Thursday, November 20, 2014

How to setup NGINX as a reverse proxy for Workspace Portal 2.1

Per Workspace Portal's installation guide,


During deployment, Workspace is set up inside the internal network. If you want to provide access to Workspace for users connecting from outside networks, you must install a load balancer, such as Apache, nginx, F5, and so on, in the DMZ.

This process is unfortunately outside of VMware's Documentation scope as every environment is different and we do not recommend a particular vendor/service over another.

NGINX, however, is a free and robust option that can at least get you up and running for your external users fairly quickly. This won't be a comprehensive how-to, but should certainly be useful in getting you started!

In this example, we'll be using Ubuntu Server 12.04 for the NGINX server. I performed a default install and enabled only the OpenSSH service during install. Once Ubuntu is installed and has the desired IP and hostname, go ahead and install nginx: sudo apt-get install nginx

Now you can configure nginx.conf to include all the reverse proxy information in a single file, however, in my setup, NGINX needs 3 things in order to work with Workspace:

  1. nginx.conf

  2. default.conf

  3. SSL Certificates


Here is a copy of what my nginx.conf looks like: /etc/nginx/nginx.conf (HUGE thanks to Tomi Vakala from vReality)

_______________________________________
# nginx configuration file
# hws21


# User to run nginx processes as. Ensure this user exists on your system!
user hadmin;

# Worker processes
worker_processes 4;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
    # Use epoll on Linux, kqueue on *BSD and Mac OS X
    use epoll;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;

    # Enable sendfile for improved performance on Linux
    sendfile on;

    # Enable nagle algorithm to buffer more data before sending
    tcp_nopush on;

    keepalive_timeout 65;

    # Setup client buffers
    client_body_buffer_size 256k;
    client_header_buffer_size 2k;

    # Enable gzip compression
    gzip             on;
    gzip_buffers     128 8k;
    gzip_min_length  512;
    gzip_proxied     any;
    gzip_types       text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
    gzip_comp_level  3;

    include /etc/nginx/conf.d/*.conf;
}

# eof
_____________________________________


Next, we need to configure the default.conf which we told nginx.conf to include toward the end of the file.


The default.conf  (/etc/nginx/conf.d/default.conf)  you'll create and customize for your environment. The things you'll need to customize are:



  1. server_name (this is the public facing FQDN)

  2. ssl_certificate (your certificate's full chain)

  3. ssl_certificate_key

  4. proxy_pass (what nginx is proxying to - the internal Workspace instance name)

  5. [Updated] proxy_redirect off;
    -- I originally missed number 5 here in my config and it caused issues when enabling Kerberos in my environment. More on proxy_redirect here


________________________________________




# /etc/nginx/conf.d/default.conf

# hws2.1

 

server {

    # IPv4 listen directive, enable SSL

    listen 443 ssl;

 

    server_name workspace.vcloud.local;

 

    server_tokens off;

 

    # Strict Transport Security (HSTS), force browser to use encrypted

    # connection to this site at all times

    add_header Strict-Transport-Security "max-age=31536000;";

 

    # Configure SSL

    ssl on;

    ssl_certificate /etc/ssl/workspace_chain.crt;

    ssl_certificate_key /etc/ssl/workspace.key;

    ssl_session_cache shared:SSL:50m;

    ssl_session_timeout 10m;

    ssl_prefer_server_ciphers on;

    # Set list of preferred ciphers to enable use of ciphers with perfect

    # forward secrecy to improve security

    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM- SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';

 

    # Reverse proxy directives

    location / {

        proxy_pass https://hws21.vcloud.local:443/;
        proxy_redirect off;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_read_timeout 1800;

        proxy_connect_timeout 1800;

        proxy_http_version 1.1;

        proxy_max_temp_file_size 5m;

 

        # Increase proxy memory buffers

        proxy_buffering on;

        proxy_buffer_size 32k;

        proxy_buffers 16 32k;

        proxy_busy_buffers_size 32k;

    }

}

 

# eof


___________________________________


If you're not much of an SSL wizard, the following two links will be extremely useful in setting up an internal CA with openSSL, then generating your internally signed certs (assuming you don't have Third Party CA signed certs)





Once default.conf and nginx.conf have been configured, and your certificate is valid, you should be able to start nginx. If the service fails to start, it should indicate which component it's having an issue with, whether it's one of the .conf files themselves, or the provided certificate or key file.


The next steps would be to then login to the Workspace Configurator portal at https://:8443/cfg/setup


Click on Install Certificate > Terminate SSL on a Load Balancer. Here you can install the root CA cert from the Load Balancer. Then under Workspace FQDN you can set your new public FQDN.


If you have issues changing your FQDN, check out this excellent troubleshooting blog on VMware Blogs



Good luck!

Share:

Saturday, November 1, 2014

How I built a budget gaming PC for under $400

I had a goal this past year to build a budget gaming PC. Obviously everyone has different budget constraints, but my goal was to keep it under $400 which I was able to accomplish.

Here were my other goals for this system:
  1. Something with plenty of storage, but not overkill
  2. Decent boot times since it likely wouldn't be powered on 24/7
  3. Decent gaming experience without an expensive GPU
  4. Something I could also rely on for working from home

After lots of research to accomplish these goals for cheap, I decided to build an AMD box. AMD vs Intel is an age-old battle that I honestly don't care for.. I've mostly used Intel my whole life, but I can tell you that I'm quite satisfied with my AMD's performance. Most people can agree that AMD is an excellent choice for boxes on a budget.

When researching how to get decent gaming performance without throwing my whole budget at a GPU, I discovered the AMD APU (Accelerated Processing Unit). I took a chance on this CPU with an integrated GPU and have been pleasantly surprised! So on to the system specs..

CPUAMD A10 6800k$129.99http://www.newegg.com/Product/Product.aspx?Item=N82E16819113331
MemoryG.Skill Ripjaw X 8GB$84.99http://www.newegg.com/Product/Product.aspx?Item=N82E16820231654
MoboMSI A78m-E35$59.99http://www.newegg.com/Product/Product.aspx?Item=N82E16813130741



Hard DriveSeagate Hybrid Drive ST1000DX001 1TB$96http://www.newegg.com/Product/Product.aspx?item=N82E16822178381
CaseAntech Mini P1800http://www.newegg.com/Product/Product.aspx?Item=N82E16811129041
PSUThermaltake TR2 TR-600$24.99 (with rebate)http://www.newegg.com/Product/Product.aspx?Item=17-153-166

I also had a 10% off coupon from Newegg that I applied to my mobo/memory purchase taking an additional $15 off the price. All in all, this system only set me back ~$380

Now to be fair, I did get an excellent computer case for free. It was an item a friend of mine had laying around collecting dust that he donated to my cause. However if you were to buy a new case, a quality one would certainly put you over the $400 mark.

Of my 4 goals listed above, the first two were solved by getting the Seagate SSHD. This 1TB harddrive is plenty of space for storing a good number of games, and the small SSD portion of the drive allows for incredibly fast boot times. All in all a great deal for a budget system.

Goal #3 was met by the magic of the APU. You can find all sorts of benchmarks and reviews of the AMD APU series, but my experience has been nothing but positive. The first game I loaded up and played was Batman: Arkham Asylum which I was able to play at max settings without any hindrance at full 1080p. The entire game was an absolute joy to play (especially for a Batman nerd like myself).

Moving on to Arkham City, well, I had to lower the resolution to a windowed 1600 x 900. This still allowed for high settings to be applied, so it looks great. For hard core gamers, this is a deal breaker. But hey, if you're hard core you're probably not interested in a budget gaming rig. For me, this is perfectly acceptable. Same video config needed for Injustice: Gods Among Us. Portal and Portal 2 can both be played with high settings, no issues.

One important note of caution: these kinds of results are possible due to the memory I specifically picked out. The memory is 8GB clocked at 2133Mhz. If you want to game on an APU, you must (MUST) get the fastest RAM you can afford. 2133 is what my mobo supports and what kept the memory reasonably priced. The RAM you decide to get will make or break your choice to use the APU.


Looks a little light in there, but it does the trick! The box has plenty of room for expanding in the future. I plan to get a full on SSD and another TB or two of spinning disk drives. Plus there's enough room for a large GPU if I ever decide it's worth dumping money into.

And there you have it. Simple yet satisfying! You can find me on Steam under the username phiredrop >> Add me on Steam <<
Share:

Follow by Email