Template
Nginx Reverse Proxy + Auto-Renewing SSL
HTTPS in front of your app, API or container, with a certificate that renews by itself.
Options
As they appear on the run form, with their defaults.
Domains
List: one per line or comma-separated
Each must already point at this server. The first one names the site and certificate.
Default: Required
Forward requests to
Text
Such as http://127.0.0.1:8000 for an app on this server, or unix:/run/app.sock.
Default: Required
Email for Let's Encrypt
Text
Optional. Let's Encrypt uses it for account recovery and service notices.
Default: Empty
I accept the Let's Encrypt Subscriber Agreement
On or off
Required to get a certificate. Read it at https://letsencrypt.org/repository/.
Default: Off
Redirect HTTP to HTTPS
On or off
Default: On
Support WebSocket connections
On or off
Default: On
Largest request body
One choice
Larger uploads are refused before they reach the application.
- 1 MB
- 10 MB
- 100 MB
- 1 GB
Default: 10 MB
Use a staging certificate
On or off
For testing. Browsers do not trust staging certificates, but the limits are much higher.
Default: Off
Send HSTS
On or off
Browsers then use HTTPS only, for a year. Turn it on once HTTPS works for every domain.
Default: Off
What you get
Nginx with a Let's Encrypt certificate in front of your application, API or container, forwarding every request with the X-Forwarded headers and WebSocket support, and a certificate that renews by itself with nginx reloaded after each renewal. The run ends with a renewal dry run and a check that port 443 serves the certificate, so you know renewal will work before it matters.
Before you run it
- Every domain must already point at this server: its DNS A record (and AAAA, if you publish one) must hold the server's public address.
- Ports 80 and 443 must be open in the server's firewall and your provider's firewall or security group.
Choosing the options
The options are the Configure Reverse Proxy playbook's; its page explains each one. In short:
- Domains — the first one names the site and the certificate.
- Forward requests to — such as
http://127.0.0.1:8000, orunix:/run/app.sock. - I accept the Let's Encrypt Subscriber Agreement — required.
- Use a staging certificate — only for a first test; browsers do not trust it.
- Send HSTS — only once HTTPS works for every domain.
What happens
- Update Packages.
- Install Nginx.
- Install Certbot.
- Configure Reverse Proxy — the site and the certificate, after a staging dry run.
- Configure Certificate Renewal.
- Check Certificate Renewal for the new certificate.
After the run
Visit the first domain over HTTPS. Until your application answers at the address you forward to, visitors see 502 Bad Gateway. Add an SSL certificate monitor in Monitoring to be warned well before any expiry.
Common problems
- Let's Encrypt could not validate the domain — DNS does not point here yet, or port 80 is blocked. See Configure Reverse Proxy.
- Another nginx site already answers for the domain — remove the other site first.
- 502 Bad Gateway — your application is not answering at the upstream address yet.