May 16, 20206 yr 48 minutes ago, izarkhin said: HI guys, My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached. Thanks! [removed].duckdns.org.conf 1015 B · 0 downloads letsencrypt.log 3.05 kB · 0 downloads Never mind! Turns out I needed to open port 80 for the challenge to work. All fine now.
May 16, 20206 yr did anyone ever manage to get a nginx subdomain proxy setup with bitnami's phpbb that you wouldn't mind sharing?
May 17, 20206 yr I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP. But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where?
May 17, 20206 yr 7 hours ago, madaroda said: I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP. But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where? Try following this https://blog.linuxserver.io/2019/07/10/troubleshooting-letsencrypt-image-port-mapping-and-forwarding/
May 17, 20206 yr Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider. Edited May 17, 20206 yr by Tucubanito07
May 17, 20206 yr 40 minutes ago, Tucubanito07 said: Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider. Post what you changed/tried to make it work and we'll take a look
May 17, 20206 yr 3 minutes ago, aptalca said: Post what you changed/tried to make it work and we'll take a look Thank you so much @aptalca This config is the one that this guide said to use. https://technicalramblings.com/blog/how-to-set-up-a-wordpress-site-with-letsencrypt-and-mariadb-on-unraid/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainname.com; return 301 https://domainnamecom$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainname.com; return 301 https://domainname.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainname.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } So i dont think that one is the one working. I copied the nextcloud config file and changed the name of the site server and also the app name. I believe this one is the ones that is working. Since it had nextcloud i changed it to WordPress and now i get a 502 Bad Gateway. Here is that config. # make sure that your dns has a cname set for nextcloud # assuming this container is called "letsencrypt", edit your nextcloud container's config # located at /config/www/nextcloud/config/config.php and add the following lines before the ");": # 'trusted_proxies' => ['letsencrypt'], # 'overwrite.cli.url' => 'https://nextcloud.your-domain.com/', # 'overwritehost' => 'nextcloud.your-domain.com', # 'overwriteprotocol' => 'https', # # Also don't forget to add your domain name to the trusted domains array. It should look somewhat like this: # array ( # 0 => '192.168.0.1:444', # This line may look different on your setup, don't modify it. # 1 => 'nextcloud.your-domain.com', # ), server { listen 443 ssl; listen [::]:443 ssl; server_name mydomainname.com; include /config/nginx/ssl.conf; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; client_max_body_size 0; location / { include /config/nginx/proxy.conf; resolver 127.0.0.11 valid=30s; set $upstream_app WordPress; set $upstream_port 443; set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_max_temp_file_size 2048m; } }
May 17, 20206 yr This is how the container looks The logs look like this. I dont see the domain i own with google on the EXTRA_DOMAIN parameters.
May 17, 20206 yr You have probably used the wrong name for the variable. It's EXTRA_DOMAINS. Show us how it looks like if you click Edit on Extra domain. And please use the code tag if you insert config files or else it's a pain to read them. Like this Much easier to read for our sore eyes Edited May 17, 20206 yr by saarg
May 17, 20206 yr 18 minutes ago, saarg said: You have probably used the wrong name for the variable. It's EXTRA_DOMAINS. Show us how it looks like if you click Edit on Extra domain. And please use the code tag if you insert config files or else it's a pain to read them. Like this Much easier to read for our sore eyes Ok so i was missing the S in EXTRA_DOMAINS i had EXTRA_DOMAIN. I do see that my domain on the logs does not have an error. Before i was doing domainname.com,www.domainname.com. The www.domainname.com was the one throwing an error. I delete it. Now i have been trying other configs like the ones above and grrr.
May 17, 20206 yr This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; }
May 17, 20206 yr 56 minutes ago, Tucubanito07 said: This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } Learn how to put the config in a code tag! Don't we already have a wordpress proxy-conf?
May 17, 20206 yr 3 minutes ago, saarg said: Learn how to put the config in a code tag! Don't we already have a wordpress proxy-conf? I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag?
May 17, 20206 yr 3 minutes ago, Tucubanito07 said: I don't see in under proxy-conf. That is where i looked first before asking and i don't see anything. What do you mean by putting a config in a code tag? Look a couple of posts up. I already asked you to do it there. I thought we had one, but no we don't have a proxy-conf for it.
May 17, 20206 yr 4 minutes ago, saarg said: Look a couple of posts up. I already asked you to do it there. I thought we had one, but no we don't have a proxy-conf for it. Yea you guys don't have one. Now, when you say look a couple of posts up i dont see where you said to try anything.
May 17, 20206 yr Just now, Tucubanito07 said: Yea you guys don't have one. Now, when you say look a couple of posts up i dont see where you said to try anything.
May 17, 20206 yr 5 minutes ago, saarg said: I have already resolve the problem with not getting the certificate. I only need to point the NGINX to the wordpress domain so people can see the site. I know on nextcloud they have a config file we have to change to connect to reverse proxy. However, i dont see a config file in wordpress.
May 17, 20206 yr This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } When you say tag do you mean like this? @saarg
May 17, 20206 yr 29 minutes ago, Tucubanito07 said: This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } When you say tag do you mean like this? @saarg Finally 😁
May 18, 20206 yr 8 hours ago, Tucubanito07 said: This is the config i am using under letsencrypt/nginx/proxy-confs/ # REDIRECT WWW TO https://[domain.com] server { listen 80; listen 443 ssl http2; server_name www.domainame.com; return 301 https://domainame.com$request_uri; } # REDIRECT HTTP TRAFFIC TO https://[domain.com] server { listen 80; server_name domainame.com; return 301 https://domainame.com$request_uri; } # BLOG SITE server { listen 443 ssl http2; server_name domainame.com; ## Source: https://github.com/1activegeek/nginx-config-collection ## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME! ## Certificates from LE container placement ssl_certificate /config/keys/letsencrypt/fullchain.pem; ssl_certificate_key /config/keys/letsencrypt/privkey.pem; ## Strong Security recommended settings per cipherli.st ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 ssl_session_timeout 10m; ## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap ## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com) add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE! add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe! add_header Referrer-Policy "strict-origin-when-cross-origin"; add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;"; #FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/ proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi. more_set_headers "Server: Classified"; more_clear_headers 'X-Powered-By'; client_max_body_size 0; root /config/www/wordpress/; index index.html index.php; location ~ /\. { deny all; } location / { try_files $uri $uri/ /index.php?_url=$uri&$query_string; } # PHP location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; # With php7-cgi alone: fastcgi_pass 127.0.0.1:9000; # With php7-fpm: #fastcgi_pass unix:/var/run/php7-fpm.sock; fastcgi_index index.php; include /etc/nginx/fastcgi_params; } fastcgi_buffer_size 4K; fastcgi_buffers 64 4k; } When you say tag do you mean like this? @saarg You have way too many modifications there. Either contact the author of the guide you used, or use our guide here: https://blog.linuxserver.io/2019/04/25/letsencrypt-nginx-starter-guide/
May 18, 20206 yr On 4/22/2020 at 6:30 AM, aptalca said: 502 means letsencrypt can't reach the service at the specified address and port How can I drill down the issue? I haven't remaned the container and the port is pretty straight forward. It work for several other containers, but not for nextcloud.
May 19, 20206 yr 8 hours ago, Jaster said: How can I drill down the issue? I haven't remaned the container and the port is pretty straight forward. It work for several other containers, but not for nextcloud. Can't say without seeing your settings
May 19, 20206 yr I found out, that the nextcloud container seems not to be reachable via the name, if I use the server ip, it's fine. every other container works fine.
May 19, 20206 yr 12 hours ago, Jaster said: I found out, that the nextcloud container seems not to be reachable via the name, if I use the server ip, it's fine. every other container works fine. Is it on the same custom bridge as letsencrypt and the container name is all lowercase?
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.