# Reverse proxy - nginx not working

**URL:** <https://help.nextcloud.com/t/reverse-proxy-nginx-not-working/143252>\
**Category:** ℹ️ Support\
**Tags:** reverseproxy, nginx\
**Created:** [August 5, 2022, 4:14pm UTC](https://help.nextcloud.com/t/reverse-proxy-nginx-not-working/143252 "2022-08-05T16:14:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wortor](https://help.nextcloud.com/letter_avatar/wortor/32/5_5575768a8748004e209b776fc1b2916d.png) [@wortor](https://help.nextcloud.com/u/wortor)\
**Post date:** [August 5, 2022, 4:14pm UTC](https://help.nextcloud.com/t/reverse-proxy-nginx-not-working/143252/1 "2022-08-05T16:14:45Z")

</div>

hi,  
i have separate VM with nginx acting as reverse proxy 10.0.1.204 all other reverse proxies works fine … but … nextcloud doesnt work at all… and i am desperate already.

nextcloud has ip 10.0.1.163

[https://cloxxx.duckdns.org](https://cloxxx.duckdns.org) from internal network:

 ![image](https://help.nextcloud.com/uploads/default/original/3X/8/0/803426b9f52aeb566e5fb3b0168e2fb5f71591c5.png)

when i execute this from outside of the local network  
[xp@localhost ~]$ curl -kv [https://cloxx.duckdns.org/](https://cloxx.duckdns.org/)

- Trying xx217.96:443…
- Connected to [cloxx.duckdns.org](http://cloxx.duckdns.org) (xxx217.96) port 443 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- successfully set certificate verify locations:
- CAfile: /etc/ssl/certs/ca-certificates.crt
- CApath: /etc/ssl/certs
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
- TLSv1.3 (IN), TLS handshake, Certificate (11):
- TLSv1.3 (IN), TLS handshake, CERT verify (15):
- TLSv1.3 (IN), TLS handshake, Finished (20):
- TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
- TLSv1.3 (OUT), TLS handshake, Finished (20):
- SSL connection using TLSv1.3 / TLS\_AES\_256\_GCM\_SHA384
- ALPN, server accepted to use http/1.1
- Server certificate:
- subject: [CN=cloxx.duckdns.org](http://CN=cloxx.duckdns.org)
- start date: Aug 4 23:47:37 2022 GMT
- expire date: Nov 2 23:47:36 2022 GMT
- issuer: C=US; O=Let’s Encrypt; CN=R3
- SSL certificate verify ok.

> GET / HTTP/1.1  
> Host: [cloxx.duckdns.org](http://cloxx.duckdns.org)  
> User-Agent: curl/7.74.0  
> Accept: _/_

- TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
- TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
- old SSL session ID is stale, removing
- Mark bundle as not supporting multiuse  
\< HTTP/1.1 308 Permanent Redirect  
\< Server: nginx/1.18.0 (Ubuntu)  
\< Date: Fri, 05 Aug 2022 16:08:37 GMT  
\< Content-Length: 0  
\< Connection: keep-alive  
\< Location: [https://cloxxx.duckdns.org/](https://cloxxx.duckdns.org/)  
\< Strict-Transport-Security: max-age=15768000;includeSubDomains  
\<
- Connection #0 to host [cloxxx.duckdns.org](http://cloxxx.duckdns.org) left intact

config.php  
 ![image](https://help.nextcloud.com/uploads/default/original/3X/0/1/0163229dcee21108e42db20b887d3f62cca9feeb.png)  
 ![image](https://help.nextcloud.com/uploads/default/original/3X/e/3/e31e52e85a63fded2b4b3507dcb44b72f5362dda.png)  
 ![image](https://help.nextcloud.com/uploads/default/original/3X/8/c/8cc512b80b8f30b2b59b44baf3aef46c93cc1396.png)

on the nextcloud vm when i execute  
root@nextcloud:/usr/local/www/nextcloud/config # host 10.0.1.204  
204.1.0.10.in-addr.arpa domain name pointer reverz-proxy.lan.

when i try to open nextcloud page [https://cloxx](https://cloxx)…/ thats what i got in rever proxy log

```auto
10.0.1.138 - - [05/Aug/2022:16:14:04 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"
10.0.1.138 - - [05/Aug/2022:16:14:05 +0000] "GET / HTTP/1.1" 308 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0"

```

nginx reverz proxy

```auto
server {

       # root /var/www/cloxxx.duckdns.org/html;
       #index index.html index.htm index.nginx-debian.html;

        server_name cloxxx.duckdns.org;

       # location / {
       # try_files $uri $uri/ =404;
       # }
    add_header Strict-Transport-Security "max-age=15768000;includeSubDomains";

    access_log /var/log/nginx/cloxxx.duckdns.org.access.log;
    error_log /var/log/nginx/cloxxx.duckdns.org.error.log;

   # listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/cloxxx.duckdns.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/cloxxx.duckdns.org/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
       proxy_pass http://10.0.1.163/;
       proxy_buffering off;
       proxy_request_buffering off;

# proxy_set_header X-Real-IP $remote_addr;

# Enable HSTS (HTTP Strict Transport Security)
    # add_header Strict-Transport-Security "max-age=15768000;includeSubDomains";

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
       # add_header Front-End-Https on;

        proxy_headers_hash_max_size 512;
        proxy_headers_hash_bucket_size 64;

        #proxy_redirect off;
        proxy_max_temp_file_size 0;
    }

}

```

nextcloud was installed with that script

> **[GitHub - danb35/freenas-iocage-nextcloud: Script to create an iocage jail on FreeNAS for the...](https://github.com/danb35/freenas-iocage-nextcloud)**
>
> Script to create an iocage jail on FreeNAS for the latest Nextcloud 28 release, including Caddy, MariaDB or PostgreSQL, and Let's Encrypt

and this directive was enabled as described

### HTTP Strict Transport Security

When you log into your Nextcloud instance as administrator, you may see a configuration warning that HSTS is not enabled. This is intentional. HSTS is a useful security measure, but it can also lock you out of your site if certificate renewal isn’t working properly. I recommend you let the system obtain its initial trusted cert, and then renewing at least once, before enabling HSTS, to ensure that automatic renewal works as intended. Ordinarily this will take about 60 days. To enable HSTS, follow these steps:

- `iocage console nextcloud`
- `nano /usr/local/www/Caddyfile`
- Uncomment (remove the `#`) from the line that begins with `Strict-Transport-Security`
- Save the edited file and exit `nano`.
- `service caddy reload`

when i changed  
proxy\_pass [http://10.0.1.163](http://10.0.1.163)  
to  
proxy\_pass [http://10.0.1.163:443](http://10.0.1.163:443)

i got response in browser:  
Client sent an HTTP request to an HTTPS server.

any idea here?  
thanks!

---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [December 13, 2024, 2:33pm UTC](https://help.nextcloud.com/t/reverse-proxy-nginx-not-working/143252/2 "2024-12-13T14:33:43Z")

</div>