@stacksofplates said in Nginx Config Need to Point Folder Reference Without Stripping:

Couldn't you just use a rewrite for this? Not at a computer but like

rewrite ^/api /api

Maybe, I'll try it!

@NashBrydges said in NGINX Just Stop Working:

Wanted to close the loop here. I've recreated the server and refetched all my certs. It's been working well for the last 2 days. Fingers crossed it stays that way.

Thanks to everyone who participated!

Ah, doing things the DevOps way. When it doubt, nuke and rebuild.

@JaredBusch So... now that you've had this up and running for a while, care to report on how that is going? Inquiring minds are curious. Particularly w.r.t. resource utilization comparison, performance differences, etc. comparatively. I think you were on Mongo previously, correct? Cuz I am right there with you on the license bullshit. All it takes is one bump in the road, merger, and wham, history repeats and next major version changes license again - only this time to something closed. Have no interest in betting on community to fork and continue. Need a safer bet. It would appear that percona may have already done so w/their percona mongodb offering but I wonder if that would continue as a full fork if/when upstream became closed source.

TIA-- o/

@marcinozga said in Tomcat with an NGINX Reverse Proxy and Self-signed SSL Certificate:

I don't know if it's strictly required, I'd add it.

Because the one tells the port to listen on. The other tells it what protocol to use. Since you can use any port, with any protocol, it has to be listed. You can just add it to port 80 if you want, for example.

@scottalanmiller said in Mattermost Behind Nginx and Cloudflare Script Load Error:

@Pete-S said in Mattermost Behind Nginx and Cloudflare Script Load Error:

@scottalanmiller said in Mattermost Behind Nginx and Cloudflare Script Load Error:

@black3dynamite said in Mattermost Behind Nginx and Cloudflare Script Load Error:

s your setup is Cloudflare proxy -> Nginx proxy -> apache (mattermost)?

CF Proxy > Nginx Proxy > Mattermost (MM is its own server)

And yes, if I disable the CF Proxy, it works.

Why the double reverse proxies?

That's the standard. You are always expected to have your node.js servers behind a reverse proxy. And CloudFlare is the CDN cache in front. This is the universal standard for all web servers. Plenty of times to avoid it, of course, but this is the baseline system design.

In this case, MM is a raw node server so has none of the protections or handling of a system like Nginx. Nginx also provides the ability to have multiple sites behind one IP address. MM doesn't do that on its own, nor does CloudFlare. No different than how MangoLassi is on NodeBB, also a node platform, behind Nginx, behind CloudFlare.

CF can't do the details port and IP handling, Nginx can't do the globally distributed cache.

Thanks for the clarification Scott. I (wrongly) thought that Cloudflare was a full featured proxy and could do the same job as haproxy, nginx etc.

You have the answer in the logs you posted. Nginx can't connect to php handler daemon on port 9000, most likely php-fpm.

Got it all working. Thanks for everyone's assistance!

@wrx7m said in Configure Nginx as Reverse Proxy for ScreenConnect to Enable Lets Encrypt:

Less to that than I thought there would be.

It's surprisingly simple and basic. It's really just passing one port to another, and using SSL. About the most basic setup you can have.

@IRJ said in Massive speed increase when switching WordPress from apache to nginx:

I really wanted to do everything server side and be as lean as possible. I wanted zero plugins related to performance on my WP site.

Lean WP, that's an oxymoron if anything :)

I've heard before that some sites are slower with cloudflare CDN compared to going straight to the site. Are you using http/2 as well?

Most likely in this case, the switch to nginx from apache itself didn't make anything noticeably faster but the caching and compression did.

dhcp

If you get external DNS to go to the nginx proxy you could probably allow all traffic to the URL path that lets encrypt needs and then create a whitelist for everything else.

Well let's talk about fedora and updating killing a laptop lol....

Worth noting that the issue comes back when you upgrade to Fedora 31 as well. Same fix still applies.

@black3dynamite said in NGINX Reverse Proxy Help - Error code: SSL_ERROR_RX_RECORD_TOO_LONG:

In the server block, add ssl_protocols TLSv1.2; and reload nginx

no joy. Incognito mode did not work either.

I'd normally keep swap space too but I know for sure you can run without it successfully because we used to do that with embedded linux for years - with devices that had years of uptime.

With memory ballooning you can overcommit RAM and the hypervisor can swap guest RAM to disk if it comes to that. I don't know which hypervisors supports it though. As always it depends on how much you want to cram out of your gear.

@scottalanmiller said in NGINX vs Apache:

@wrx7m said in NGINX vs Apache:

Does Apache have a paid version? I know that nginx reverse proxy is free, but the web server (at least used to be) a paid product.

Apache is totally free. Nginx is free for all normal purposes, it is advanced features that I've never even thought of wanting that are paid.

Ahh. Ok. I misconstrued those features as being the entire product.

@Donahue said in Nginx questions:

looks like the NC thing might be a bug with just iOS and using a reverse proxy
https://github.com/nextcloud/server/issues/11464

yep, the "old method" indeed did work.

@scottalanmiller said in NGinx Configuration Block for Zimbra Reverse Proxy:

Someone was looking for this specifically so...

server { client_max_body_size 80M; server_name my.domain.com; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; proxy_redirect off; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; proxy_pass https://myip:443/; proxy_redirect off; # Socket.IO Support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } listen 80; ssl_stapling on; ssl_stapling_verify on; ssl_session_cache shared:SSL:10m; add_header Strict-Transport-Security "max-age=31536000; includeSubdomains"; listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/my.domain.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/my.domain.com/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot }

Remember to create one for the Admin console on port 7071.