Submitted by Caoimhe in technology

I have a website: https://oakreef.ie/

It has a self-hosted comments section that uses Comentario which is exposed at: https://comments.oakreef.ie/

This seems to work consistently fine on my desktop (running Manjaro) in both Firefox and Chromium but on Fennec (Firefox fork) on my phone and also on Chrome on my work laptop (Windows 11 🙁) sometimes the https://comments.oakreef.ie/ domain just redirects back to the main page instead of the Comentario dashboard and when this happens the comment section stops loading entirely because the subdomain is directing to the wrong place.

I site is just hosted on a server I rent that’s running Ubuntu through an Nginx reverse proxy. I assume that the problem is with Nginx but I am not sure and I find configuring Nginx confusing. I have just pasted the full configuration here which I don’t think contains anything that I shouldn’t post publicly but do please tell me if I fucked up posting it too lol.

##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# https://www.nginx.com/resources/wiki/start/
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
# https://wiki.debian.org/Nginx/DirectoryStructure
#
# In most cases, administrators will remove this file from sites-enabled/ and
# leave it as reference inside of sites-available where it will continue to be
# updated by the nginx packaging team.
#
# This file will automatically load configuration files provided by other
# applications, such as Drupal or Wordpress. These applications will be made
# available underneath a path with that package name, such as /drupal8.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

server {
    root /var/www/oakreef.ie/html;
    index index.html;
    server_name oakreef.ie www.oakreef.ie;
    error_page  404  /404.html;

    location / {
        # redirects
        include /etc/nginx/conf.d/oakreef.ie-redirects;

        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri.html $uri/ =404;
        add_header Cache-Control "public";
        add_header X-Robots-Tag noai;
        add_header Permissions-Policy 'fullscreen=(self "https://www.youtube-nocookie.com")';
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/oakreef.ie/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/oakreef.ie/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server {

  server_name comments.oakreef.ie;

	#listen [::]:443 ssl ipv6only=on;
	listen 443 ssl;

  ssl_certificate     /etc/letsencrypt/live/oakreef.ie/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/oakreef.ie/privkey.pem;
	include /etc/letsencrypt/options-ssl-nginx.conf;
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

  location / {
    proxy_pass http://127.0.0.1:5050;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection keep-alive;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $server_name;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
		add_header Cache-Control "private";
	}
}


server {
    if ($host = www.oakreef.ie) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = oakreef.ie) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = comments.oakreef.ie) {
				return 301 https://$host$request_uri;
		}

    listen 80 default_server;
    listen [::]:80 default_server;

    server_name oakreef.ie www.oakreef.ie comments.oakreef.ie;
    return 404; # managed by Certbot
}
7

Comments

You must log in or register to comment.

emma wrote

seems to me it might be happening because the main domain is on ipv6, but the comments subdomain isn't? so whether you're redirected or not depends on if traffic is being sent over ipv6 at any given moment.

3

Caoimhe OP wrote (edited )

Hmm I tried to uncomment the #listen [::]:443 ssl ipv6only=on; line in the comments.oakreef.ie block and it resulted in Nginx failing to start because it considered it duplicate configuration.

Jun 30 06:47:48 localhost nginx[404098]: nginx: [emerg] duplicate listen options for [::]:443 in /etc/ngi>
Jun 30 06:47:48 localhost nginx[404098]: nginx: configuration file /etc/nginx/nginx.conf test failed
Jun 30 06:47:48 localhost systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE

Edit: After finding this I uncommented that line again and just removed the ipv6only=on part and it no longer is considered a duplicate line and starts fine and comments.oakreef.ie is working fine on my phone for now at least. Does removing ipv6only=on matter much? Fucked if I know. I’ll look at Caddy when I have the time.

3

twovests wrote

First, I'm going to be insufferable here and suggest you take a look at Caddy. It took me 20 minutes to be more comfortable with Caddy than I was after 5 years of Nginx.

I highly recommend giving Caddy an hour of your time. It's my "Play Outer Wilds" of webservers.

site is just hosted on a server I rent that’s running Ubuntu through an Nginx reverse proxy. I assume that the problem is with Nginx but I am not sure and I find configuring Nginx confusing.

This is the exact same position I was in.

Second, re:

I don’t think contains anything that I shouldn’t post publicly but do please tell me

I don't think anything here is sensitive (but might make things easier for an attacker if they get root on your server).

Third, re:

sometimes the https://comments.oakreef.ie/ domain just redirects back to the main page

This happens (1) only sometimes, and (2) only on Fennic-on-personal-phone and Chrome-on-work-laptop? That's strange, and I'm wondering if you have any more rhyme-or-reason to this.


tldr: Play Outer Wilds Consider Caddy. (Also, do you have any more details or suspicions on what's causing the subdomain to point to the wrong thing?)

1

Caoimhe OP wrote

I will have a look at Caddy but probably not today. And no I don’t really have any other clue about what’s going on TBH.

3