Nginx acting as reverse proxy only partly working

Question

I have a CMS (grav) running inside a Docker-container which somehow gets affected by nginx servicing as reverse-proxy to redirect a web address to a port (e.g. mydomain.de:80 -> 127.0.0.1:8001).

Here is what I observe: the service is generally running fine but certain operations (e.g. trying to log in) fail with an error message on the web interface: "Invalid security token".

Of course this is way too fuzzy information to even guess what component is configured improperly. But to me it looks like it doesn't matter whether or not nginx is proxies the port or not. If I just leave away the nginx everything works fine regardless which port I use inside Docker or which port it's being mapped to.

E.g. the following configurations without nginx work fine:

• EXPORT 80, docker run -p 80:80 .., browse mydomain.de:80
• EXPORT 8001, docker run -p 80:8001 .., browse mydomain.de:80
• EXPORT 80, docker run -p 8001:80 .., browse mydomain.de:8001
• EXPORT 8001, docker run -p 8001:8001 .., browse mydomain.de:8001

as soon as I start nginx as proxy server I get the described error. So currently I guess Docker and Grav are working totally fine and just nginx is not reverse-proxying properly.

This is my nginx server config:

map $http_upgrade $connection_upgrade {
    default         upgrade;
    ''              close;
}

server {
    listen 80;
    server_name mydomain.de;
    location / {
        proxy_pass          http://127.0.0.1:8001;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade     $http_upgrade;
        proxy_set_header    Connection  $connection_upgrade;
    }
}

And this is my nginx.conf which loads the file above:

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    gzip on;
    gzip_disable "msie6";
    include /etc/nginx/sites-enabled/*;
}

Answer 1

Probably there is an issue with creating a session when grav is behind a proxy.

Try to use additional headers in Nginx:

location / {
    ...
    proxy_set_header  Host $host;
    proxy_set_header  X-Real-IP $remote_addr;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  X-Forwarded-For $remote_addr;
    proxy_set_header  X-Forwarded-Host $remote_addr;
}

Additionally there is a reverse_proxy_setup config in grav, did you set it to true?