diff --git a/ansible/files/nginx.conf b/ansible/files/nginx.conf index 10645e3..b097dc4 100644 --- a/ansible/files/nginx.conf +++ b/ansible/files/nginx.conf @@ -39,11 +39,6 @@ server { add_header X-Cache-Status $upstream_cache_status; - # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite - # redirection loop because the backend assumes that HTTP was spoken behind the - # proxy. - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs proxy_set_header Host $host; @@ -72,6 +67,12 @@ server { proxy_cache my_cache; proxy_set_header x_debian_sso_dn $ssl_client_s_dn; proxy_pass http://127.0.0.1:3000; + + # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite + # redirection loop because the backend assumes that HTTP was spoken behind the + # proxy. And Omniauth would incorrectly assume you used a HTTP callback URL. + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Avoid cache stampede - rather update once and deliver stale content proxy_cache_lock on;