nginx returns 302 FOUND with http instead of https

Question

I try to access https://seafile.example.com, which is a proxied application. The application will return 302, but with HTTP instead of HTTPS. Should this be fixed in Nginx or the application (Seafile in this case), I tried it, but don't know what's wrong:

Output from curl -v https://seafile.example.com

< HTTP/1.1 302 FOUND
< Server: nginx/1.12.2
< Date: Fri, 18 May 2018 03:08:02 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Vary: Accept-Language, Cookie
< Location: http://seafile.example.com/accounts/login?next=/
< Content-Language: en

I would have expected https://seafile ...

Nginx config:

server {
    listen 80;
    server_name seafile.example.com;

    return 301 https://$server_name$request_uri;
}
server {
    listen 443 ssl;
    server_name seafile.example.com;
    ssl_certificate /etc/letsencrypt/live/seafile.example.com-0001/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/seafile.example.com-0001/privkey.pem; # managed by Certbot

    include /etc/nginx/conf.d/ssl.conf;

   proxy_set_header X_Forwarded-For $remote_addr;

   location / {
   proxy_pass         http://192.168.99.12:8000;
   proxy_set_header   Host $host;
   proxy_set_header   X-Real-IP $remote_addr;
   proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header   X-Forwarded-Host $server_name;
   proxy_set_header   X-Forwarded-Proto https;

   access_log      /var/log/nginx/seahub.access.log;
   error_log       /var/log/nginx/seahub.error.log;

   proxy_read_timeout  1200s;

   client_max_body_size 0;
   }
   location /seafhttp {
       rewrite ^/seafhttp(.*)$ $1 break;
       proxy_pass http://192.168.99.12:8082;
       client_max_body_size 0;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_connect_timeout  36000s;
       proxy_read_timeout  36000s;
       proxy_send_timeout  36000s;
       send_timeout  36000s;
   }

seahub_settings.py

# -*- coding: utf-8 -*-
SECRET_KEY = "random"

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'seahub-db',
        'USER': 'seafile',
        'PASSWORD': 'random',
        'HOST': '127.0.0.1',
        'PORT': '3306'
    }
}

FILE_SERVER_ROOT = 'https://seafile.example.com'

EMAIL_USE_TLS = True
EMAIL_HOST = 'mail.example.com'        # smpt server
EMAIL_HOST_USER = ''    # username and domain
EMAIL_HOST_PASSWORD = ''    # password
EMAIL_PORT = 25
DEFAULT_FROM_EMAIL = '[email protected]'
SERVER_EMAIL = '[email protected]'

ccnet.conf

[General]
USER_NAME = seafile
ID = ranodm
NAME = seafile
SERVICE_URL = https://seafile.example.com

[Client]
PORT = 13419

[Database]
ENGINE = mysql
HOST = 127.0.0.1
PORT = 3306
USER = seafile
PASSWD = random
DB = ccnet-db
CONNECTION_CHARSET = utf8

Answer 1

Try this snippet:

server {
        listen 443;
        listen [::]:443;
        server_name seafile.example.com;
        include /etc/nginx/conf.d/ssl.conf;
        location / {
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_pass http://192.168.99.12:8000/;
                proxy_http_version 1.1;
                proxy_redirect http://192.168.99.12:8000/ https://seafile.example.com/;
                proxy_read_timeout  1200s;
                client_max_body_size 0;
        }
        ssl     on;
        ssl_certificate /etc/letsencrypt/live/seafile.example.com-0001/fullchain.pem;
        ssl_certificate_key     /etc/letsencrypt/live/seafile.example.com-0001/privkey.pem;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
}