0

I've been banging my head against the wall trying to figure this out, so if anyone can help I'd appreciate it. My Nginx conf has three different redirect loops, haven't been able to get any of the three to work right. The three problem areas are:

  • Redirecting memcache directory to SSL
  • Redirecting accounts directory to SSL
  • Redirecting SSL to www if non-www

nginx.conf:

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;
    error_log   /var/log/nginx/error.log  notice;
    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;
    proxy_set_header X-Url-Scheme $scheme;

    #gzip  on;
    rewrite_log on;
    include /etc/nginx/conf.d/*.conf;
}

conf.d/default.conf:

server {
    listen       80;
    server_name  <redacted>.net;
    rewrite      ^(.*) http://www.<redacted>.net$1;
}

server {
    listen       80;
    server_name  www.<redacted>.net;

    set_real_ip_from 192.168.30.4;
    set_real_ip_from 192.168.30.5;
    set_real_ip_from 192.168.30.10;
    real_ip_header   X-Forwarded-For;

    #charset koi8-r;
    access_log  /var/log/nginx/host.access.log  main;

    root        /var/www/html;
    index       index.php index.html index.htm;

    location  =/memcache {
        rewrite ^/(.*)$ https://$server_name$request_uri? permanent;
    }

    location /accounts {
        rewrite ^/(.*)$ https://$server_name$request_uri? permanent;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    #
    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include        /etc/nginx/fastcgi_params;
        try_files      $uri = 404;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ /\.ht {
        deny  all;
    }
}

conf.d/ssl.conf:

# HTTPS server
#
server {
    listen       443;
    server_name  <redacted>.net;
    rewrite      ^(.*) https://www.<redacted>.net$1;
}

server {
    listen       443 default_server ssl;
    server_name  www.<redacted>.net;

    set_real_ip_from 192.168.30.4;
    set_real_ip_from 192.168.30.5;
    set_real_ip_from 192.168.30.10;
    real_ip_header   X-Forwarded-For;

    proxy_set_header X-Forwarded_Proto https;
    proxy_set_header Host $host;
    proxy_redirect off;
    proxy_max_temp_file_size 0;
    proxy_set_header X-Forwarded-Ssl on;
    set $https_enabled on;

    ssl_certificate      <redacted>.crt;
    ssl_certificate_key  <redacted>.key;

    ssl_session_timeout  5m;

    ssl_protocols  SSLv2 SSLv3 TLSv1;
    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    root        /var/www/html;
    index       index.php index.html index.htm;

    location  /memcache {
        auth_basic "Restricted";
        auth_basic_user_file  $document_root/memcache/.htpasswd;
    }

    location ~ \.php$ {
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param  HTTPS on;
        include        /etc/nginx/fastcgi_params;
        try_files      $uri = 404;
    }

}
1
  • Debug logs might help to display the problem you are attempting to correct.
    – mdpc
    Dec 18, 2012 at 16:59

1 Answer 1

0

Could you give the following configuration a try. This is extremely simplified and I don't see a single reason to use redirects. You should simply return and exit.

PLEASE NOTE! THIS IS UNTESTED!

root              /var/www/html;
index             index.php index.html index.htm;
error_page        500 502 503 504 /50x.html;
access_log        /var/log/nginx/host.access.log  main;

server {
  listen            [::]:80;
  listen            [::]:443 ssl;
  server_name       <redacted>.net;
  return            301 $scheme://<redacted>.net$request_uri;
}

server {
  listen            [::]:80;
  server_name       www.<redacted>.net;

  set_real_ip_from  192.168.30.4;
  set_real_ip_from  192.168.30.5;
  set_real_ip_from  192.168.30.10;
  real_ip_header    X-Forwarded-For;

  location ~ /\.ht {
    deny all;
  }

  location = /memcache {
    return 301 https://$server_name$request_uri;
  }

  location = /accounts {
    return 301 https://$server_name$request_uri;
  }

  location ~ \.php$ {
    fastcgi_pass    127.0.0.1:9000;
    fastcgi_index   index.php;
    fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include         fastcgi_params;
    try_files       $uri =404;
  }
}

server {
  listen            [::]:443 ssl;
  server_name       www.<redacted>.net;

  set_real_ip_from  192.168.30.4;
  set_real_ip_from  192.168.30.5;
  set_real_ip_from  192.168.30.10;
  real_ip_header    X-Forwarded-For;

  proxy_set_header          X-Forwarded_Proto https;
  proxy_set_header          Host $host;
  proxy_set_header          X-Forwarded-Ssl on;
  proxy_redirect            off;
  proxy_max_temp_file_size  0;
  set                       $https_enabled on;

  ssl_certificate           <redacted>.crt;
  ssl_certificate_key       <redacted>.key;

  ssl_session_timeout       5m;

  ssl_protocols             SSLv2 SSLv3 TLSv1;
  ssl_ciphers               HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;

  location ~ /\.ht {
    deny all;
  }

  location ~ \.php$ {
    fastcgi_pass    127.0.0.1:9000;
    fastcgi_index   index.php;
    fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include         fastcgi_params;
    try_files       $uri =404;
  }
}
4
  • Thanks for the reply. I like what you've done with the config, the one problem I am encountering is proxy_set_header is not allowed in an If. Also, per Nginx's IfIsEvil article, I'd rather not use Ifs except for rewrites or returns if possible. Dec 20, 2012 at 0:31
  • I updated the above configuration. Dec 20, 2012 at 2:09
  • Tried the new config, this one didn't cause any errors, but all three redirect loops are still there. The HTML for these pages is pretty basic, no redirecting going on there. Any idea what else I could try? Dec 20, 2012 at 3:10
  • Check the HTTP headers of the response and post them here. Maybe they can help us where the redirect is coming from. Dec 21, 2012 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .