ubuntuusers.de

Hallo Community. Ich benötige euer Wissen mit einem Problem das ich mit Nginx habe. Kurz zur mir. Ich arbeite seid ca.15 Jahren mit Linux. Mal etwas mehr und mal etwas weniger, so wie es die Zeit zulässt. In letzter Zeit habe ich mich mehr mit Ubuntu befasst.

Ich habe für unseren Verein eine Nextcloud Instanz auf einem VPS aufgesetzt. Dazu bin ich nach dieser Anleitung vorgegangen. https://decatec.de/home-server/nextcloud-auf-ubuntu-server-18-04-lts-mit-nginx-mariadb-php-lets-encrypt-redis-und-fail2ban/#Hinweis_bei_abweichender_Verzeichnisstruktur_bei_nginx An und für sich verstehe ich ja das Grundprinzip des Nginx Reverse Proxy. Nun komme ich aber an den Punkt diesen Reverse Proxy zu erweitern. Ich möchte gerne die Applikation Rocket Chat mit über den Nginx Reverse Proxy laufen lassen. Hier komme ich aber an den Punkt wo ich nicht recht weiß wie ich die Konfiguration für den Rocket Chat erweitre. Ziel soll es sein das der Rocket chat über https://chat.beispiel.com erreichbar ist. Aber wenn der Pfad https://beispiel.com/chat ist wäre das auch egal.

Es wäre schön wenn mir jemand erläutern bzw. erklären kann wie ich die Rocket Chat konfiguration in das bestehende Nginx Konstrukt integriere.

Folgende Nginx Config habe ich derzeit laufen.

Meine nextcloud config (gateway Funktion)

upstream php-handler {
    server unix:/run/php/php7.2-fpm.sock;
}

server {
	listen 80 default_server;
	listen [::]:80 default_server;
	server_name beispiel.com 1.1.1.1;
 
	root /var/www;
	
	location ^~ /.well-known/acme-challenge {
		proxy_pass http://127.0.0.1:81;
		proxy_redirect off;
	}

	location / {
		# Enforce HTTPS
		# Use this if you always want to redirect to the DynDNS address (no local access).
		return 301 https://$server_name$request_uri;
		
		# Use this if you also want to access the server by local IP:
		#return 301 https://$server_addr$request_uri;
	}
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;					   
	server_name beispiel.com 1.1.1.1;
  
	# Certificates used
	ssl_certificate /etc/letsencrypt/beispiel.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/beispiel.com/key.pem;
  
	# Not using TLSv1 will break:
	#	Android <= 4.4.40
	#	IE <= 10
	#	IE mobile <=10
	# Removing TLSv1.1 breaks nothing else!
	# TLSv1.3 is not supported by most clients, but it should be enabled.
	ssl_protocols TLSv1.2 TLSv1.3;
	
	# Cipher suite from https://cipherli.st/
	# Max. security, but lower compatibility 
	ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384';
 
	# Cipher suite from https://wiki.mozilla.org/Security/Server_Side_TLS
	#ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 
	# (Modern) cipher suite from https://mozilla.github.io/server-side-tls/ssl-config-generator/
	#ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 
	# Diffie-Hellman parameter for DHE ciphersuites, recommended 4096 bits
	ssl_dhparam /etc/nginx/dhparams/dhparams.pem;
  
	# Use multiple curves.
	# secp521r1: Not supported by Chrome
	# secp384r1: Not supported by Android (DAVdroid)
	ssl_ecdh_curve secp521r1:secp384r1:prime256v1;
 
	# Server should determine the ciphers, not the client
	ssl_prefer_server_ciphers on;
  
	# OCSP Stapling
	# fetch OCSP records from URL in ssl_certificate and cache them
	ssl_stapling on;
	ssl_stapling_verify on;
	
	# This should be chain.pem
	# See here: https://certbot.eff.org/docs/using.html
	ssl_trusted_certificate /etc/letsencrypt/beispiel.com/ca.pem;
	
	resolver 192.168.178.1;
  
	# SSL session handling
	ssl_session_timeout 24h;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;


	#
	# Collabora
	#
	# static files
    location ^~ /loleaflet {
        proxy_pass https://localhost:9980;
        proxy_set_header Host $http_host;
    }
 
    # WOPI discovery URL
    location ^~ /hosting/discovery {
        proxy_pass https://localhost:9980;
        proxy_set_header Host $http_host;
    }
 
   # main websocket
   location ~ ^/lool/(.*)/ws$ {
       proxy_pass https://localhost:9980;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "Upgrade";
       proxy_set_header Host $http_host;
       proxy_read_timeout 36000s;
   }
   
   # download, presentation and image upload
   location ~ ^/lool {
       proxy_pass https://localhost:9980;
       proxy_set_header Host $http_host;
   }
   
   # Admin Console websocket
   location ^~ /lool/adminws {
       proxy_pass https://localhost:9980;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "Upgrade";
       proxy_set_header Host $http_host;
       proxy_read_timeout 36000s;
   }


	#
	# Add headers to serve security related headers
	#  
	# HSTS (ngx_http_headers_module is required)
	# In order to be recoginzed by SSL test, there must be an index.hmtl in the server's root
	add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload;" always;
	add_header X-Content-Type-Options "nosniff" always;
	# Usually this should be "DENY", but when hosting sites using frames, it has to be "SAMEORIGIN"
	add_header Referrer-Policy "no-referrer" always;
	#add_header X-Frame-Options "SAMEORIGIN" always;
	add_header X-XSS-Protection "1; mode=block" always;
	add_header X-Robots-Tag none always;
	add_header X-Download-Options noopen always;
	add_header X-Permitted-Cross-Domain-Policies none always;
	add_header Referrer-Policy no-referrer always;

        # Remove X-Powered-By, which is an information leak
        fastcgi_hide_header X-Powered-By;	
	location = / {
        # Disable access to the web root, otherwise nginx will show the default site here.
		deny all;
        }	
 
	#
	# Nextcloud
	#
	location ^~ /nextcloud/ {
		# Set max. size of a request (important for uploads to Nextcloud)
		client_max_body_size 10G;
		# Besides the timeout values have to be raised in nginx' Nextcloud config, these values have to be raised for the proxy as well
		proxy_connect_timeout 3600;
		proxy_send_timeout 3600;
		proxy_read_timeout 3600;
		send_timeout 3600;
		proxy_buffering off;
		proxy_request_buffering off;
		proxy_max_temp_file_size 10240m;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_pass http://127.0.0.1:82;
		proxy_redirect off;
	}

	#These two location blocks are needed, otherwise you'll get warnings in the Nextcloud admin UI later on
	location = /.well-known/carddav {
		return 301 $scheme://$host/nextcloud/remote.php/dav;
	}
 
	location = /.well-known/caldav {
		return 301 $scheme://$host/nextcloud/remote.php/dav;
	}
	# Well-known URL for Webfinger
	# Regardless of this rule, you'll get a warning in the admin UI when the social app is not installed
	location = /.well-known/webfinger {
		return 301 $scheme://$host/nextcloud/public.php?service=webfinger;
	}

	location ~ /(ocm-provider|ocs-provider)/ {
		return 301 $scheme://$host/nextcloud/$1/;
	}
}

Nexcloud Konfiguration an sich selber

server {
    listen 127.0.0.1:82;
    server_name 127.0.0.1;
 
    # Path to the root of your installation
    root /var/www/;
 
    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }
 
    location ^~ /nextcloud {
        # set max upload size
        client_max_body_size 10G;
        fastcgi_buffers 64 4K;
 
        # Enable gzip but do not remove ETag headers
        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
 
        # Uncomment if your server is build with the ngx_pagespeed module
        # This module is currently not supported.
        #pagespeed off;
 
        location /nextcloud {
            rewrite ^ /nextcloud/index.php$request_uri;
        }
 
        location ~ ^\/nextcloud\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
            deny all;
        }
        location ~ ^\/nextcloud\/(?:\.|autotest|occ|issue|indie|db_|console) {
            deny all;
        }
 
        location ~ ^\/nextcloud\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|ocm-provider\/.+)\.php(?:$|\/) {
            fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
		include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
		
		# Important: disable HTTPS, otherwise no log in will be possible!
            #fastcgi_param HTTPS on;
 
            fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
            fastcgi_param front_controller_active true;
            fastcgi_pass php-handler;
            fastcgi_intercept_errors on;
 
            # Raise timeout values.
            # This is especially important when the Nextcloud setup runs into timeouts (504 gateway errors)
		fastcgi_read_timeout 600;
		fastcgi_send_timeout 600;
		fastcgi_connect_timeout 600;
            fastcgi_request_buffering off;
	    
            # Pass PHP variables directly to PHP.
            # This is usually done in the php.ini. For more flexibility, these variables are configured in the nginx config.
		# All the PHP parameters have to be set in one fastcgi_param. When using more 'fastcgi_param PHP_VALUE' directives, the last one will override all the others.
		fastcgi_param PHP_VALUE "open_basedir=/var/www:/tmp/:/var/nextcloud_data:/dev/urandom:/proc/meminfo
		upload_max_filesize = 10G
		post_max_size = 10G
		max_execution_time = 3600
		max_input_time = 3600
		output_buffering = off";
            
            # Make sure that the real IP of the remote host is passed to PHP.
            fastcgi_param REMOTE_ADDR $http_x_real_ip;
        }
 
        location ~ ^\/nextcloud\/(?:updater|ocs-provider|ocm-provider)(?:$|\/) {
            try_files $uri/ =404;
            index index.php;
        }
 
        # Adding the cache control header for js and css files
		# Make sure it is BELOW the PHP block
		location ~ ^\/nextcloud\/.+[^\/]\.(?:css|js|woff2?|svg|gif)$ {
		try_files $uri /nextcloud/index.php$request_uri;
		proxy_set_header Cache-Control "public, max-age=15778463";
		# Add headers to serve security related headers
		# Use 'proxy_set_header' (not 'add_header') as the headers have to be passed through a proxy.
		proxy_set_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload;";
		proxy_set_header X-Content-Type-Options nosniff;
		proxy_set_header X-XSS-Protection "1; mode=block";
		proxy_set_header X-Robots-Tag none;
		proxy_set_header X-Download-Options noopen;
		proxy_set_header X-Permitted-Cross-Domain-Policies none;
		proxy_set_header Referrer-Policy no-referrer;
		
		# Optional: Don't log access to assets
		access_log off;
		}
 
		location ~ ^\/nextcloud\/.+[^\/]\.(?:png|html|ttf|ico|jpg|jpeg)$ {
		try_files $uri /nextcloud/index.php$request_uri;
		# Optional: Don't log access to other assets
		access_log off;
		}
    }
}

Lets Encrypt Konfiguration

server {
	listen 127.0.0.1:81;
	server_name 127.0.0.1;	
	
	location ^~ /.well-known/acme-challenge {
		default_type text/plain;
		root /var/www/letsencrypt;
	}
}

Hier nun die Rocket Chat Konfiguration die ich gerne dort einfügen möchte. https://rocket.chat/docs/installation/manual-installation/configuring-ssl-reverse-proxy/

# Upstreams
upstream backend {
    server 127.0.0.1:3000;
}

# HTTPS Server
server {
    listen 443;
    server_name your_hostname.com;

    # You can increase the limit if your need to.
    client_max_body_size 200M;

    error_log /var/log/nginx/rocketchat.access.log;

    ssl on;
    ssl_certificate /etc/nginx/certificate.crt;
    ssl_certificate_key /etc/nginx/certificate.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # don’t use SSLv3 ref: POODLE

    location / {
        proxy_pass http://backend/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forward-Proto http;
        proxy_set_header X-Nginx-Proxy true;

        proxy_redirect off;
    }
}

Vielen dank euch schon mal im voraus.

chortyenz schrieb:

An und für sich verstehe ich ja das Grundprinzip des Nginx Reverse Proxy. Nun komme ich aber an den Punkt diesen Reverse Proxy zu erweitern.

Du solltest dennoch mal deine Nginx-Konfiguration überarbeiten. Einen Reverse-Proxy brauchst du für Nextcloud nämlich nicht, weil der Nginx ja selbst die Auslieferung übernimmt. Von daher kannst du einfach den Default-Vhost so konfigurieren, dass er Nextcloud ausliefert.

Ich möchte gerne die Applikation Rocket Chat mit über den Nginx Reverse Proxy laufen lassen. Hier komme ich aber an den Punkt wo ich nicht recht weiß wie ich die Konfiguration für den Rocket Chat erweitre.

Für Rocket.Chat brauchst du die Reverse-Proxy-Funktionalität. Je nachdem, wie du es abbilden willst, kannst du die Konfiguration entweder in eine location auslagern, oder du machst noch einen VHost mit eigenem Namen (chat.beispiel.com).