Skip to main content

Flink Web Proxy Configuration

Security Notice

Flink Web is an administration interface. Access it only from a controlled network, enable authentication, and avoid exposing it directly to the public internet.

Configuration Steps​

1. Prepare the Configuration

If you are deploying Nginx outside the container, first refer to Nginx Deployment to complete the installation and basic configuration. Then refer to HTTP Proxy Configuration or HTTPS Proxy Configuration to configure the HAP proxy.

The following examples use:

  • Nginx configuration file: /usr/local/nginx/conf/conf.d/hap.conf
  • Flink service address: http://192.168.10.30:8081
Connectivity Requirement

Make sure the host running external Nginx can access http://192.168.10.30:8081. If the address is unreachable, the Flink Web proxy will not work.

2. Back Up the Configuration File

cp -p /usr/local/nginx/conf/conf.d/hap.conf /usr/local/nginx/conf/conf.d/hap.conf.bak.$(date +%Y%m%d%H%M%S)

3. Add the Flink Proxy Configuration

Edit the HAP proxy configuration file:

vi /usr/local/nginx/conf/conf.d/hap.conf

Add the following location block to the server block for the HAP access address. Do not add it to the upstream hap block:

location /privatedeploy/mdy/monitor/flink/ {
    auth_basic "Flink Web";
    auth_basic_user_file /usr/local/nginx/conf/conf.d/.flink_passwd;
    rewrite ^/privatedeploy/mdy/monitor/flink$ / break;
    rewrite ^/privatedeploy/mdy/monitor/flink/(.*)$ /$1 break;
    proxy_pass http://192.168.10.30:8081; # Replace with the actual Flink Web service address
    return 200 "ok";
}
Configuration Notes
  • Add this location block to the server block for the HAP access address. Do not place it in upstream hap.
  • Set proxy_pass to the actual Flink Web service address.
  • For an HTTPS proxy, add the configuration to the server block listening on 443 ssl. For an HTTP proxy, add it to the server block listening on 80.
Combined Example with the HAP Proxy Configuration

Use the following example as a reference for /usr/local/nginx/conf/conf.d/hap.conf. Modify the HAP backend address, certificate paths, and Flink service address according to your environment.

upstream hap {
    server 服务器IP:8880; # Change to the HAP system's internal IP and port
}

server {
    listen 80;
    server_name _;
    access_log /data/logs/weblogs/hap.log main;
    error_log /data/logs/weblogs/hap.error.log;

    underscores_in_headers on;
    client_max_body_size 2048m;

    location / {
        set $real_ip '';
        if ($http_x_real_ip) {
            set $real_ip $http_x_real_ip;
        }
        if ($http_x_real_ip = '') {
            set $real_ip $remote_addr;
        }
        proxy_set_header X-Real-IP $real_ip;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://hap;
    }

    # Required by IM
    location ~ /mds2 {
        proxy_set_header Host $http_host;
        proxy_hide_header X-Powered-By;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://hap;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
    }

    # SSE streaming responses and long-lived connections
    location ~ ^/(agent|api/workflow/api/sse/chat) {
        set $md_real_ip '';
        if ($http_x_real_ip) {
            set $md_real_ip $http_x_real_ip;
        }
        if ($http_x_real_ip = '') {
            set $md_real_ip $remote_addr;
        }
        proxy_buffering off;
        proxy_read_timeout 30m;
        proxy_send_timeout 30m;
        client_max_body_size 16m;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $md_real_ip;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-HTTP-Method-Override "";
        proxy_pass http://hap;
        proxy_redirect default;
    }

    location /privatedeploy/mdy/monitor/flink/ {
        auth_basic "Flink Web";
        auth_basic_user_file /usr/local/nginx/conf/conf.d/.flink_passwd;
        rewrite ^/privatedeploy/mdy/monitor/flink$ / break;
        rewrite ^/privatedeploy/mdy/monitor/flink/(.*)$ /$1 break;
        proxy_pass http://192.168.10.30:8081; # Replace with the actual Flink Web service address
        return 200 "ok";
    }
}

4. Create the Login Account

The login username is hap. YourStrongPassword123 in the command is only an example. Replace it with the actual password before running the command. The password can contain only letters and digits. Use a strong password:

printf "hap:$(openssl passwd -apr1 'YourStrongPassword123')\n" > /usr/local/nginx/conf/conf.d/.flink_passwd

5. Check and Reload Nginx

/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload

Access URL​

After completing the configuration, open the following address in a browser and sign in with the configured credentials:

<HAP access address>/privatedeploy/mdy/monitor/flink/

Replace <HAP access address> with the actual HAP access address.

The login username is hap, and the password is the one configured during setup.