How do I use the location directive in NGINX to serve a file in HTTP
(port 80) instead of redirecting to HTTPS (port 443)?
reddit / selfhosted

----------------------------------------------------------------------
Mountain_Plant2016 · 2023-11-07 22:47

Let's say I have a site and its domain is `mydomain.com`. I have set
it so it redirects to `https://mydomain.com` if someone types the www
and/or http version. The problem is I need to figure out how to make
an exception for files in a specific directory and its subdirectories
in `SERVER_ROOT/.well-known/acme-challenge` (for example
`http://mydomain.com/``/.well-known/acme-challenge``/test.txt`). I
need to do this because of LetsEncrypt/certbot being a PITA requiring
files in the `/.well-known/acme-challenge/` directory to be accessible
through HTTP (port 80) and not redirected to HTTPS so it can pass the
HTTP-01 certificate challenge. I have a text file called test.txt
located in `SERVER_ROOT/.well-known/acme-challenge/test.txt`. Of
course I `systemctl reload nginx` each time I edit the nginx config.

If I open this URL in Internet Explorer 11 it displays the text file
and stays in http, which is what I intended.

If I open this URL in a Firefox private window it redirects to https
before displaying the text file.

If I type in `curl -I` `mydomain.com/.well-known/acme-
challenge/test.txt:80` I get:

    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 07 Nov 2023 22:28:55 GMT
    Content-Type: text/html
    Content-Length: 162
    Connection: keep-alive

If I type in `curl -s` `mydomain.com/.well-known/acme-
challenge/test.txt:80` I get:


    404 Not Found

    404 Not Found
    nginx



Here is my full nginx config:

    server {
        listen 80;
        server_name mydomain.com www.mydomain.com 169.99.99.99;
        access_log off;

        location /.well-known/acme-challenge {
            root /var/www/mydomain;
            default_type text/plain;
            allow all;
        }

        location / {
                return 301 https://mydomain.com$request_uri;
        }
    }

    server {
        listen 443;
        server_name www.mydomain.com;
        access_log off;

        return 301 https://mydomain.com$request_uri;
    }

    server {
        listen 443 default_server ssl;

        server_name mydomain.com;
        access_log off;
        log_not_found off;

        root /var/www/mydomain;
        index index.php index.html index.htm index.nginx-debian.html;
        ssl_certificate
/etc/letsencrypt/live/mydomain.com/fullchain.pem; # managed by Certbot
        ssl_certificate_key
/etc/letsencrypt/live/mydomain.com/privkey.pem; # managed by Certbot
        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        add_header Strict-Transport-Security "max-age=31536000;
includeSubDomains; preload" always;
        add_header X-XSS-Protection "1; mode=block";
        add_header Content-Security-Policy "default-src * 'unsafe-
eval' 'unsafe-inline' 'unsafe-dynamic' data: filesystem: about: blob:
ws: wss:";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        ssl_ecdh_curve secp384r1;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        resolver 8.8.8.8 8.8.4.4 valid=300s;

        server_name mydomain;

        error_page 403 = @403_handler;
        location @403_handler {
                error_log /dev/null;
        }

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
        }
    }

Here's `ufw status` below.  `iptables -S` is just ufw and sshguard
stuff, nothing weird blocking port 80.

    Status: active
    To                         Action      From
    --                         ------      ----
    22/tcp                     ALLOW       Anywhere
    80/tcp                     ALLOW       Anywhere
    443/tcp                    ALLOW       Anywhere
    DNS                        ALLOW       Anywhere
    22/tcp (v6)                ALLOW       Anywhere (v6)
    80/tcp (v6)                ALLOW       Anywhere (v6)
    443/tcp (v6)               ALLOW       Anywhere (v6)
    DNS (v6)                   ALLOW       Anywhere (v6)

What do I change in this nginx to get this to work properly, at least
in curl so that I can be sure LetsEncrypt/certbot will stop failing
the http-01 challenge? ChatGPT was unable to help, it basically said
everything looks correct in my nginx config.