# Apache w/mod\_sec -\> nginx -\> mongrel SSL & ReqForCcomment

**URL:** <https://www.ruby-forum.com/t/apache-w-mod-sec-nginx-mongrel-ssl-reqforccomment/113390>\
**Category:** Deployment\
**Created:** [August 30, 2007, 4:58pm UTC](https://www.ruby-forum.com/t/apache-w-mod-sec-nginx-mongrel-ssl-reqforccomment/113390 "2007-08-30T16:58:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jz176](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/eb9ed0/32.png) [@jz176](https://www.ruby-forum.com/u/jz176)\
**Post date:** [August 30, 2007, 4:58pm UTC](https://www.ruby-forum.com/t/apache-w-mod-sec-nginx-mongrel-ssl-reqforccomment/113390/1 "2007-08-30T16:58:16Z")

</div>

i need to run apache with mod\_security proxying to nginx which will be  
using basically ezras’ nginx.conf and doing caching etc. and then  
proxying to mongrel.

the reason for this setup is b/c i _NEED_ mod\_security for an app im  
deploying but i want to be able to use nginxs caching and other advanced  
features and have it be the one that interacts with mongrel. so apache  
is going to be layer-7 firewall and filter dynamic content only while  
passing static to nginx.

first of all, is there a mod\_secuity port of some sort out there for  
nginx i couldn’t find? i looked around on the intergoogle and i saw in  
the requestforfeatures doc on nginx home a request and no follow up so i  
assume not.

as far as the config my question is regarding ssl. do i need to set up  
an ssl vhost for nginx too and reset the X\_FORWARDED\_PROTO in nginx or  
does that flag get preserved as it pases through? can i make that a moot  
point by passing it through the apache vhost on 443 (basic vhost is  
below post) and letting nginx handle ssl? i can’t see why not, except  
that awstats might complain and nginx and aw don’t play so well together  
so id be taking a hit on the stats. (if anyone has a log config for  
nginx that works with aw please do share 🙂 but then again if i do  
compression at nginx that might make aw complain too.

and also, what do i have to set in nginx so that it knows it has another  
proxy upstream?

ideally i want nginx to handle pretty much everything and for apache to  
do nothing besides run traffic through mod\_security. i want to make  
apache as transparent as possible. i think this vhost does that, and if  
i could pass the buck on the ssl handling that would be wonderful. i  
just don’t know going proxy to proxy who will get confused where

does anyone have any thoughts on or experience with this setup? i figure  
before i move forward on this i better make sure im not doing something  
stoopid and on top of that there’s a couple issues that could arise like  
the awstats problems which i could solve it by putting nginx on the  
outside but i really wanna put the security appliance on the border.

any thoughts on or experiences with this would be greatly appreciated