Update nginx.conf

configs/nginx/nginx.conf

@@ -1,61 +1,49 @@
+# =====================================================================
+# OpenELIS internal reverse proxy — HTTP-only build for Dokploy
+#
+# Dokploy's Traefik terminates public TLS (Let's Encrypt) and forwards
+# plain HTTP to this container on port 80. This proxy then stitches the
+# app together:  /  -> React frontend   |   /api/ -> Tomcat backend (8443).
+# The nginx->backend hop stays HTTPS internally with the self-signed
+# certs from the certgen service (nginx does not verify upstream certs).
+# =====================================================================
+
 worker_processes 1;
 
 events { worker_connections 1024; }
+
 http {
-    server {
-        listen 80;
-        server_name _;
-        ##### Comment to run on HTTP
-         return 301 https://$host$request_uri;
-
-        ##### Uncomment to run on HTTP
-        # location / {
-        #     proxy_pass http://frontend.openelis.org;
-        #     proxy_redirect off;
-
-        #     proxy_set_header Host $host;
-        #     proxy_set_header X-Real-IP $remote_addr;
-        #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        #     proxy_set_header X-Forwarded-Proto $scheme;
-        # }
-        # location /api/ {
-        #     proxy_pass https://oe.openelis.org:8443/api/;
-        #     proxy_redirect off;
-
-        #     proxy_set_header Host $host;
-        #     proxy_set_header X-Real-IP $remote_addr;
-        #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        #     proxy_set_header X-Forwarded-Host $server_name;
-        #     proxy_set_header X-Forwarded-Proto $scheme;
-        # }
+    # TLS is terminated at Traefik. Trust its X-Forwarded-Proto so the
+    # app generates correct https URLs; default to https if the header
+    # is missing (it will always be present in normal operation).
+    map $http_x_forwarded_proto $fwd_proto {
+        default $http_x_forwarded_proto;
+        ""      https;
     }
 
     server {
-        listen [::]:443 ssl;
-        listen 443 ssl default;
-        server_name __;
-
-        ssl_certificate /etc/nginx/certs/${OE_NGINX_CERT};
-        ssl_certificate_key /etc/nginx/keys/${OE_NGINX_KEY};
+        listen 80;
+        server_name _;
 
-        proxy_set_header X-Forwarded-For $proxy_protocol_addr; # To forward the original client's IP address
-        proxy_set_header X-Forwarded-Proto $scheme; # to forward the  original protocol (HTTP or HTTPS)
-        proxy_set_header Host $host; # to forward the original host requested by the client
+        absolute_redirect off;
 
-       absolute_redirect off;
+        proxy_set_header X-Forwarded-Proto  $fwd_proto;
+        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
+        proxy_set_header Host               $host;
 
         location / {
-            proxy_pass http://frontend.openelis.org;
-            proxy_redirect     off;
+            proxy_pass       http://frontend.openelis.org;
+            proxy_redirect   off;
         }
 
         location /api/ {
             proxy_pass         https://oe.openelis.org:8443/api/;
             proxy_redirect     off;
-            proxy_set_header   Host $host;
-            proxy_set_header   X-Real-IP $remote_addr;
-            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header   X-Forwarded-Host $server_name;
+            proxy_set_header   Host               $host;
+            proxy_set_header   X-Real-IP          $remote_addr;
+            proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Host   $host;
+            proxy_set_header   X-Forwarded-Proto  $fwd_proto;
         }
     }
 }