Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a domain listening on both http and https. I want to redirect all the traffic to https except for two specific locations. It works, but only for mydomain.com, not for www.mydomain.com.

Here the config:

upstream mydomain_rails {
  server unix:/home/deploy/mydomain/shared/pids/unicorn.sock;
}

# blog.mydomain.com
server {
  listen 80;
  server_name blog.mydomain.com;
  rewrite ^ http://www.mydomain.com/de/blog permanent;
}

# blog.mydomain.com.br
server {
  listen 80;
  server_name blog.mydomain.com.br;
  rewrite ^ http://www.mydomain.com/br/blog permanent;
}

# www.mydomain.de
server { 
  listen 80;
  server_name mydomain.de www.mydomain.de;
  rewrite ^ https://www.mydomain.com/de permanent;
}

# www.mydomain.com.br
server {
  listen 80;
  server_name mydomain.com.br www.mydomain.com.br;
  rewrite ^ https://www.mydomain.com/br permanent;
}

server {
listen 80;
server_name mydomain.com;
rewrite ^ http://www.mydomain.com$request_uri permanent;
}

## www.mydomain.com
## Redirect http to https, keep blogs on plain http
server {
  listen      80;
  server_name www.mydomain.com;

  location / {
#     if ($host ~* ^(www\.mydomain\.com)$ ) {
       rewrite  ^/(.*)$  https://www.mydomain.com/$1  permanent;
#     }
#     return 444;
   }

  # Matches any request starting with '/br/blog' and proxies to the upstream blog instance
  location ~* /br/blog {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    if (!-f $request_filename) {
      rewrite ^/br/blog$ /;
      rewrite ^/br/blog/(.*)$ /$1;
      proxy_pass http://mydomain_blog_br;

      break;
    }
  }

  # Matches any request starting with '/de/blog' and proxies to the upstream blog instance
  location ~* /de/blog {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    if (!-f $request_filename) {
      rewrite ^/de/blog$ /;
      rewrite ^/de/blog/(.*)$ /$1;
      proxy_pass http://mydomain_blog;

      break;
    }
  }
}

# www.mydomain.com
server {
  add_header Cache-Control "public, must-revalidate";
  server_name mydomain.com www.mydomain.com;
  listen 443;

  ssl on;
  ssl_certificate /etc/ssl/mydomain.com/sslchain.crt;
  ssl_certificate_key /etc/ssl/mydomain.com/privatekey.key;

## Strict Transport Security (ForceHTTPS), max-age 30d
  add_header Strict-Transport-Security "max-age=2592000; includeSubdomains";

## Due SSL encryption, rather to increase the keepalive requests and timeout
  keepalive_requests 10;
  keepalive_timeout 60 60;

  root       /home/deploy/mydomain/current/public/;
  error_log  /home/deploy/mydomain/shared/log/nginx.error.log info;
  access_log /home/deploy/mydomain/shared/log/nginx.access.log main;

## Redirect from non-www to www
  if ($host = 'mydomain.com' ) {
      rewrite  ^/(.*)$  https://www.mydomain.com/$1  permanent;
  }

## Caching images for 3 months
  location ~* \.(ico|css|js|gif|jpe?g|png)\?[0-9]+$ {
      expires 30d;
      break;
  }
## Deny illegal Host headers
  if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) {
      return 444;
  }

## Deny certain User-Agents (case insensitive)
  if ($http_user_agent ~* (Baiduspider|webalta|Wget|WordPress|youdao|jakarta) ) {
      return 444;
  }

## Deny certain Referers (case insensitive)
  if ($http_referer ~* (dating|diamond|forsale|girl|jewelry|nudit|poker|porn|poweroversoftware|sex|teen|webcam|zippo|zongdo) ) {
      return 444;
  }

## Enable maintenance page. The page is copied in during capistrano deployment
  set $maintenance 0;
  if (-f $document_root/index.html) {
    set $maintenance 1;
  }
  if ($request_uri ~* (jpg|jpeg|gif|png|js|css)$) {
    set $maintenance 0;
  }
  if ($maintenance) {
    rewrite ^(.*)$ /index.html last;
    break;
  }

  location /uk  {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/htpasswd;
    root /home/deploy/mydomain/current/public/; 
    try_files $uri @fallback;
  }


  # Matches any request starting with '/br/blog' and proxies to the upstream blog instance
  location ^~ /br/blog {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    if (!-f $request_filename) {
      rewrite ^/br/blog$ /;
      rewrite ^/br/blog/(.*)$ /$1;
      proxy_pass http://mydomain_blog_br;

      break;
    }
  }

  # Matches any request starting with '/de/blog' and proxies to the upstream blog instance
  location ^~ /de/blog {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    if (!-f $request_filename) {
      rewrite ^/de/blog$ /;
      rewrite ^/de/blog/(.*)$ /$1;
      proxy_pass http://mydomain_blog;

      break;
}} 

  # Matches any request starting with '/lp' and proxies to the upstream blog instance
  location /lp {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    rewrite ^/lp(/?.*)$ /$1;
    proxy_pass http://mydomain_landingpage;

    break;
  }

 #Matches any request, and looks for static files before reverse proxying to the upstream app server socket
  location / {
    root /home/deploy/mydomain/current/public/; 
    try_files $uri @fallback;
  }

  # Called after the above pattern, if no static file is found
  location @fallback {
    proxy_set_header X-Sendfile-Type X-Accel-Redirect;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;

    proxy_pass http://mydomain_rails;
  }



## All other errors get the generic error page
  error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 495 496 497 500 501 502 503 504 505 506 507 /500.html;
      location  /500.html {
          root /home/deploy/mydomain/current/public/;
      }
}

I defined the blog upstream. As said, it works properly for mydomain.com, but not for www.mydomain.com.

Any idea?

share|improve this question

1 Answer 1

Because on line 43 you say to redirect to https:// (but you're not listening on 443). Change that to http

I would also change it to two server blocks, the first is

server {
  listen 80 default;
  server_name mydomain.com;

  rewrite ^ http://www.mydomain.com$request_uri permanent;
}

server {
    listen      80;
    server_name www.mydomain.com;
    # Matches any request starting with '/br/blog' and proxies to the upstream blog instance
    #...and so on with the rest of your config...

}
share|improve this answer
    
Well, I didn't include the HTTPS configuration section, but I do have one and it is working properly. Anyway ... I think the https section is not relevant, since my problem is that I want that (www.)mydomain.com/br/blog an (www.)mydomain.com/de/blog to be skipped from the ssl, and sent to a upstream. This is only working when I exclude the www. From the url. Split in two servers?? Why?? I think it can be achieve with only one server definition. –  Luis Nov 8 '11 at 16:53
    
if you always want mydomain.com to redirect to www.mydomain.com, you need separate server{} blocks, because otherwise it will always redirect to itself ("redirect loop"), even if it is now going to www.mydomain.com. If you don't care whether the www. is there, get rid of the redirect. –  gWaldo Nov 8 '11 at 16:56
    
Just to add, I created 2 server sections, one with www and one without ... and it didn't work. –  Luis Nov 8 '11 at 16:57
1  
Post your entire config, because there are plenty of places where there could be problems. –  gWaldo Nov 8 '11 at 17:02
    
There u have it :-). The upstreams for the blogs are in a different file. As you can see, I had to tackle the problem and redefine the proxy for the blogs in the https section 2, cause it continues redirecting. –  Luis Nov 8 '11 at 17:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.