Running behind an nginx

It is possible to run the SMP on an Tomcat (or the like) that is proxied via an nginx to the public. In this case and the SMP runs on Tomcat in a context different than ROOT, it is important to

• set the smp.forceroot configuration property to true (see Configuration for details) and
• to change the path of the SMP session cookie (usually JSESSIONID) from the original path to the destination path as well

By default nginx uses HTTP 1.0 so it is important to add the proxy-statement to switch to HTTP 1.1. The name peppolXX is just a placeholder that you can change. The XX is just added to clearly identify where the placeholder is used. The following configuration assumes that the SMNP software is running on Tomcat on the same host on port 8080 in the context /smp. The public DNS name of the server in the below configuration is smp.example.org. Note: according to the Peppol SMP specification 1.4.0 the SMP must be publicly reachable via TLS on port 443, so nginx terminates TLS as shown below. Adjust the certificate paths to your setup.

upstream peppolXX {
  server  127.0.0.1:8080;
}

server {
  listen 443 ssl;
  server_name smp.example.org;

  ssl_certificate     /etc/ssl/certs/smp.example.org.crt;
  ssl_certificate_key /etc/ssl/private/smp.example.org.key;

  location / {
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_cookie_path /smp /;
    proxy_http_version 1.1;
    proxy_pass http://peppolXX/smp/;
  }
}