Using a certificate when Discourse is installed behind a reverse proxy

[naupe]

@Stephen

Assuming you’ve configured your DNS and network correctly, the only things you need in your app.yml are:

uncomment in templates:
- "templates/web.ssl.template.yml"
- "templates/web.letsencrypt.ssl.template.yml"

uncomment in expose:
- "443:443" # https

add an email to LETSENCRYPT_ACCOUNT_EMAIL:

Already did all that, but I assume you were suggesting this before you read that I want it Reverse Proxying through Nginx.

@Stephen

That’s your problem, Let’s Encrypt won’t work within Discourse if you’re using a reverse proxy in front of it. It’s not possible for the Discourse container to make the request for the certificate if it’s not directly accessible. The reverse proxy needs to request the certificate and include it in the server declaration. Discourse will continue to listen on :80 without a certificate, Let’s Encrypt will handle the external encapsulation. Look for guides here on Meta for installing Discourse alongside another webserver.

Ok, so I need to revert app.yml for an HTTP setup? Do I still need to have a Key and Cert file pair in /var/discourse/shared/standalone/ssl? And if so, how in fact would I generate the necessary Key and Cert file pair I need on my Nginx VM?

I assume you’re suggesting that I follow one of these guide?

• Install and Run Discourse behind Nginx the Right Way, First Time!
  • EDIT: I discovered this article after my initial post. THIS one looks like the best to follow, since it looks like its assuming Nginx is on a separate machine. It also mentions that Nginx needs to handle Let’s Encrypt instead of Discourse. However it still assumes a VPS setup on DigitalOcean … ugh.
• Running other websites on the same machine as Discourse
• How To Install Discourse Behind Nginx on Ubuntu 14.04

Any recommendations? Even skimming these guides, I’m wondering: are they assuming that Nginx will be installed on the same VM as Discourse or on a separate VM? I’ve skimmed both and its not obvious to me.

@Stephen

You will need to manually enable force_https on your site afterwards to get rid of mixed content errors. You will also need to make sure your reverse proxy configuration hands off the true origin IP, otherwise you won’t see user IP addresses within Discourse and will get all kinds of funky rate limit errors.

If you’re familiar with nginx this shouldn’t be a problem for you to do.

I’m unfortunately not familiar with Nginx much at all. I am only using it based on the recommendation of the previous Admin who helped set me up our current (and soon to be taken offline) Discourse Server. As per what he told me: it was on its own IP, but this new Discourse is on a VM on a single Server, so Reverse Proxying with Nginx is required.

I don’t understand what you mean when you say “manually enable force_https on your site afterwards to get rid of mixed content errors.” So what you’re suggesting is that I get Discourse working via HTTP first? But then I still have questions:

1. How would I go about setting up HTTPS on a Discourse reverse proxying through Nginx, particularly in terms of creating Key and Cert file pairs? I guess I’m going to hope that’s covered in one of these Nginx + Discourse guide.
2. I wouldn’t even know where to start with “manually enable force_https” as you suggested. Would you mind providing more details?

@Stephen

The external DNS entry needs the external IP address, even if a reverse proxy is in play.

Weird, for setting up my ownCloud VM DNS entry (which Reverse Proxies through Nginx), I used the local IP and it connects just fine. I guess for Discourse I will make sure it uses my External IP.