How to expose Omni with Nginx (HTTPS)

This guide will show you how to expose a self-hosted Omni with Nginx and secure it with TLS

Omni deployment configuration

You need to deploy an omni instance the how to deploy omni on prem guide, with the following flags set:

--name=$OMNI_NAME
--private-key-source=file:///omni.asc
--bind-addr=127.0.0.1:8080
--advertised-api-url=https://$OMNI_DOMAIN/
--siderolink-api-bind-addr=127.0.0.1:8090
--siderolink-api-advertised-url=https://api.$OMNI_DOMAIN:443
--k8s-proxy-bind-addr=127.0.0.1:8100
--advertised-kubernetes-proxy-url=https://kube.$OMNI_DOMAIN/
--account-id=$OMNI_UUID
## Also add the authentication flags according to your setup

Certificates

You can use acme or certbot to generate certificates for your domain. In the following nginx config, the are stored in /var/lib/acme/omni/ and /var/lib/acme/omni_api/ and /var/lib/acme/omni_kube/. Make sure to change the paths to your own or to output the certificates to those paths.

Nginx configuration

Use the following configuration to expose omni with nginx. Make sure to change the domain name ($OMNI_DOMAIN) to your own domain and to update the certificate paths if applicable.

http {
	proxy_redirect off;
	proxy_http_version 1.1;

	proxy_connect_timeout 60s;

	# Omni needs long timeouts for the long-lived connections
	proxy_send_timeout 1h;
	proxy_read_timeout 1h;

	# $connection_upgrade is used for websocket proxying
	map $http_upgrade $connection_upgrade {
		default upgrade;
		'' close;
	}

	# Omni HTTPS redirection
	server {
		listen 0.0.0.0:80;
		listen [::0]:80;
		server_name $OMNI_DOMAIN;
		location / {
			return 301 https://$host$request_uri;
		}
	}

	map $http_content_type $is_grpc {
		default 0;
		"application/grpc" 1;
	}

	# Omni main API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name $OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni/chain.pem;
		location / {
			error_page 418 = @grpc;
			error_page 419 = @http;

			if ($is_grpc) {
				return 418;
			}

			return 419;
		}

		# Omni main GRPC API
		location @grpc {
			# Omni needs long timeouts for the long-lived GRPC stream connections
			grpc_read_timeout 1h;
			grpc_send_timeout 1h;
			grpc_pass grpc://127.0.0.1:8080;
		}

		# Omni main HTTP API
		location @http {
			proxy_pass http://127.0.0.1:8080;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
		}
	}

	# Omni SideroLink (a.k.a. Machine) API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name api.$OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni_api/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni_api/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni_api/chain.pem;
		location / {
			# Omni needs long timeouts for the long-lived GRPC stream connections
			grpc_read_timeout 1h;
			grpc_send_timeout 1h;
			grpc_pass grpc://127.0.0.1:8090;
		}
	}

	# Omni Kube API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name kube.$OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni_kube/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni_kube/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni_kube/chain.pem;
		location / {
			proxy_pass http://127.0.0.1:8100;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
		}
	}
}

How to use

The omni instance will be available at https://$OMNI_DOMAIN/, the API at https://api.$OMNI_DOMAIN/ and the kubernetes proxy at https://kube.$OMNI_DOMAIN/.