Issue Onebox in HTTPS

Product Support Self-hosting

AI-generated summary

In a Discourse forum setup using Nginx as a front-end proxy with Let’s Encrypt SSL outside the Docker container, user dax reported that oneboxing fails for internal links over HTTPS, treating them as external. The issue was resolved by enabling force_https in Discourse’s admin settings dax, despite running Discourse via Unix socket with SSL handled externally. Falco cautioned that misconfigured reverse proxies can break the site but confirmed that correct HTTP headers (like X-Forwarded-Proto, X-Forwarded-For, and Host) allow HTTPS to function properly even without the internal SSL template Falco. tophee later asked for clarification on required headers, sharing their Nginx config which includes standard proxy headers. After enabling force_https, dax confirmed the issue was resolved. The discussion highlights the importance of proper header forwarding and SSL enforcement in reverse-proxied Discourse installations.

1

We set Nginx has a front-end proxy for discourse docker (with sock Add an offline page to display when Discourse is rebuilding or starting up).
Then we set HTTPS Lets’ Encrypt outside the container (acme.sh) and everything works fine except onebox for internal link.
Onebox is not able to show the preview of internal links. They are as external links

  • HTTPS link

746×212 12.7 KB

  • Same link in HTTP:

751×267 19.9 KB

Is there a way to fix this issue?

2

Is force_ssl checked on site settings?

Obligatory, please share a link to the forum in a support topic.

3

Do you meen force_https on the admin panel? I can’t find force_ssl on site settings.

4

Yes, and looks like you don’t.

Also, when checking this, if you reverse proxy is badly configured, it’s gonna break your site.

5

Just made a backup, we will try to check the “force_https” setting. Do you confirm that even if discourse runs through sock, and so the “ssl template” is commented out, everything should work fine?
Our reverse proxy is configured to redirect all http traffic to https.

6

I’m not really a fan of running reverse proxy in self-hosted environments, unless you are very comfortable with your reverse proxy of choice.

That said, if you have all the correct headers set, it will work.

7

It works perfectly now.
Thanks for the support @Falco.

9

Which headers would that be?

Here’s what I have:

location / {
            proxy_pass http://unix:/var/discourse/shared/standalone/nginx.http.sock;
            proxy_set_header Host $http_host;                                                                                                     
            proxy_http_version 1.1;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;                                                                                           
            client_max_body_size 20M;
            error_page 502 =502 /errorpages/offline.html;
            proxy_intercept_errors on;
            error_page 500 503 504 /errorpages/50x.html;
}