App behind Nginx SSL proxy

[prugala]

Hi

Im trying to run app behind nginx proxy but doesn't work.

My nginx site configuration:

server {
  server_name mywebsite.com;
  location / {
     proxy_pass http://127.0.0.1:8081;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mywebsite.comfullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = mywebsite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  server_name mywebsite.com;
    listen 80;
    return 404; # managed by Certbot


}

compose.prod.yaml:

# Production environment override
services:
  php:
    build:
      context: .
      target: frankenphp_prod
    env_file:
      - .env
    volumes:
      - ./config/jwt:/app/config/jwt
    ports:
      # HTTP
      - target: 80
        published: 8081
        protocol: tcp

When I use directly ip:8081 app works, same if I change my nginx to work on 80 without SSL https://mydomain.com app works.
When I use Nginx with SSL when I'm trying to open app with URL https://mydomain.com have the error: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

[7-zete-7]

Hi @prugala!

This error can be caused by various reasons: old version of Nginx, incompatibility with the installed version of OpenSSL, problems with Certbot, etc.
Nginx may also have other configuration files that override some parameters.

Try updating your server software to the latest versions and make sure that Nginx uses the configuration you expect (using the nginx -T command).

There is a lot of information on this issue on the Internet.
There are also several discussions on the Caddy forum about how when using Caddy (FrankenPHP) there is no obvious need for Nginx, if this might interest you.

[prugala]

@7-zete-7

nginx -v
nginx version: nginx/1.18.0

I can update to newest stable but all other services on my server works fine with nginx proxy. I Have problem only with FrankenPHP/Caddy.
Yes I know that I dont need nginx when I'm using Caddy but I run on my server multiple apps in docker so I want to publish all with on way.

[7-zete-7]

@prugala, what value are you setting for the SERVER_NAME environment variable?
Can you show content of your Caddyfile?

[prugala]

@7-zete-7
Didn't change Caddyfile:

{
	{$CADDY_GLOBAL_OPTIONS}

	frankenphp {
		{$FRANKENPHP_CONFIG}
	}
}

{$CADDY_EXTRA_CONFIG}

{$SERVER_NAME:localhost} {
	log {
		# Redact the authorization query parameter that can be set by Mercure
		format filter {
			request>uri query {
				replace authorization REDACTED
			}
		}
	}

	root * /app/public
	encode zstd br gzip

	mercure {
		# Transport to use (default to Bolt)
		transport_url {$MERCURE_TRANSPORT_URL:bolt:///data/mercure.db}
		# Publisher JWT key
		publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
		# Subscriber JWT key
		subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
		# Allow anonymous subscribers (double-check that it's what you want)
		anonymous
		# Enable the subscription API (double-check that it's what you want)
		subscriptions
		# Extra directives
		{$MERCURE_EXTRA_DIRECTIVES}
	}

	vulcain

	{$CADDY_SERVER_EXTRA_DIRECTIVES}

	# Disable Topics tracking if not enabled explicitly: https://github.com/jkarlin/topics
	header ?Permissions-Policy "browsing-topics=()"

	php_server
}

Im building Docker image with my code with command:
SERVER_NAME=:80 docker build . --target frankenphp_prod --tag ghcr.io/my-repo/api:latest
tried also:
SERVER_NAME=:80 CADDY_GLOBAL_OPTIONS="auto_https off" docker build . --target frankenphp_prod --tag ghcr.io/my-repo/api:latest

Running app with docker compose:
docker compose -f compose.yaml -f compose.prod.yaml up -d --wait --build

php service use .env file with:

SERVER_NAME=:80
ADDY_GLOBAL_OPTIONS="auto_https off"

[prugala]

OK I found problem (don't know yet why :) ).
When I've changed my domain on subdomain.domain.com all works, but api.subdomain.domain.com doesn't work. Im using Letsencrypt but don't see restrictions on level od subdomains.

I will close discussion soon, because problem is not related with project.

[dunglas]

Thanks for the feedback. I hope it may help other people having the same issue.