Step 5 –  Configure NGINX 

Finally we can configure the NGINX. We need 3 things to specify:

where our certificates, keys and chain.pem are stored in ssl parameters.

Then we need to specify proxy parameters.

Then we need to specify each domain server blocks i.e. where they live in the network.

in case you wish to restrict access to a server externally i.e. only accessible from LAN/inside your home then create rules for that in internal_rules.conf.

NGINX installation comes with the snippets folder. So we will make use of this to store our config files. But we will have to create a folder which will hold server block information per service.

mkdir /usr/local/etc/nginx/vdomains

Create Certificates/Keys Configuration:

cd /usr/local/etc/nginx/snippets
vi example.com.cert.conf

and paste the following:

# certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
ssl_certificate /usr/local/etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/example.com/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /usr/local/etc/letsencrypt/live/example.com/chain.pem;

replace example.com with your own domain and save and close.

Create SSL Configuration for SSL parameters:

vi ssl_common.conf

ssl_prefer_server_ciphers on;
ssl_session_timeout 1d;
# Disable SSLv2 and SSLv3 (BEAST and POODLE attacks)
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
# Enable our strong DH Key
ssl_dhparam /etc/ssl/dh4096.pem;
# Cipher-list for PFS.
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-A
ES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES12
8-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_ecdh_curve secp384r1;
# Requires nginx >= 1.1.0
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
# Requires nginx >= 1.5.9
ssl_stapling on;
# Requires nginx >= 1.3.7
ssl_stapling_verify on;
# Requires nginx => 1.3.7
resolver 192.168.0.100 valid=300s;
resolver_timeout 5s;
# HSTS Support
add_header Strict-Transport-Security "max-age=63072000;includeSubdomains; preload";

Change IP address of your own resolver. I use pihole so I added that. You could add your router’s IP address here.

Create Proxy Configuration:

vi proxy_params.conf

and paste:

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_hide_header 'x-frame-options';
proxy_hide_header 'X-Content-Type-Options';
proxy_hide_header 'X-Download-Options';
proxy_http_version 1.1;

Default NGINX.conf

We now need to change the default nginx.conf. Make sure you copy it first to take a backup.

cp /usr/local/etc/nginx/nginx.conf /usr/local/etc/nginx/nginx.conf.bak
vi nginx.conf

and paste:

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;

    # Redirect all HTTP traffic to HTTPS
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        return 301 https://$host$request_uri;
    }

    # Import server blocks for all subdomains
    include "vdomains/*.conf";
}

Now we just need to create server blocks and we’re done within the vdomains directory.

Server Block Config

I am assuming you want to access nextcloud outside your home network. So I will be creating its server block first. I am also assuming that you created CNAME of cloud.example.com and pointed to DUCK DNS in Step 0.

cd vdomains

vi cloud.example.com

and paste:

server {
        listen 443 ssl http2;
        server_name cloud.example.com;
        access_log /var/log/nginx/cloud.access.log;
        error_log /var/log/nginx/cloud.error.log;
        include snippets/example.com.cert.conf;
        include snippets/ssl_common.conf;
        location / {
                include snippets/proxy_params.conf;
                proxy_pass https://192.168.0.2;
        }
}

Notice proxy_pass with https. This is because I was using self signed certs internally when I setup the NextCloud previously.

You will need to create separate config files for every service you want to access externally in the same folder.

save and exit. Reload the NGINX by

system nginx reload

And try going to cloud.example.com and it should load up the nextcloud login page.

However you will need to fix some more config for nextcloud to work properly.

Fixing the Nextcloud for Reverse Proxy:

First, you will now need to add your domain to trusted domains.

Trusted domains are used by Nextcloud to prevent Host Header Poisoning. You need to specify every domain at which your Nextcloud can be accessed.

This means if you have Nextcloud installed at “192.168.0.2” and also want it to be accessible at “cloud.example.com 467” you’d need to modify the trusted_domains entry in your config/config.php. The initial config would look like the following:

  'trusted_domains' =>
  array (
    0 => '192.168.0.2',
  ),

To add a new domain just add new entries by appending a new item to the PHP array:

  'trusted_domains' =>
  array (
    0 => '192.168.0.2',
    1 => 'cloud.example.com',
  ),

If you use an environment where your IP address can change multiple times it is recommended to configure your DNS server in a way to resolve to the IP instead of accessing the IP address manually.

The second thing you need to add here is reverse proxy configuration. just paste the following after the ‘trusted_domains’

 'trusted_proxies' =>
  array (
    0 => '192.168.0.5',
    1 => '127.0.0.1',
  ),
  'forwarded-for-headers' =>
  array (
    0 => 'HTTP_X_FORWARDED_FOR',
  ),

Save and close. Restart nginx in NextCloud jail to make sure your changes are registered.