Proxy settings for Ant Media Server running behind a firewall - ssl-certificate

Question

I have Ant Media Server community edition running on a KVM VM server on onsite server hardware (testing for now) and would like to serve up staff how-to videos for an intranet to those inside and outside the firewall for our little NPO. We do this with a number of different web, chat, wiki, code-library, etc. servers and functions using an nginx proxy server that manages Lets Encrypt certs for each and provides access to people onsite or at home. We have the port forwarding set up correctly on the router and it all runs pretty nice.
When I proxy Ant Media Server this way it works fine to get to the admin gui--it comes right up on port 443, proxied from port 5080. But streaming does not work through the proxy---either inside or outside the firewall---with all ports open in both media and proxy server. It shows the webpage with the "Stream will start playing automatically when it is live" message for a VOD link and then just stops---does not start player or stream video. The VOD video plays correctly when accessed directly via port 5080.
I realize that maybe you've taken steps to make sure people cannot do what I am trying to do--- which circumvents the community edition license features that do not include the SSL feature. If so, just let me know.
I am aware that there is a feature to allow SSL via Lets Encrypt directly on Ant Media Server. But I cannot keep public port 80 forwarding to Ant Media Server to allow for Lets Encrypt cert updating---port 80 is forwarded to the dedicated proxy/cert machine that I mentioned above and which does this job very well for us.
Otherwise, if this should work and anyone can look at my settings and tell me what's awry, here are my proxy_pass settings:
---------------proxy_pass directive--------------------
server {
listen 443 ssl http2;
server_name antmedia.my.org;
add_header 'Access-Control-Allow-Origin' '*';
location / {
proxy_pass http://192.168.254.194:5080;
proxy_redirect http://192.168.254.194:5080 https://antmedia.my.org;
}
}
Thanks so much!! I think it's really cool that Ant Media is giving Wowza such a run for their money!!
The nginx.conf settings are stock/default for this docker---which is optimized for the reverse proxy role. Here they are with only the active lines listed:
user abc;
worker_processes 4;
pid /run/nginx.pid;
include /etc/nginx/modules/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
variables_hash_max_size 2048;
large_client_header_buffers 4 16k;
client_max_body_size 0;
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /config/log/nginx/access.log;
error_log /config/log/nginx/error.log;
gzip on;
gzip_disable "msie6";
proxy_connect_timeout 600;
proxy_send_timeout 600;
proxy_read_timeout 600;
send_timeout 600;
include /etc/nginx/conf.d/*.conf;
include /config/nginx/site-confs/*;
lua_load_resty_core off;
}

Answer 1

Can you try please as follows?
server {
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
server_name yourdomain.com;
location / {
proxy_pass http://192.168.254.194:5080;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
}