I have uwsgi running on a docker container. Nginx running on host.

Current setup:

;uwsgi.ini

http-socket=8080

With docker, I’ve forwarded the host’s 8080 port to containers 8080 port. Nginx is configured like

server {
    listen 443 ssl http2;
    server_name domain.example.com;
    location / {
        proxy_pass http://127.0.0.1:8080;
    }
}

This works fine, only problem: my port 8080 is exposed and I can directly request the port on the public IP. I should be able to use domain sockets to mitigate this, but I don’t know how the set up would look like.

Here’s my half attempt:

; uwsgi.ini in container

socket=/path/uwsgi.sock

# nginx on host

upstream prod_server {
    server unix:///path/uwsgi.sock;
}

server {
    listen 443 ssl http2;
    server_name example.domain.com;
    location {
        uwsgi_pass pror_server;
    }
}

Since nginx is in host, it will look for the path on host server, is adding the socket as a volume the right way to go? Is there another best practice? How would you recommend the setup? Thank you.