Serving two streamlit apps in parallel with nginx results in 403 or 404

First time using nginx here and it seems I’m missing something.

I have two Streamlit apps being served on ports 8501 and 8502 respectively. I can access either by going to their respective : directly. I also have a URL pointing to the EC2 instance from where they are served.

But when routing /app1 and /app2 locations, nginx gives me either 403 and stops or 404 and returns to /. I imagine there is something wrong with nginx configuration. Can someone please help me set it up correctly – or point me to somewhere else where my problem may be?

Here are the contents of the default file in /etc/nginx/sites-enabled/:

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name = <my domain>;

    root /var/www/html;

    # Add index.php to the list if you are using PHP
    index index.html index.htm index.nginx-debian.html;

    # Required to enable Streamlit's websockets (?)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_read_timeout 2h;

    location /app1 {
        proxy_pass http://127.0.0.1:8501/;
    }

    location /app2 {
        proxy_pass http://127.0.0.1:8502/;
    }

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        # try_files $uri $uri/ =404;
#       proxy_pass http://127.0.0.1:8501;
    }
}

Notes:

• / is commented out above (I don’t need a /, I could return a 404 on that)
• As it is above, both locations result in 403
• Removing the trailing “/” from the address of the proxy_pass in the locations results in 404

I tried naming the baseUrlPath in each app’s .streamlit/config.toml file (and adding that to the location proxy_pass) but it didn’t help. Below is what I currently have on each app’s config.toml:

[logger]
level = "debug"

[server]
port = 8501
#baseUrlPath = "app1"
headless = true
enableCORS = false
enableXsrfProtection = false

(except with port 8502 for app2)

Thanks for any insights!

UPDATE: Got it to work!

Two changes, I think the first one is what made the difference, but may have been something in the second:

1. Uncommented the baseUrlPath on both Streamlit configs and added /app1 and /app2 to their respective proxy_pass calls (without the trailing /)
2. From this solution, added all the lines suggested (previously I had only half of them), and under each location (rather than for the whole server as above, from where I thought each location would have inherited it).

I’ll still test later whether all these lines are really required, and whether they can be inherited from the server definition – but for now it works.