@@ -5,15 +5,29 @@ upstream app_server {
55server {
66 listen 80 default_server;
77 listen [::]:80 default_server;
8- server_name mailcom.rose.uni-heidelberg.de _;
8+ server_name _;
99 return 301 https://mailcom.rose.uni-heidelberg.de$request_uri ;
1010}
1111
12+ # Catch-all HTTPS: redirect any non-canonical host to domain (308 preserves POST)
1213server {
13- listen 443 ssl default_server ;
14- listen [::]:443 ssl default_server ;
14+ listen 443 ssl ;
15+ listen [::]:443 ssl ;
1516 http2 on;
16- server_name mailcom.rose.uni-heidelberg.de _;
17+ server_name _;
18+
19+ ssl_certificate /etc/nginx/ssl /mailcom.rose.uni-heidelberg.de.crt;
20+ ssl_certificate_key /etc/nginx/ssl /mailcom.rose.uni-heidelberg.de.key;
21+
22+ return 308 https://mailcom.rose.uni-heidelberg.de$request_uri ;
23+ }
24+
25+ # Canonical HTTPS vhost: proxy to app
26+ server {
27+ listen 443 ssl ;
28+ listen [::]:443 ssl ;
29+ http2 on;
30+ server_name mailcom.rose.uni-heidelberg.de;
1731
1832 ssl_certificate /etc/nginx/ssl /mailcom.rose.uni-heidelberg.de.crt;
1933 ssl_certificate_key /etc/nginx/ssl /mailcom.rose.uni-heidelberg.de.key;
@@ -22,15 +36,14 @@ server {
2236 ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' ;
2337 ssl_prefer_server_ciphers on;
2438
25- # If someone sends HTTP to 443, redirect to HTTPS
26- error_page 497 =301 https://$host$request_uri ;
27-
2839 location / {
2940 proxy_pass http ://app_server;
3041 proxy_set_header Host $host ;
42+ proxy_set_header X-Forwarded-Host $host ;
43+ proxy_set_header X-Forwarded-Proto $scheme ;
44+ proxy_set_header X-Forwarded-Port $server_port ;
3145 proxy_set_header X-Real-IP $remote_addr ;
3246 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ;
33- proxy_set_header X-Forwarded-Proto $scheme ;
3447 proxy_http_version 1.1;
3548 }
3649}
0 commit comments