Wiki source code of Configure HTTPS for the NginX HTTP Proxy Server
Last modified by Eleni Cojocariu-testing account on 2026/08/18 15:04
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | Once NginX forwards requests to XWiki on port ##80##, a second ##server## block on port ##443## serves the same wiki over ##HTTPS## and the port ##80## one redirects to it. This procedure continues [[Configure NginX Server as a Proxy on a Linux OS>>doc:documentation.xs.admin.installation.http-reverse-proxy.nginx-key-configurations.configure-nginx-server-linux.WebHome]], and the directives it adds are described in [[NginX Server Key Configurations>>doc:documentation.xs.admin.installation.http-reverse-proxy.nginx-key-configurations.WebHome]]. | ||
| 2 | |||
| 3 | 1. Obtain a TLS certificate and its private key for the wiki's domain. | ||
| 4 | 1. Add the ##HTTPS## block to ##/etc/nginx/sites-available/xwiki##, carrying every proxy directive of the port ##80## block:((( | ||
| 5 | {{code language="nginx"}} | ||
| 6 | server { | ||
| 7 | listen 443 ssl; | ||
| 8 | server_name wiki.example.com; | ||
| 9 | |||
| 10 | ssl_certificate /etc/ssl/certs/wiki.example.com.crt; | ||
| 11 | ssl_certificate_key /etc/ssl/private/wiki.example.com.key; | ||
| 12 | |||
| 13 | access_log /var/log/nginx/xwiki-access.log; | ||
| 14 | error_log /var/log/nginx/xwiki-error.log; | ||
| 15 | |||
| 16 | client_max_body_size 0; | ||
| 17 | |||
| 18 | location = / { | ||
| 19 | return 301 /xwiki/; | ||
| 20 | } | ||
| 21 | |||
| 22 | location /xwiki { | ||
| 23 | proxy_pass http://localhost:8080; | ||
| 24 | |||
| 25 | proxy_set_header Host $http_host; | ||
| 26 | proxy_set_header X-Real-IP $remote_addr; | ||
| 27 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| 28 | proxy_set_header X-Forwarded-Proto $scheme; | ||
| 29 | proxy_set_header X-Forwarded-Host $http_host; | ||
| 30 | proxy_set_header Forwarded ""; | ||
| 31 | |||
| 32 | proxy_http_version 1.1; | ||
| 33 | proxy_set_header Upgrade $http_upgrade; | ||
| 34 | proxy_set_header Connection $connection_upgrade; | ||
| 35 | |||
| 36 | proxy_redirect off; | ||
| 37 | } | ||
| 38 | } | ||
| 39 | {{/code}} | ||
| 40 | ))) | ||
| 41 | 1. Replace the body of the port ##80## block in the same file with a redirect to ##HTTPS##:((( | ||
| 42 | {{code language="nginx"}} | ||
| 43 | server { | ||
| 44 | listen 80; | ||
| 45 | server_name wiki.example.com; | ||
| 46 | |||
| 47 | location ^~ /.well-known/acme-challenge/ { | ||
| 48 | root /var/www/html; | ||
| 49 | } | ||
| 50 | |||
| 51 | location / { | ||
| 52 | return 301 https://$host$request_uri; | ||
| 53 | } | ||
| 54 | } | ||
| 55 | {{/code}} | ||
| 56 | ))) | ||
| 57 | 1. Set ##xwiki.home## in the [[##xwiki.cfg## configuration file>>doc:documentation.xs.admin.configuration.WebHome]] to the public base address, scheme and trailing slash included and without the ##/xwiki## path: {{code language="none"}}xwiki.home=https://wiki.example.com/{{/code}}. | ||
| 58 | 1. Recommended: make the Servlet Container trust the forwarded headers as well, following [[Configure Tomcat to Find Proxy Headers>>doc:documentation.xs.admin.installation.methods.install-xwiki-war.configure-servlet-container.configure-tomcat.find-proxy-headers.WebHome]]. | ||
| 59 | 1. Check the configuration and reload NginX: {{code language="none"}}sudo nginx -t{{/code}} then {{code language="none"}}sudo systemctl reload nginx{{/code}}. | ||
| 60 | 1. Open {{code language="none"}}https://wiki.example.com{{/code}} in a browser. The browser reports the connection as secure, the plain ##HTTP## address redirects to it, and the wiki's own links all use {{code language="none"}}https://{{/code}}. |
