<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">It’s setup this way, because haproxy can’t really do vhosts and sometimes you need to limit access per vhost.</div><div class=""><br class=""></div><div class="">OTOH, haproxy can do restrictions on a per-url basis much better (IMO) than Nginx.</div><div class=""><br class=""></div><div class="">There are up to several hundred vhosts there and sometimes you want to limit stuff on any one of them.</div><div class=""><br class=""></div><div class="">Plus, as I said, haproxy’s handling of certificates is sometimes very convenient.</div><div class=""><br class=""></div><div class="">I run let’s encrypt on almost all of these vhosts and due to the way they are provisioned, it’s much easier than dealing with the individual Nginx configuration files.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I will try and activate SSL without the Really Simple SSL plugin, maybe it is doing something weird - though with all the SSL offloading going on these days, you’d think this isn’t a too unusual case…</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 09.02.2021 um 05:08 schrieb Ali Mohsin <<a href="mailto:aliofthemohsins@gmail.com" class="">aliofthemohsins@gmail.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Hi, normally when I get infinite loop with ssl, its usually because of redirection of http to https. Sometimes front proxy (cloudflare or haproxy) is expecting simple http traffic and it gets https traffic and vice versa.<div dir="auto" class="">Also check your wordpress settings and its url. Try changing it.</div><div dir="auto" class="">And why are you using so much stuff just for wordpress? Simple nginx, php-fpm, fcgi cache works for me. And rate limiting works in nginx too. Try simplifying the setup so there are less variables to deal with.</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 8 Feb 2021, 10:16 PM Rainer Duffner, <<a href="mailto:rainer@ultra-secure.de" class="">rainer@ultra-secure.de</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br class="">
<br class="">
I have an interesting problem.<br class="">
<br class="">
I have apache behind Nginx behind haproxy.<br class="">
<br class="">
SSL is terminated with haproxy (because haproxy can load all certificates from a single directory, and because some rate-limiting stuff is easier with haproxy).<br class="">
This makes using Let’s Encrypt easier.<br class="">
<br class="">
Sometimes, I want to do Nginx + fastcgi + php-fpm directly, without apache (it’s measurably faster).<br class="">
<br class="">
For apache, you need this in the configuration:<br class="">
<br class="">
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;<br class="">
<br class="">
(and for good measure, also this:<br class="">
SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on<br class="">
)<br class="">
<br class="">
For fast-cgi, one also needs this in the configuration (fastcgi_params):<br class="">
<br class="">
fastcgi_param HTTPS $fwd_ssl;<br class="">
<br class="">
<br class="">
$fwd_ssl is generated by this map:<br class="">
<br class="">
map $http_x_forwarded_proto $fwd_ssl {<br class="">
http off;<br class="">
https on;<br class="">
}<br class="">
<br class="">
in the global http section.<br class="">
<br class="">
In wordpress, when I enable „Really Simple SSL“, I get a redirect loop (to https) on the front-page (as an unauthenticated user) but the backend works.<br class="">
<br class="">
I wonder what wordpress is missing so that it still thinks the connection is coming over http instead of https.<br class="">
<br class="">
<br class="">
<br class="">
Any ideas?<br class="">
<br class="">
Best Regards<br class="">
Rainer<br class="">
<br class="">
_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" target="_blank" rel="noreferrer" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>
_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class="">http://mailman.nginx.org/mailman/listinfo/nginx</div></blockquote></div><br class=""></body></html>