Nginx reverse proxy into external cPanel server results in an error

Question

I am trying to reverse proxy into a cPanel account by attempting to use the following Nginx configuration (123.123.123.123 is the cPanel IP), but I'm getting an error: ERR_TOO_MANY_REDIRECTS

server {
server_name example.com

        access_log /var/log/nginx/reverse-access.log;
        error_log /var/log/nginx/reverse-error.log;

        location / {
                    proxy_pass http://123.123.123.123;

  }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}
server {
    if ($host = example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;
server_name example.com

        access_log /var/log/nginx/reverse-access.log;
    return 404; # managed by Certbot


}

The following is returned by curl:

curl --head https://example.com/

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 04 Oct 2021 20:59:17 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-redirect-by: WordPress
location: https://example.com/
x-litespeed-cache: hit

curl --head http://example.com --resolve example.com:80:123.123.123.123

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 04 Oct 2021 20:59:33 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://example.com/

The only thing I can find on the topic is: cPanel powered site is not accessible via IP address by my reverse proxy (it gives a 404 error) Could it be the same issue of a header being required?

Loading http://123.123.123.123 does open the site by the way.

Update:

By adding the following to: /etc/hosts

123.123.123.123 example.com www.example.com

and then changing proxy_pass to:

proxy_pass https://example.com:443;

I now see the following not found error that cPanel returns:

Answer 1

Your origin server isn't properly configured. It is returning a redirect to HTTPS and isn't actually configured to server the site over HTTPS. You need to either:

• Configure your origin server to serve the site over HTTP rather than redirecting to HTTPS.
• Configure your origin server to server the site over HTTPS rather than showing the default cPanel page.

The problem is not with your reverse proxy server. The problem is that there doesn't appear to be a way to get the content from your origin server.

You might want to take a step back and evaluate whether or not you actually need to use a reverse proxy server at all. It appears to be adding HTTPS certificates and forwarding requests to an IP address. If that IP address is public and that machine can be configured with LetsEncrypt, I would suggest skipping the reverse proxy altogether. Reverse proxies always reduce performance by a little bit and should be avoided if possible.