I am trying to configure nginx to serve two differents sites on the same IP address, and I'm having trouble to make this work.

server_tokens off;  # hide nginx version

# site1.com app is served from localhost:3006
# site2.com is served from a socket:
upstream puma {
  server unix:/var/www/site1/sockets/puma.sock fail_timeout=0;

# Site 1 should be served over HTTP
server {
  listen   80;
  server_name site1.com;

  location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_set_header X-NginX-Proxy true;
    proxy_pass http://localhost:3006/;

  access_log /var/www/site2/log/site1.nginx.access.log;
  error_log  /var/www/site2/log/site1.nginx.error.log;

# Site 2 over HTTP should redirect to site 2 HTTPS
server {
  listen 80;
  server_name site2.com;
  return 301 https://$host$request_uri;

# Site 2 should be served over HTTPS
server {
  listen 443 ssl;

  ssl_certificate /etc/letsencrypt/live/site2.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/site2.com/privkey.pem;

  access_log /var/www/site2/log/nginx.access.log;
  error_log  /var/www/site2/log/nginx.error.log;

  # if the maintenance file exists, we return it
  if (-f /var/www/site2/public/system/maintenance.html) {
    return 503;

  error_page 503 @maintenance;
  location @maintenance {
    rewrite ^(.*)$ /system/maintenance.html last;

  # .well-known is for letsencrypt certificates
  location ~ ^/(static|assets|files|system|.well-known)/ {
    root /var/www/site2/public;

  location / {
    proxy_pass http://puma;

    # Keep the original host and pass it to the Rails app,
    # so it can handle differently requests from different
    # subdomains.
    # If proxy_set_header is not used, Rails will only see
    # 'puma' as host of requests.
    proxy_set_header Host $host;
    # More headers are needed by rack, for various reasons,
    # including security checks
    # see https://github.com/rails/rails/issues/22965
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Ssl on;  # optional
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Forwarded-Host $host;

Currently, site2.com works fine, but requests for site1.com result in a 'misconfigured certificate' error.

Shouldn't all requests to the site1.com domain be handled by the first server directive?

  • Welcome to Server Fault. Please add the exact test procedure you used to reach your test result to the question. – Tero Kilkanen Oct 6 '18 at 23:19
  • @TeroKilkanen My procedure: I restarted nginx and wrote site1.com in my browser's address bar. – vmarquet Oct 6 '18 at 23:45
  • Okay nevermind, this is a combined mistake with the deployment tool and docker where the nginx conf file is overwritten with the bad one... – vmarquet Oct 6 '18 at 23:54
  • please add you solution as an answer to the question, so the question will be set as solved. – Phillip -Zyan K Lee- Stockmann Oct 7 '18 at 8:01

Part of the mistake was that I was using the nginx docker image, with a Dockerfile like:

FROM nginx

COPY nginx.prod.conf /etc/nginx/conf.d/default.conf

They say to use sudo docker exec [name] nginx -s reload to reload nginx inside the docker, but this does not import the new conf inside docker, it just reloads the same one...

My solution: don't use docker. In my case, it was only a new layer of complexity and error prone. Of course YMMV, docker can be really usefull if properly managed by your deployment tool.

  • "Don't use docker" is a bad solution and an even worse general statement. But indeed, every technology adds to the complexity of the solution and you should keep your solution as simple as possible. Especially if you don't fully understand all the pieces involved. – Tommiie Oct 8 '18 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.