Good ingress webservers with reverse proxy support: 1. Nginx 2. Envoy 3. Traefik 4. Istio It depends on your infrastructure for production environment

https://serverfault.com/questions/920534/nginx-proxy-subdomains-to-other-addresses-and-ports here’s an example for Nginx

There’re cost-effective options if you use Google Cloud, Amazon Web services or Azure. They have load balancer and you can use it too.

You can consider using Elastic Load Balancer when you’ll have more network load for your VPS

Revisiting this after a long time 😅 I've set up reverse proxy using nginx. Both kratos and hydra are running on the same instance but being mapped like 9000 -> /oauth-admin 9001 -> oauth-public and similar trend for kratos admin and public apis. I've set up SSL using Lets Encrypt. OAuth Client is on 127.0.0.1:8080 which is redirecting user to the oauth endpoint for hydra oauth. Now, I'm getting these 2 errors.

error=map[message:neither remote address nor any x-forwarded-for values match CIDR ranges [127.0.0.1/32]: [172.19.0.1], ranges, check)]

and

error=map[message:can not serve request over insecure http]

To tackle 2nd one, I'm using https connection on 127.0.0.1:8080 but I'm unaware of the 1st one. My nginx rules are:

location /auth-admin{
          proxy_set_header          X-Forwarded-Proto $thescheme;
          proxy_pass                <http://127.0.0.1:9000/>;
        }

location /auth-public{
            proxy_set_header        X-Forwarded-Proto $thescheme;
            proxy_pass              <http://127.0.0.1:9001/>;
        }

location /idp-admin {
            proxy_set_header        X-Forwarded-Proto $thescheme;
            proxy_pass              <http://127.0.0.1:4433/>;
        }
		
location /idp-public {
            proxy_set_header        X-Forwarded-Proto $thescheme;
            proxy_pass              <http://127.0.0.1:4434/>;
        }

@User, Can you help me figure out what might be the issue here?

in your configuration you terminate only from localhost network while you need to setup a network ranges from your cluster

Now, it's redirecting me to

/oauth2/auth?response_type=code&redirect_uri=http%

instead of

/auth-public/oauth2/auth?response_type=code&redirect_uri=http%

Trying to figure out what config can I override.

seems like the redirect was from disk cache 🤐