0

The situation is - On my nginx server I have one virtual host (lets call it inbox) and another (lets call it postal) and to set up postal i followed a set of instructions. Postal has SSL enabled as you can see (see the virtual hosts site-avaibale configs file below in the "extra info" section).

  • http://inbox.go-tribalscale.com/index.html takes me to the correct inbox folder (/var/www/roundcube.go-tribalscale.com/public_html)

the problem is - if i remove "/index.html" from the url it then takes me to postals directory (which loads the app therein , /opt/postal/public)

solutions i think that the problem is in the ssl situation maybe the 443 port takes full control and the url is ignored not sure maybe you guys can help please?

extra info

inbox (edited as per Gerards points)

server {
    listen 80;
    listen [::]:80;
    root /var/www/inbox.go-tribalscale.com/public_html;
    index  index.php index.html index.htm;
    server_name  inbox.go-tribalscale.com www.inbox.go-tribalscale.com;

    client_max_body_size 100M;

     location / {
            try_files $uri $uri/ /index.php?q=$uri&$args;
        }

    location ~ \.php$ {
         include snippets/fastcgi-php.conf;
         fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         include fastcgi_params;
    }

     location ^~ /data {
         deny all;
      }
}



postal

  server {
    listen [::]:80;
    listen 0.0.0.0:80;
    server_name postal.outreach-hangar49.com;
    return 301 https://$host$request_uri;
 }

server {
    listen [::]:443 ssl;
    listen 0.0.0.0:443 ssl;

    root /opt/postal/public;
    server_name postal.outreach-hangar49.com;

    ssl_certificate      /etc/letsencrypt/live/postal.outreach-hangar49.com/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/postal.outreach-hangar49.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

    location / {
       client_max_body_size 50M;
       try_files $uri $uri/index.html $uri.html @puma;
    }

    location /app/assets {
       add_header Cache-Control max-age=3600;
    }

    location @puma {
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://127.0.0.1:5000;
    }
}
2
  • How come there is no "server_name inbox.go-tribalscale.com" in your configuration? Jun 2, 2020 at 11:41
  • your right that was an error in my questions description Jun 2, 2020 at 13:23

2 Answers 2

0

Nginx will need to find suitable server context for the requested port.

So if request comes in port 80 (http) then there are multiple servers to choose from, and Nginx will choose the one with the correct server_name.

But if request comes in port 443 (https) then there isn't much of a chice, and regardless of the server_name directive, Nginx will be forced to choose incorrect server context.

My advise to you:

Create empty servers (with self-signed SSL certificate) that will be a failover for incorrect requests. Only if user pass the correct Host header, (or server_name param for SNI) it will choose the correct context.

Example:

default.conf:

server {
  listen 80;
  server_name _;
  return 404;
}
server {
  listen 443 ssl;
  server_name _;
  ssl_certificate /usr/local/nginx/ssl/localhost.pem;
  ssl_certificate_key /usr/local/nginx/ssl/localhost.key;
  include /usr/local/nginx/snippets/ssl-params.conf;
  return 404;
}

site1.conf:

server {
  listen 80;
  server_name site1.com www.site1.com;
  return 302 https://$host$request_uri;
}
server {
  listen 443 ssl;
  server_name site1.com www.site1.com;
  ssl_certificate /usr/local/nginx/ssl/site1/site1.com/site1.com.pem;
  ssl_certificate_key /usr/local/nginx/ssl/site1/site1.com/site1.com.key;
  include /usr/local/nginx/snippets/ssl-params.conf;
  ...
}

site2.conf:

server {
  listen 80;
  server_name example.com www.example.com;
  return 302 https://$host$request_uri;
}
server {
  listen 443 ssl;
  server_name site2.com www.site2.com;
  ssl_certificate /usr/local/nginx/ssl/site2/site2.com/site2.com.pem;
  ssl_certificate_key /usr/local/nginx/ssl/site2/site2.com/site2.com.key;
  include /usr/local/nginx/snippets/ssl-params.conf;
  ...
}
0

When you visit http://inbox.go-tribalscale.com or http://inbox.go-tribalscale.com/, the following is applied:

location / {
    try_files $uri $uri/ /index.php?q=$uri&$args;
}

If you want index.html to be presented, the try_files should be

    try_files $uri $uri/ /index.html;

If you want this only when you receive a root request, you could add a new location before the current "location /":

location = / {
    try_files $uri $uri/ /index.html;
}

If there is an index.php in /var/www/inbox.go-tribalscale.com/public_html/, then this page is maybe the one sending you to the postal domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .