location /nextcloud {
proxy_pass http://192.168.1.10;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
client_max_body_size 16400M;
Do you keep all sites / services in one file? Or each in a separate file?
Ok, try replacing what you set up in NextCloud's reverse proxy
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
client_max_body_size 16400M;
proxy_pass https://Internal IP of NextCloud;
proxy_read_timeout 90;
proxy_redirect https://Internal IP of NextCloud https://Your domain;
}
I have followed your advice. The only Headers I have added is now in my nc nginx.conf. Nothing in the proxy.conf and the nginx.conf of the proxy. But I have still this two issues:
Headers
X-Frame-Options
X-Content-Type-Options
X-XSS-Protection
X-Download-Options
X-Permitted-Cross-Domain-Policies
__Host-Prefix
The __Host prefix mitigates cookie injection vulnerabilities within potential third-party software sharing the same second level domain. It is an additional hardening on top of 'normal' same-site cookies.
Try adding them to NextCloud's reverse proxy
add_header Strict-Transport-Security "max-age=31536000; " always; add_header X-Frame-Options $x_frame_options; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block";
root@proxy:/usr/local/www # ls -la total 51 drwxr-xr-x 5 root wheel 6 Nov 24 20:44 . drwxr-xr-x 15 root wheel 15 Sep 11 10:38 .. drwxr-xr-x 3 root wheel 3 Sep 11 10:39 letsencrypt lrwxr-xr-x 1 root wheel 25 Sep 11 10:39 nginx -> /usr/local/www/nginx-dist dr-xr-xr-x 3 root wheel 6 Nov 11 00:01 nginx-dist
# cat letsencrypt.conf
location ^~ /.well-known/acme-challenge {
root /usr/local/www/letsencrypt/;
}
server {
listen 80;
listen [::]:80;
server_name foo.bar.pasta;
include /usr/local/etc/nginx/letsencrypt.conf;
location / {
return 301 https://$Host/$URI;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name foo.bar.pasta;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
ssl_certificate /usr/local/etc/letsencrypt/live/foo.bar.pasta/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/foo.bar.pasta/privkey.pem;
ssl_certificate /usr/local/etc/nginx/certs_ecc/foo.bar.pasta/fullchain.pem; # these are acme.sh ECDHE keys
ssl_certificate_key /usr/local/etc/nginx/certs_ecc/foo.bar.pasta/key.pem; # """""
include /usr/local/etc/nginx/letsencrypt.conf;
location / {
proxy_pass http://10.0.0.1:80;
include /usr/local/etc/nginx/proxy-control.conf;
proxy_ssl_certificate /usr/local/etc/letsencrypt/live/foo.bar.pasta/fullchain.pem;
proxy_ssl_certificate_key /usr/local/etc/letsencrypt/live/foo.bar.pasta/privkey.pem;
}
certbot certonly --webroot -w /usr/local/www/letsencrypt/ -d foo.bar.pasta -d other.foo.bar.pasta --rsa-key-size 4096# cat /usr/local/etc/letsencrypt/renewal/foo.bar.pasta.conf # renew_before_expiry = 30 days version = 0.27.1 archive_dir = /usr/local/etc/letsencrypt/archive/foo.bar.pasta cert = /usr/local/etc/letsencrypt/live/foo.bar.pasta/cert.pem privkey = /usr/local/etc/letsencrypt/live/foo.bar.pasta/privkey.pem chain = /usr/local/etc/letsencrypt/live/foo.bar.pasta/chain.pem fullchain = /usr/local/etc/letsencrypt/live/foo.bar.pasta/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = webroot rsa_key_size = 4096 account = RANDOMNUMBER renew_hook = /root/letsencrypt.sh server = https://acme-v02.api.letsencrypt.org/directory [[webroot_map]] foo.bar.pasta = /usr/local/www/letsencrypt other.foo.bar.pasta = /usr/local/www/letsencrypt
proxy_connect_timeout 59s; proxy_send_timeout 600; proxy_read_timeout 36000s; proxy_buffer_size 64k; proxy_buffers 16 32k; proxy_pass_header Set-Cookie; proxy_hide_header Vary; proxy_busy_buffers_size 64k; proxy_temp_file_write_size 64k; proxy_set_header Accept-Encoding ''; proxy_ignore_headers Cache-Control Expires; proxy_set_header Referer $http_referer; proxy_set_header Host $host; proxy_set_header Cookie $http_cookie; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port '443'; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-Proto https; proxy_set_header Authorization ''; proxy_buffering off; proxy_redirect off; ## Required for Plex WebSockets proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade";
# HTTP server
server {
listen 80;
listen [::]:80;
server_name nextcloud.foo.bar;
include /usr/local/etc/nginx/letsencrypt.conf;
location / {
return 301 https://$Host/$URI;
}
}
# HTTPS server
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name nextcloud.foo.bar;
"SNIP irrelevant stuff"
location / {
proxy_pass https://192.168.1.202:443;
include /usr/local/etc/nginx/proxy.conf;
proxy_ssl_certificate /usr/local/etc/letsencrypt/live/nextcloud.foo.bar/fullchain.pem;
proxy_ssl_certificate_key /usr/local/etc/letsencrypt/live/nextcloud.foo.bar/privkey.pem;
}
}
if ($args ~* "(.{1,})=(.{1,})" ){
rewrite ^/$ /444_rewrite?;
}
location /444_rewrite {
return 444;
}location /nextcloud {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
client_max_body_size 16400M;
proxy_read_timeout 90;
proxy_pass http://LOCAL-IP-ADDRESS:80;
proxy_redirect http://LOCAL-IP-ADDRESS:80 https://MYWEBSITE.com/nextcloud;
}
@weingeist Did you get this figured out? I'm trying to do the same thing as you here and your modified code works great from my PC.
#user nobody;
worker_processes 1;
# This default error log path is compiled-in to make sure configuration parsing
# errors are logged somewhere, especially during unattended boot when stderr
# isn't normally logged anywhere. This path will be touched on every nginx
# start regardless of error log location configured here. See
# https://trac.nginx.org/nginx/ticket/147 for more info.
#
#error_log /var/log/nginx/error.log;
#
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
#access_log logs/access.log main;
sendfile on;
#tcp_nopush on;
#keepalive_timeout 0;
keepalive_timeout 65;
#gzip on;
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root /usr/local/www/nginx;
index index.html index.htm;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/local/www/nginx-dist;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
server {
listen 443 ssl;
server_name proxy.domain.com;
include ssl_common.conf;
include proxy_setup.conf;
# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
# location / {
# root html;
# index index.html index.htm;
# }
}
}
location /cloud {
proxy_pass https://192.168.1.235:443/; #(192.168.1.235 being LAN ip of NC server)
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}# Thanks to https://cipherli.st/ for providing a great reference! Please check out their site # to make sure your SSL Configuration is up to date with current standards! Be aware that in this # example we use a slightly liberal cipherlist to allow for older browsers on older devices, Eg. # IE8, android 2.4, etc # Enable Perfect Forward Secrecy (PFS) ssl_prefer_server_ciphers on; ssl_certificate /usr/local/etc/letsencrypt/live/proxy.domain.com/fullchain.pem; ssl_certificate_key /usr/local/etc/letsencrypt/live/proxy.domain.com/privkey.pem; # Disable SSLv2 and SSLv3 (BEAST and POODLE attacks) ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Enable our strong DH Key ssl_dhparam /usr/local/etc/ssl/dhparams.pem; # Cipher-list for PFS. ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-G$ ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_cache shared:SSL:10m; ssl_session_tickets off; # Requires nginx >= 1.5.9 ssl_stapling on; # Requires nginx >= 1.3.7 ssl_stapling_verify on; # Requires nginx => 1.3.7 resolver 8.8.8.8 4.4.4.4 valid=300s; resolver_timeout 5s; # HSTS Support add_header Strict-Transport-Security "max-age=63072000;includeSubdomains; preload"; # These headers can break applications, be careful! add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff;
'overwrite.cli.url' => 'https://proxy.domain.com/cloud/', 'overwritewebroot' => '/cloud',
