What I’m trying to do: Create a reverse proxy for multiple services (web servers, Nextcloud, etc.). Prior to configuring the reverse proxy, both the web server and Nextcloud were functioning. I am seeking to have the reverse proxy terminate TLS for the services and currently have only 443 whitelisted via the host FW.
Where I’m stuck: I have created and linked the /etc/nginx/sites-enabled/reverse proxy.conf config file within /etc/nginx/nginx.conf, and confirmed valid configuration via sudo nginx -s reload, but the browser states its inability to connect to the server.
What I’ve already tried: Below are my configuration files. Commented files/services are simply placeholders for future goals and not installed. Thank you for any help!
- nginx.conf
#----------------
# Documentation |
#----------------
# Directive directory https://nginx.org/en/docs/dirindex.html
# Reverse proxy https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/
# Server https://docs.nginx.com/nginx/admin-guide/web-server/web-server/
#-------
# Main |
#-------
# Defines worker processes' user + group credentials
user www-data;
# Quantity = CPU cores
worker_processes 2;
# Location + logging level
error_log /var/log/nginx/error_main.log debug;
# Defines file containing main PID
pid /run/nginx.pid;
events {
# Max simultaneous connections per worker process
worker_connections 1024;
}
http {
#-------
# Logs |
#-------
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
error_log /var/log/nginx/error_http.log debug;
# main applies pre-defined log_format
access_log /var/log/nginx/access_http.log main;
#----------
# SSL/TLS | https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-http/
#----------
ssl_certificate /etc/ssl/certs/name-net-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/name-net-selfsigned.key;
ssl_protocols TLSv1.3;
# Reuse in Nextcloud config
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#-----------------------
# SSL/TLS optimization | https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-http/#optimize
#-----------------------
# 1m = 4k sessions
ssl_session_cache shared:SSL-TLS:1m;
ssl_session_timeout 10m;
#-------
# MIME |
#-------
include /etc/nginx/mime.types;
default_type application/octet-stream;
#-----------------------------
# File transfer optimization |
#-----------------------------
sendfile on;
# Provide client file w/out buffering. Improves static content transfer rate. Utilize w/ static content servers.
tcp_nopush off;
# Limits data transer amount per sendfile() call. Prevents individual call completely seizing worker processes.
sendfile_max_chunk 2m;
#------------------------------
# TCP connection optimization |
#------------------------------
# Low traffic site. Low value minimizes idle connections.
keepalive_timeout 30;
# Max requests per keepalive connection
keepalive_requests 100;
#------------
# Nextcloud |
#------------
upstream php-handler {
server unix:/var/run/php/php8.3-fpm.sock;
}
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
"" "";
default ", immutable";
}
#----------------
# Reverse proxy | Redifining request headers unnecessary. Proxied services located locally.
#----------------
include /etc/nginx/sites-enabled/reverse_proxy.conf;
#-----------
# Services |
#-----------
server {
http2 on;
include /etc/nginx/sites-enabled/charlie.conf;
# include /etc/nginx/sites-enabled/sierra.conf;
# include /etc/nginx/sites-enabled/gitlab.conf;
include /etc/nginx/sites-enabled/nextcloud.conf;
# include /etc/nginx/sites-enabled/vaultwarden.conf;
}
# include /etc/nginx/sites-enabled/jellyfin.conf;
# include /etc/nginx/sites-enabled/collabora.conf;
}
- reverse_proxy.conf
server {
listen 443 ssl;
http2 on;
#----------
# Port 80 |
#----------
location /charlie {
proxy_pass http://localhost:80/charlie;
#-----------
# Security |
#-----------
allow 192.168.1.0/24;
deny all;
}
#location /sierra {
# proxy_pass http://localhost:80/sierra;
#}
#location /gitlab {
# proxy_pass http://localhost:80/gitlab;
#}
#location /nextcloud {
# proxy_pass http://localhost:80/nextcloud;
#}
#location /vaultwarden {
# proxy_pass http://localhost:80/vaultwarden;
#}
#-------------------
# Port 8096 + 9980 |
#-------------------
#location /jellyfin {
# proxy_pass http://localhost:8096;
#}
#location /collabora {
# proxy_pass http://localhost:9980;
#}
}
- charlie.conf (web server)
location /charlie {
root /var/www/html;
index index.html;
error_log /var/log/nginx/error_charlie.log debug;
# main parameter applies pre-defined config log_format
access_log /var/log/nginx/access_charlie.log main;
# Improves static content transfer rate via buffer bypass
tcp_nopush on;
}