4

I am trying to reverse proxy into a cPanel account by attempting to use the following Nginx configuration (123.123.123.123 is the cPanel IP), but I'm getting an error: ERR_TOO_MANY_REDIRECTS

server {
server_name example.com

        access_log /var/log/nginx/reverse-access.log;
        error_log /var/log/nginx/reverse-error.log;

        location / {
                    proxy_pass http://123.123.123.123;

  }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}
server {
    if ($host = example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;
server_name example.com

        access_log /var/log/nginx/reverse-access.log;
    return 404; # managed by Certbot


}

The following is returned by curl:

curl --head https://example.com/

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 04 Oct 2021 20:59:17 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-redirect-by: WordPress
location: https://example.com/
x-litespeed-cache: hit

curl --head http://example.com --resolve example.com:80:123.123.123.123

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 04 Oct 2021 20:59:33 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://example.com/

The only thing I can find on the topic is: cPanel powered site is not accessible via IP address by my reverse proxy (it gives a 404 error) Could it be the same issue of a header being required?

Loading http://123.123.123.123 does open the site by the way.

Update:

By adding the following to: /etc/hosts

123.123.123.123 example.com www.example.com

and then changing proxy_pass to:

proxy_pass https://example.com:443;

I now see the following not found error that cPanel returns:

enter image description here

6
  • 1
    Perhaps try setting proxy_pass to use port 443 (proxy_pass https://123.123.123.123:443), since I assume you want to proxy an HTTPS site on your cPanel server. Proxying port 80 might lead to redirect errors if that's being redirected in the cPanel server (by WordPress for example), which appears is the case based on your curl output since you're being 301 redirected to the HTTPS protocol.
    – dan
    Oct 5 at 1:19
  • 1
    Are you using this ngnix reverse proxy to add the SSL certificate? If so, why not just configure letsencrypt using cPanel and skip the reverse proxy? Oct 5 at 1:49
  • I made some progress it seems by modifying /etc/hosts with 123.123.123.123 example.com and then changing the proxy_pass address to proxy_pass https://example.com:443 but now I get the page not found error cPanel gives out i.gyazo.com/a2bfecb59b559a51c6670607858fa959.png
    – Toodarday
    Oct 5 at 7:39
  • It seems that using port 443 for proxy_pass solved the original problem regarding "ERR_TOO_MANY_REDIRECTS". I'm not sure why you modified the hosts file though and didn't just use the IP as in my comment, and then pass the host using proxy_set_header. That would allow Apache in cPanel to direct incoming requests to the correct virtual host.
    – dan
    Oct 5 at 9:41
  • Since cPanel manages virtual hosts for you, you'll need to make sure a domain or add-on domain is setup for that host.
    – dan
    Oct 5 at 9:41
1

Your origin server isn't properly configured. It is returning a redirect to HTTPS and isn't actually configured to server the site over HTTPS. You need to either:

  • Configure your origin server to serve the site over HTTP rather than redirecting to HTTPS.
  • Configure your origin server to server the site over HTTPS rather than showing the default cPanel page.

The problem is not with your reverse proxy server. The problem is that there doesn't appear to be a way to get the content from your origin server.

You might want to take a step back and evaluate whether or not you actually need to use a reverse proxy server at all. It appears to be adding HTTPS certificates and forwarding requests to an IP address. If that IP address is public and that machine can be configured with LetsEncrypt, I would suggest skipping the reverse proxy altogether. Reverse proxies always reduce performance by a little bit and should be avoided if possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.