Distributed agents

In complex or geographically distributed environments, you may not want to proxy all agent connections through a single entry point. A more scalable approach is to use a main proxy for the login page, which then redirects clients to their specific agent connections.

location ~ /connect/tl.sweden.example.com/(.*) {
    return 307 https://tl.sweden.example.com/$1;
}

The redirection sends the client to a new hostname. This can be the agent server directly, if it is exposed on the network. Alternatively, it can be a dedicated proxy server configured to forward the traffic to the internal agent as below.

server {
    listen 443 ssl;
    server_name tl.sweden.example.com;

    # ... (SSL configuration) ...

    location / {
        proxy_pass https://tl.internal.sweden.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }
}

The following configuration brings together all the concepts discussed in this guide for a more advanced example.

server {
    listen 443 ssl;
    server_name tl.example.com;

    # ... (SSL configuration) ...

    proxy_read_timeout 999h;

    location /subpath/ {
        proxy_pass https://tl.internal.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }

    location /subpath/connect/tl.internal.example.com/ {
        proxy_pass https://tl.internal.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }

    location ~ /subpath/connect/tl.sweden.example.com/(.*) {
        return 307 https://tl.sweden.example.com/$1;
    }
}

server {
    listen 443 ssl;
    server_name tl.sweden.example.com;

    # ... (SSL configuration) ...

    location / {
        proxy_pass https://tl.internal.sweden.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }
}