Seeking clarification for endpoint configuration behind an nginx load balancer

I’m trying to wrap my head around the endpoint configuration, especially in prod settings.

Generally I have something like this:

config :btest, BtestWeb.Endpoint,
    url: [host: "localhost", port: 4480, scheme: "http"],
    http: [
      # Enable IPv6 and bind on all interfaces.
      # Set it to  {0, 0, 0, 0, 0, 0, 0, 1} for local network only access.
      # See the documentation on https://hexdocs.pm/bandit/Bandit.html#t:options/0
      # for details about using IPv6 vs IPv4 and loopback vs public addresses.
      ip: {127, 0, 0, 1},
      port: port
    ],

The idea is to have the Phoenix app behind an nginx load balancer, offloading the SSL handshake to it, I’d say not a very unusual set up if you want to run more than one app on the same server. I do care only about binding to localhost on a certain port and that’s that.

What I can’t understand: I can set the port variable to a different value than the one hardcoded in the url , let’s say 4481. The server goes up, but the messages are a little bit confusing:

[info] Running BtestWeb.Endpoint with Bandit 1.6.10 at 127.0.0.1:4481 (http)
[info] Access BtestWeb.Endpoint at http://localhost:4480

Actually, it listens on 4481 only.
So, my questions are:

  • why do I need the port two times, and what parts of the Endpoint are configured via these two options? (I tried to look in the code with no success)
  • In which specific situation I would need to provide a different value for the port in http and the one configured via the env variable?

The http/https configuration is for where the endpoint will be listening.

The url config is for url generation wherever your phoenix app might do so. You likely want to use https there even if you listen on http (given nginx in front). With https and a default port the url port should also be 443.

1 Like

Is there any kind of doc for this?

These here following up on each other:

https://hexdocs.pm/phoenix/1.7.14/Phoenix.Endpoint.html#module-runtime-configuration
https://hexdocs.pm/phoenix/1.7.14/Phoenix.Endpoint.html#module-adapter-configuration

If you are terminating TLS at your reverse proxy and you want to force HTTPS note also the Plug.SSL docs which are linked by the above but easy to miss when scanning:

https://hexdocs.pm/plug/1.15.3/Plug.SSL.html

Those messages do appear very confusing in your case. It’s much clearer when you have a domain configured, because it would say Access ... at https://yourdomain.com:4480 instead. The point being: if that was your nginx port, that really would be where you access the site! But it is not where the Phoenix endpoint is listening.