Strict-Transport-Security and other jails

[NasKar]

<div class="bbWrapper">I've successfully added ssl to a jail with nextcloud. If I add Strict-Transport-Security to the ngnix.conf it forces https when referencing my external DDNS . This prevents me from accessing my Plex jail (not plugin) from <a href="http://myexternalddns.net:port#" target="_blank" class="link link--external" rel="nofollow ugc noopener">http://myexternalddns.net:port#</a>. How would I get my setup to go to nextcloud with <a href="https://myexternalddns.net/nextcloud" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://myexternalddns.net/nextcloud</a> and plex with <a href="https://myexternalddns.net:port#?" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://myexternalddns.net:port#?</a> Would I have to copy the ssl code from the nextcloud nginx.conf and copy the perm files from /usr/local/etc/letsencrypt/live to the same directory in the other jail? Could I apply this to other jails running various plugins?</div>

 

[Jailer]

<div class="bbWrapper">Set up a proxy server and have it handle SSL termination for your nextcloud jail.</div>

 

[NasKar]

<div class="bbWrapper"><blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 348540" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=348540" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-348540">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> Set up a proxy server and have it handle SSL termination for your nextcloud jail. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>thanks for pointing me the right direction.<br /> Can I just add<br /> <div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre> location /sonarr { proxy_pass http://192.168.1.156:8989; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } </pre></div> to my nginx.conf in the nextcloud jail that is already setup for ssl per your <a href="https://forums.freenas.org/index.php?threads/any-guide-on-reverse-proxy-with-nginx.49418/#post-339798" target="_blank" class="link link--external" rel="nofollow ugc noopener">post</a>?<br /> Do I have to make changes to the user interface?<br /> <script class="js-extraPhrases" type="application/json"> { "lightbox_close": "Close", "lightbox_next": "Next", "lightbox_previous": "Previous", "lightbox_error": "The requested content cannot be loaded. Please try again later.", "lightbox_start_slideshow": "Start slideshow", "lightbox_stop_slideshow": "Stop slideshow", "lightbox_full_screen": "Full screen", "lightbox_thumbnails": "Thumbnails", "lightbox_download": "Download", "lightbox_share": "Share", "lightbox_zoom": "Zoom", "lightbox_new_window": "New window", "lightbox_toggle_sidebar": "Toggle sidebar" } </script> <div class="bbImageWrapper js-lbImage" title="sonarr proxy.jpg" data-src="https://www.truenas.com/community/attachments/sonarr-proxy-jpg.16008/" data-lb-sidebar-href="" data-lb-caption-extra-html="" data-single-image="1"> <img src="https://www.truenas.com/community/attachments/sonarr-proxy-jpg.16008/" data-url="" class="bbImage" data-zoom-target="1" style="" alt="sonarr proxy.jpg" title="sonarr proxy.jpg" width="748" height="446" loading="lazy" /> </div> <br /> Port was changed to 8989</div>

 

[Jailer]

<div class="bbWrapper">That's what you need to redirect to another IP listening on port 8989. Make sure it's listening on port 80 in your server block if you want a http connection. If you add it after your location block for Nextcloud it will try to serve it over https since Nextcloud is listening on port 443. <br /> <br /> You don't need to make any changes in Nextcloud to make this function.</div>

 

[NasKar]

<div class="bbWrapper"><blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 348809" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=348809" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-348809">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> That's what you need to redirect to another IP listening on port 8989. Make sure it's listening on port 80 in your server block if you want a http connection. If you add it after your location block for Nextcloud it will try to serve it over https since Nextcloud is listening on port 443.<br /> <br /> You don't need to make any changes in Nextcloud to make this function. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>Here is part of my server block<br /> <div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre> server { listen 80; listen 443 ssl; server_name 192.168.1.180; add_header Strict-Transport-Security &quot;max-age=0; includeSubDomains; preload;&quot;; # add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains&quot; always; root /usr/local/www; location = /robots.txt { allow all; access_log off; log_not_found off; } location = /favicon.ico { access_log off; log_not_found off; } location /sonarr { proxy_pass http://192.168.1.156:8989; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location ^~ /nextcloud { client_max_body_size 512M; error_page 403 /nextcloud/core/templates/403.php; error_page 404 /nextcloud/core/templates/404.php; location /nextcloud { </pre></div><br /> With this config if I go to <a href="https://myexternaldomain/sonarr" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://myexternaldomain/sonarr</a> it works. But not on <a href="http://" target="_blank" class="link link--external" rel="nofollow ugc noopener">http://</a>.....<br /> So all the traffic from the <a href="https://" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://</a>... site is now encryted even though I have not enabled ssl in sonarr?</div>

 

[Jailer]

<div class="bbWrapper">You have to put your location block for sonarr above your listen 443 directive. Nginx reads the configuration from top to bottom in the server blocks and your location directive is listed after it's listening on port 443 and that's why it's being served over an encrypted connection. Something like this <i>should</i> work in place of what you have with of course the rest of the nginx config in place. <br /> <br /> <div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre> server { listen 80; server_name 192.168.1.180; location /sonarr { proxy_pass http://192.168.1.156:8989; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } listen 443 ssl; # add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains&quot; always; root /usr/local/www; location = /robots.txt { allow all; access_log off; log_not_found off; } location = /favicon.ico { access_log off; log_not_found off; } location ^~ /nextcloud { client_max_body_size 512M; error_page 403 /nextcloud/core/templates/403.php; error_page 404 /nextcloud/core/templates/404.php; location /nextcloud } }</pre></div></div>

 

[NasKar]

<div class="bbWrapper"><blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 348986" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=348986" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-348986">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> You have to put your location block for sonarr above your listen 443 directive. Nginx reads the configuration from top to bottom in the server blocks and your location directive is listed after it's listening on port 443 and that's why it's being served over an encrypted connection. Something like this <i>should</i> work in place of what you have with of course the rest of the nginx config in place. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>Thanks I didn't realize that. <br /> But if I keep it the original way with proxy stuff below listen 80 and listen 443 and using <a href="https://externalIP/sonarr" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://externalIP/sonarr</a> to access sonarr is it encrypted without turning on ssl in sonarr?</div>

 

[Jailer]

<div class="bbWrapper">I'm not sure as I don't use sonarr and have no idea how it works. <br /> <br /> Are you trying to access everything over an encrypted connection?</div>

 

[NasKar]

<div class="bbWrapper"><blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 349012" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349012" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349012">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> I'm not sure as I don't use sonarr and have no idea how it works. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>same question for any of the plugin Sabnzbd or Couchpotato or Plex etc.<br /> <blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 349012" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349012" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349012">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> Are you trying to access everything over an encrypted connection? </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>Sure. Why not try.</div>

 

[Jailer]

<div class="bbWrapper"><blockquote data-attributes="member: 55856" data-quote="NasKar" data-source="post: 349041" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349041" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349041">NasKar said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> Sure. Why not try. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>Ok I guess I misunderstood your original question then. I thought you were trying to exclude jails from being accessed via SSL. <br /> <br /> Add your location blocks for each jail after the listen 443 and they should all work over an encrypted connection. If you want to access over an encrypted connection do not use Strict Transport Security. <br /> <br /> As far as accessing Plex, why not use the certificate and encryption built into it to access it?</div>

 

[NasKar]

<div class="bbWrapper"><blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 349276" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349276" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349276">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> As far as accessing Plex, why not use the certificate and encryption built into it to access it? </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>I'm trying to give others access my plex on their ipad by going to http;/myexternalIP:portforwardedtoserveronrouter without the Plex app. No problem from a computer with their login.<br /> <br /> <blockquote data-attributes="member: 43288" data-quote="Jailer" data-source="post: 349276" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349276" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349276">Jailer said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> If you want to access over an encrypted connection do not use Strict Transport Security. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>I'm confused, I thought that Strict Transport Security forced the browser to use https://<br /> That was the original problem preventing http:// access as metioned in the previous paragraph when enabling STS. <br /> I couldn't access Plex from https;/myexternalIP:portforwardedtoserveronrouter after adding the proxy code after listen 443.</div>

 

[Jailer]

<div class="bbWrapper">Ahh! typo on my part, sorry about that. Strict transport security forces https after your initial visit to a site for the time period specified. <br /> <blockquote data-attributes="member: 55856" data-quote="NasKar" data-source="post: 349336" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=349336" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-349336">NasKar said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> I'm trying to give others access my plex on their ipad by going to http;/myexternalIP:portforwardedtoserveronrouter without the Plex app. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>Copy that. I'm not sure exactly how you would do that. I think there is a thread on the plex forums that explains how to set this up.</div>