[PR #3789] [CLOSED] Add SSL to streams #3759

New issue

Closed

opened 2026-02-26 08:31:51 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 08:31:51 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3789
Author: @jbowring
Created: 6/2/2024
Status: ❌ Closed

Base: develop ← Head: stream-ssl

📝 Commits (9)

b8b80d3 Add SSL certificate to TCP streams if certificate in database
0cf7ed9 Add SSL tab to stream UI
1d3d5be Add SSL column to streams table UI
7307515 Add certificate to streams database model
ae1255d Fix whitespace in nginx stream config
207dbb2 Fix stream update not persisting
d3526de Merge branch 'NginxProxyManager:develop' into stream-ssl
e4c1013 Merge branch 'NginxProxyManager:develop' into stream-ssl
a262ad1 Merge branch 'develop' into stream-ssl

📊 Changes

19 files changed (+569 additions, -151 deletions)

View changed files

📝 backend/internal/stream.js (+97 -20)
➕ backend/migrations/20240427161436_stream_ssl.js (+38 -0)
📝 backend/models/stream.js (+17 -5)
📝 backend/schema/components/stream-object.json (+16 -0)
📝 backend/schema/paths/nginx/streams/post.json (+9 -1)
📝 backend/schema/paths/nginx/streams/streamID/put.json (+20 -56)
📝 backend/templates/_certificates.conf (+1 -0)
➕ backend/templates/_certificates_stream.conf (+13 -0)
📝 backend/templates/stream.conf (+8 -12)
➕ docker/rootfs/etc/nginx/conf.d/include/ssl-cache-stream.conf (+2 -0)
➕ docker/rootfs/etc/nginx/conf.d/include/ssl-cache.conf (+2 -0)
📝 docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf (+0 -3)
📝 frontend/js/app/nginx/stream/form.ejs (+176 -37)
📝 frontend/js/app/nginx/stream/form.js (+154 -13)
📝 frontend/js/app/nginx/stream/list/item.ejs (+7 -1)
📝 frontend/js/app/nginx/stream/list/main.ejs (+1 -0)
📝 frontend/js/app/nginx/stream/main.js (+1 -1)
📝 frontend/js/i18n/messages.json (+3 -1)
📝 frontend/js/models/stream.js (+4 -1)

📄 Description

Support for SSL for streams with TCP forwarding enabled. Uses the same web interface as creating a new Proxy Host for adding SSL.

Details

An Nginx stream config created with this SSL feature looks like this:

# ------------------------------------------------------------
# 1883 TCP: 1 UDP: 1
# ------------------------------------------------------------

server {
  listen 1883 ssl;
  listen [::]:1883 ssl;

  # Let's Encrypt SSL
  include conf.d/include/ssl-cache-stream.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-9/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-9/privkey.pem;

  proxy_pass google.com:443;

  # Custom
  include /data/nginx/custom/server_stream[.]conf;
  include /data/nginx/custom/server_stream_tcp[.]conf;
}

server {
  listen 1883 udp;
  listen [::]:1883 udp;

  proxy_pass google.com:443;

  # Custom
  include /data/nginx/custom/server_stream[.]conf;
  include /data/nginx/custom/server_stream_udp[.]conf;
}

Nginx doesn't allow stream and http blocks to share an SSL cache, so all streams have a separate SSL cache defined in ssl-cache-stream.conf:

ssl_session_cache shared:SSL_stream:50m;

Use a DNS Challenge is forced as streams cannot perform HTTP authentication for issuing certificates.

Streams do not have domain names associated with them in the database or displayed in the UI, as streams are not proxied by hostname but exclusively by port.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NginxProxyManager/nginx-proxy-manager/pull/3789 **Author:** [@jbowring](https://github.com/jbowring) **Created:** 6/2/2024 **Status:** ❌ Closed **Base:** `develop` ← **Head:** `stream-ssl` --- ### 📝 Commits (9) - [`b8b80d3`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/b8b80d3e80131260bbe138c954763370da6d02a6) Add SSL certificate to TCP streams if certificate in database - [`0cf7ed9`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/0cf7ed9d8213513aadf12adf9813b5da4d8d1be0) Add SSL tab to stream UI - [`1d3d5be`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/1d3d5be5888d5ec2ffb07f44e89f151d85d3c54c) Add SSL column to streams table UI - [`7307515`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/7307515eedc836d39e661b6c213a817e09cdbd95) Add certificate to streams database model - [`ae1255d`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/ae1255df273be7958913deae62621b37f4d07170) Fix whitespace in nginx stream config - [`207dbb2`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/207dbb2f370f2dce854679d7c9b0eeb5fe14bb89) Fix stream update not persisting - [`d3526de`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/d3526debe662c01da7c09f5b899020bd7ece77e5) Merge branch 'NginxProxyManager:develop' into stream-ssl - [`e4c1013`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/e4c10131f06ae364242cd547f1375b8bc7aba63b) Merge branch 'NginxProxyManager:develop' into stream-ssl - [`a262ad1`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/a262ad132b07aee722f4f186220452894e0ca1f6) Merge branch 'develop' into stream-ssl ### 📊 Changes **19 files changed** (+569 additions, -151 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/stream.js` (+97 -20) ➕ `backend/migrations/20240427161436_stream_ssl.js` (+38 -0) 📝 `backend/models/stream.js` (+17 -5) 📝 `backend/schema/components/stream-object.json` (+16 -0) 📝 `backend/schema/paths/nginx/streams/post.json` (+9 -1) 📝 `backend/schema/paths/nginx/streams/streamID/put.json` (+20 -56) 📝 `backend/templates/_certificates.conf` (+1 -0) ➕ `backend/templates/_certificates_stream.conf` (+13 -0) 📝 `backend/templates/stream.conf` (+8 -12) ➕ `docker/rootfs/etc/nginx/conf.d/include/ssl-cache-stream.conf` (+2 -0) ➕ `docker/rootfs/etc/nginx/conf.d/include/ssl-cache.conf` (+2 -0) 📝 `docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf` (+0 -3) 📝 `frontend/js/app/nginx/stream/form.ejs` (+176 -37) 📝 `frontend/js/app/nginx/stream/form.js` (+154 -13) 📝 `frontend/js/app/nginx/stream/list/item.ejs` (+7 -1) 📝 `frontend/js/app/nginx/stream/list/main.ejs` (+1 -0) 📝 `frontend/js/app/nginx/stream/main.js` (+1 -1) 📝 `frontend/js/i18n/messages.json` (+3 -1) 📝 `frontend/js/models/stream.js` (+4 -1) </details> ### 📄 Description Support for SSL for streams with TCP forwarding enabled. Uses the same web interface as creating a new _Proxy Host_ for adding SSL. <img width="1188" alt="Screenshot 2024-06-02 at 20 38 48" src="https://github.com/NginxProxyManager/nginx-proxy-manager/assets/4677505/b1af206f-eba9-4c16-9fcb-998c5859f83d"> <img width="506" alt="image" src="https://github.com/NginxProxyManager/nginx-proxy-manager/assets/4677505/ec4e1d65-1f1b-447f-b418-cd183df51e42"> ## Details An Nginx stream config created with this SSL feature looks like this: ```nginx configuration file # ------------------------------------------------------------ # 1883 TCP: 1 UDP: 1 # ------------------------------------------------------------ server { listen 1883 ssl; listen [::]:1883 ssl; # Let's Encrypt SSL include conf.d/include/ssl-cache-stream.conf; include conf.d/include/ssl-ciphers.conf; ssl_certificate /etc/letsencrypt/live/npm-9/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/npm-9/privkey.pem; proxy_pass google.com:443; # Custom include /data/nginx/custom/server_stream[.]conf; include /data/nginx/custom/server_stream_tcp[.]conf; } server { listen 1883 udp; listen [::]:1883 udp; proxy_pass google.com:443; # Custom include /data/nginx/custom/server_stream[.]conf; include /data/nginx/custom/server_stream_udp[.]conf; } ``` Nginx doesn't allow `stream` and `http` blocks to share an SSL cache, so all streams have a separate SSL cache defined in `ssl-cache-stream.conf`: ```nginx configuration file ssl_session_cache shared:SSL_stream:50m; ``` _Use a DNS Challenge_ is forced as streams cannot perform HTTP authentication for issuing certificates. Streams do not have domain names associated with them in the database or displayed in the UI, as streams are not proxied by hostname but exclusively by port. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 08:31:51 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3759

No description provided.

Rows
Columns