needed for the Nginx container](https://blog.markkulab.net/content/markku/posts/nginx-https-forwarding/images/2.png) ### First, download the HTTPS certificate Because our DNS is hosted on Cloudflare, we get HTTPS for free. You can [download the certificate](https://developers.cloudflare.com/ssl/client-certificates/create-a-client-certificate/) from the Cloudflare dashboard. ### Next, write the Dockerfile ``` FROM nginx COPY nginx.conf /etc/nginx/conf.d/default.conf COPY upstream.conf /etc/nginx/conf.d/upstream.conf COPY ca.crt /etc/nginx/ca.crt COPY ca.key /etc/nginx/ca.key ``` ### Then configure nginx.conf Nginx forwards requests to different upstream servers based on the domain name specified in the server_name directive. When an HTTPS request reaches the Nginx server, Nginx checks the HTTP Host header to decide which server block handles the request. ``` server { # Listen HTTP - From Firewall listen 80; server_name aafes.abc.com; # Redirect HTTP to HTTPS return 301 https://$host$request_uri; } server { # Listen HTTPS - From Firewall listen 443 ssl; server_name aafes.abc.com; # SSL config ssl_certificate /etc/nginx/ca.crt; ssl_certificate_key /etc/nginx/ca.key; # Proxy Config location / { proxy_pass http://192.168.0.99:20080; proxy_http_version 1.1; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_pass_request_headers on; } } server { # Listen HTTP - Cloudflare Tunnel listen 80; server_name new-aafes.abc.com; location / { proxy_pass http://192.168.0.99:10080; proxy_http_version 1.1; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $http_host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_pass_request_headers on; } } server { # Listen on HTTP listen 80; server_name cdn.abc.com; # Root directory for static content root /var/www/html; # Default location location / { # Enable directory listings autoindex off; # Try to serve file as is, return 404 if not found try_files $uri $uri/ =404; } # Other configurations (if needed) } ``` ### Configure load balancing (only needed if the application has multiple instances) — upstream.conf ``` upstream cms.abc.com { server 192.168.0.99:27777; } ``` ### Build and run the container with PowerShell ``` $imageName = "certificate-centerlize-nginx" docker build -t $imageName . $containerName="certificate-centerlize-nginx" $port80="80:80" $port443="443:443" docker run -d --name $containerName --restart=always -p "${port80}" -p "${port443}" $imageName PAUSE ``` ## Reload configuration without downtime One of Nginx's strengths is that when the config or certificate changes, running nginx -s reload to reload the configuration usually doesn't cause service interruption or unavailability. ``` $containerName = "certificate-centerlize-nginx" $localDir = (Get-Location).Path $nginxConfigPath = "$localDir\nginx.conf" $nginxUpstreamConfig = "$localDir\upstream.conf" docker cp "${nginxConfigPath}" "${containerName}:/etc/nginx/conf.d/default.conf" docker cp "${nginxUpstreamConfig}" "${containerName}:/etc/nginx/conf.d/upstream.conf" docker exec $containerName nginx -s reload ``` ![Run the test command](https://blog.markkulab.net/content/markku/posts/nginx-https-forwarding/images/3.png) ## Wrap-up Following the steps in this article, readers can learn how to use Docker to set up Nginx for centralized HTTPS forwarding and load balancing, improving the efficiency and flexibility of web application deployment. This solution works for both small projects and easily scales up to large enterprise applications. ## References [Nginx Load Balancing Configuration](https://blog.csdn.net/xyang81/article/details/51702900) [Understanding Nginx Load Balancing in Five Minutes](https://juejin.cn/post/6844904106541203464) [Implementing Nested Hyper-V Virtualization to Boost R&D Efficiency](https://www.netadmin.com.tw/netadmin/zh-tw/feature/85DC7EDD93F546AF81E8EBAEE18B8992#google_vignette) [A Friendly Management UI and Automated HTTPS for Nginx — Nginx Proxy Manager](https://blog.darkthread.net/blog/nginx-proxy-manager/) --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/post/nginx-https-forwarding) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software Solution Provider - 10+ years senior software engineer, now an AI Builder - Focused on large-platform architecture — North-American e-commerce, AI SaaS subscription billing - Combining AI Agents and automation to build evolvable product foundations ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer and compare/sync, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Kafka message browsing with monitoring & alerts, a bilingual UI (Traditional Chinese / English), a built-in AI assistant (natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [Special Education](https://blog.markkulab.net/en/education): Learning materials crafted for special education students ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物週報](https://blog.markkulab.net/en/category/open-source-weekly): A weekly two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.