Strict-Transport-Security and other jails

[NasKar]

I've successfully added ssl to a jail with nextcloud. If I add Strict-Transport-Security to the ngnix.conf it forces https when referencing my external DDNS . This prevents me from accessing my Plex jail (not plugin) from http://myexternalddns.net:port#. How would I get my setup to go to nextcloud with https://myexternalddns.net/nextcloud and plex with https://myexternalddns.net:port#? Would I have to copy the ssl code from the nextcloud nginx.conf and copy the perm files from /usr/local/etc/letsencrypt/live to the same directory in the other jail? Could I apply this to other jails running various plugins?

 

[Jailer]

Set up a proxy server and have it handle SSL termination for your nextcloud jail.

 

[NasKar]

Set up a proxy server and have it handle SSL termination for your nextcloud jail.

thanks for pointing me the right direction.
Can I just add

Code:

location /sonarr {
         proxy_pass http://192.168.1.156:8989;
         proxy_redirect off;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }

to my nginx.conf in the nextcloud jail that is already setup for ssl per your post?
Do I have to make changes to the user interface?

Port was changed to 8989

 

[Jailer]

That's what you need to redirect to another IP listening on port 8989. Make sure it's listening on port 80 in your server block if you want a http connection. If you add it after your location block for Nextcloud it will try to serve it over https since Nextcloud is listening on port 443.

You don't need to make any changes in Nextcloud to make this function.

 

[NasKar]

That's what you need to redirect to another IP listening on port 8989. Make sure it's listening on port 80 in your server block if you want a http connection. If you add it after your location block for Nextcloud it will try to serve it over https since Nextcloud is listening on port 443.

You don't need to make any changes in Nextcloud to make this function.

Here is part of my server block

Code:

server {
        listen      80;
        listen      443 ssl;
        server_name  192.168.1.180;
         add_header Strict-Transport-Security "max-age=0; includeSubDomains; preload;";
#       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        root /usr/local/www;
        location = /robots.txt { allow all; access_log off; log_not_found off; }
        location = /favicon.ico { access_log off; log_not_found off; }

location /sonarr {
         proxy_pass http://192.168.1.156:8989;
         proxy_redirect off;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }

        location ^~ /nextcloud {
            client_max_body_size 512M;
            error_page 403 /nextcloud/core/templates/403.php;
            error_page 404 /nextcloud/core/templates/404.php;
            location /nextcloud {

With this config if I go to https://myexternaldomain/sonarr it works. But not on http://.....
So all the traffic from the https://... site is now encryted even though I have not enabled ssl in sonarr?

 

[Jailer]

You have to put your location block for sonarr above your listen 443 directive. Nginx reads the configuration from top to bottom in the server blocks and your location directive is listed after it's listening on port 443 and that's why it's being served over an encrypted connection. Something like this should work in place of what you have with of course the rest of the nginx config in place.

Code:

server {
        listen      80;
        server_name  192.168.1.180;
        location /sonarr {
            proxy_pass http://192.168.1.156:8989;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            }

        listen      443 ssl;     
#       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        root /usr/local/www;
        location = /robots.txt { allow all; access_log off; log_not_found off; }
        location = /favicon.ico { access_log off; log_not_found off; }


        location ^~ /nextcloud {
            client_max_body_size 512M;
            error_page 403 /nextcloud/core/templates/403.php;
            error_page 404 /nextcloud/core/templates/404.php;
            location /nextcloud }
    }

 

[NasKar]

You have to put your location block for sonarr above your listen 443 directive. Nginx reads the configuration from top to bottom in the server blocks and your location directive is listed after it's listening on port 443 and that's why it's being served over an encrypted connection. Something like this should work in place of what you have with of course the rest of the nginx config in place.

Thanks I didn't realize that.
But if I keep it the original way with proxy stuff below listen 80 and listen 443 and using https://externalIP/sonarr to access sonarr is it encrypted without turning on ssl in sonarr?

 

[Jailer]

I'm not sure as I don't use sonarr and have no idea how it works.

Are you trying to access everything over an encrypted connection?

 

[NasKar]

I'm not sure as I don't use sonarr and have no idea how it works.

same question for any of the plugin Sabnzbd or Couchpotato or Plex etc.

Are you trying to access everything over an encrypted connection?

Sure. Why not try.

 

[Jailer]

Sure. Why not try.

Ok I guess I misunderstood your original question then. I thought you were trying to exclude jails from being accessed via SSL.

Add your location blocks for each jail after the listen 443 and they should all work over an encrypted connection. If you want to access over an encrypted connection do not use Strict Transport Security.

As far as accessing Plex, why not use the certificate and encryption built into it to access it?

 

[NasKar]

As far as accessing Plex, why not use the certificate and encryption built into it to access it?

I'm trying to give others access my plex on their ipad by going to http;/myexternalIP:portforwardedtoserveronrouter without the Plex app. No problem from a computer with their login.

If you want to access over an encrypted connection do not use Strict Transport Security.

I'm confused, I thought that Strict Transport Security forced the browser to use https://
That was the original problem preventing http:// access as metioned in the previous paragraph when enabling STS.
I couldn't access Plex from https;/myexternalIP:portforwardedtoserveronrouter after adding the proxy code after listen 443.

 

[Jailer]

Ahh! typo on my part, sorry about that. Strict transport security forces https after your initial visit to a site for the time period specified.

I'm trying to give others access my plex on their ipad by going to http;/myexternalIP:portforwardedtoserveronrouter without the Plex app.

Copy that. I'm not sure exactly how you would do that. I think there is a thread on the plex forums that explains how to set this up.