Proxy
Trusted origins
By default, RedisInsight trusts only the origin to which RedisInsight binds to. If RedisInsight is run behind a proxy, the origin where the requests come from is not trusted if the proxy’s origin is not the origin where RedisInsight binds to. While RedisInsight does start and is reachable, no operations are allowed. Because the origin of requests/proxy is always known, the trusted origins must be manually set via the RITRUSTEDORIGINS
environment variable.
Values in the RITRUSTEDORIGINS
setting must include the scheme (e.g. http://
or https://
) instead of only the hostname.
Also, values that started with a dot must also include an asterisk before the dot. For example, instead of .example.com
, use https://*.example.com
.
Example
Here’s a sample Nginx docker-compose file:
version: "3.7"
services:
redisinsight:
image: redislabs/redisinsight:latest
environment:
- RITRUSTEDORIGINS=http://localhost:9000 # This is the proxy origin from browser
networks:
- redis-network
nginx-basicauth:
image: nginx
ports:
- "9000:9000"
environment:
- NGINX_PORT=9000
volumes: # Your nginx.conf
- ./nginx-basic-auth.conf.template:/etc/nginx/templates/nginx-basic-auth.conf.template
depends_on:
- redisinsight
networks:
- redis-network
networks:
redis-network:
driver: bridge
Subpath proxy
You can enable subpath proxy by setting RIPROXYENABLE
environment variable. Once enabled, either RIPROXYPATH
or RIPROXYPREFIX
must be set to path of the proxy subpath. Use RIPROXYPATH
to set a static proxy subpath and RIPROXYPREFIX
for a dynamic proxy subpath.
RIPROXYPATH static subpath
When RIPROXYPATH
is being set with a path, RedisInsight is accessible only on that subpath. The default routes are given the provided prefix subpath. There isn’t a way to add another proxy behind this proxy unless the same subpath is used for the new proxy.
Once the static subpath is set, RedisInsight is only reachable on the provided subpath, both the one that is directly reachable via the binded origin and from the proxy server.
If no value is provided for RIPROXYPATH
, RedisInsight assumes dynamic subpath and uses RIPROXYPREFIX
variable to extract the proxy prefix from HTTP Headers at runtime.
Example
version: "3.7"
services:
redisinsight:
image: redislabs/redisinsight:latest
environment:
- RITRUSTEDORIGINS=http://localhost:9000 # Trust the proxy origin
- RIPROXYENABLE=t # Enable Subpath Proxy
- RIPROXYPATH=/apps/redisinsight/ # Set static proxy subpath
ports:
- "8001:8001"
networks:
- redis-network
nginx-subpath-proxy:
image: nginx
volumes: # Your nginx config
- ./nginx-subpath-proxy.conf.template:/etc/nginx/templates/nginx-subpath-proxy.conf.template
ports:
- "9000:9000"
environment:
- NGINX_PORT=9000
- NGINX_PROXY_PATH=/apps/redisinsight/
command: # Redisinsight will now be available only in `/apps/redisinsight/`.
- bash
- -c
- |
printf "Visit <a href=\"$$NGINX_PROXY_PATH\">$$NGINX_PROXY_PATH</a> for redisinsight" > /etc/nginx/index.html
/docker-entrypoint.sh nginx -g "daemon off;"
depends_on:
- redisinsight
networks:
- redis-network
networks:
redis-network:
driver: bridge
nginx config
server {
listen ${NGINX_PORT} default_server;
root /etc/nginx;
index index.html;
location ${NGINX_PROXY_PATH} { # Subpath
proxy_pass http://redisinsight:8001/; # Assumes redisinsight runs in this host
proxy_read_timeout 900;
proxy_set_header Host $host;
}
}
RIPROXYPREFIX dynamic subpath
When RIPROXYPREFIX
is being set to a value, default being X-Forwarded-Prefix
, RedisInsight extracts the path from this field in the HTTP Header. So the subpath is actually set by the proxy server and not RedisInsight and this variable just tells which HTTP header field to check for the proxy subpath. Using this approach, multiple proxies can send requests to same RedisInsight with different proxy subpaths.
localhost:8001
and the one from dynamic subpath.Example
Using the below docker-compose
and nginx.conf
file, same RedisInsight instance is reachable via:
http://localhost:8001
— Direct path to RedisInsight serverhttp://localhost:9000/tools/redisinsight/
— Proxy subpath 1 from the first proxy server.http://localhost:9000/installed-tools/more/content/here/redisinsight/
— Proxy subpath 2 from the first proxy server.http://localhost:9001/applications/redisinsight/
— Proxy subpath 1 from the second proxy server.http://localhost:9001/helpers/tools/redisinsight/
— Proxy subpath 2 from the second proxy server.
docker-compose
version: "3.7"
services:
redisinsight:
image: redislabs/redisinsight-dev:master
environment:
- RIPORT=8001
- RITRUSTEDORIGINS=http://localhost:9000,http://localhost:9001 # Trust multiple proxy origins
- RIPROXYENABLE=t # Enable subpath proxy
ports:
- "8001:8001"
networks:
- redis-network
nginx-subpath-proxy-dynamic-1:
image: nginx
volumes: # Your first nginx proxy
- ./nginx-subpath-proxy-dynamic.conf.template:/etc/nginx/templates/nginx-subpath-proxy-dynamic.conf.template
ports:
- "9000:9000"
environment:
- NGINX_PORT=9000
- NGINX_PROXY_PATH=-/tools/redisinsight/
- NGINX_PROXY_PATH_ADDITIONAL=/installed-tools/more/content/here/redisinsight/
command:
- bash
- -c
- |
printf "Visit <a href=\"$$NGINX_PROXY_PATH\">$$NGINX_PROXY_PATH</a> or <a href=\"$$NGINX_PROXY_PATH_ADDITIONAL\">$$NGINX_PROXY_PATH_ADDITIONAL</a> for redisinsight" > /etc/nginx/index.html
/docker-entrypoint.sh nginx -g "daemon off;"
depends_on:
- redisinsight
networks:
- redis-network
nginx-subpath-proxy-dynamic-2:
image: nginx
volumes: # Your second nginx proxy
- ./nginx-subpath-proxy-dynamic.conf.template:/etc/nginx/templates/nginx-subpath-proxy-dynamic.conf.template
ports:
- "9001:9001"
environment:
- NGINX_PORT=9001
- NGINX_PROXY_PATH=/applications/redisinsight/
- NGINX_PROXY_PATH_ADDITIONAL=/helpers/tools/redisinsight/
command:
- bash
- -c
- |
printf "Visit <a href=\"$$NGINX_PROXY_PATH\">$$NGINX_PROXY_PATH</a> or <a href=\"$$NGINX_PROXY_PATH_ADDITIONAL\">$$NGINX_PROXY_PATH_ADDITIONAL</a> for redisinsight" > /etc/nginx/index.html
/docker-entrypoint.sh nginx -g "daemon off;"
depends_on:
- redisinsight
networks:
- redis-network
networks:
redis-network:
driver: bridge
nginx config
server {
listen ${NGINX_PORT} default_server;
root /etc/nginx;
index index.html;
location ${NGINX_PROXY_PATH} { # Subpath one
proxy_pass http://redisinsight:8001/; # Assumes redisinsight runs in this host
proxy_read_timeout 900;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Prefix ${NGINX_PROXY_PATH}; # Dynamic subpath 1
}
location ${NGINX_PROXY_PATH_ADDITIONAL} { # Subpath two
proxy_pass http://redisinsight:8001/; # Assumes redisinsight runs in this host
proxy_read_timeout 900;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Prefix ${NGINX_PROXY_PATH_ADDITIONAL}; # Dynamic subpath 2
}
}