Ubuntu 20 Nginx反向代理配置：强制将HTTP重定向至HTTPS（LetsEncrypt）

问题背景 #

我有一台远程Ubuntu 20 Linux服务器，使用Nginx作为反向代理为Node.js应用提供服务，已安装Let's Encrypt SSL证书，当前HTTP与HTTPS请求均可正常响应，需要配置所有HTTP流量强制重定向至HTTPS。

环境信息 #

• 协议：IPv4
• 防火墙：Nginx Full ALLOW Anywhere
• Node应用路径：/var/www/html/mydomain
• Nginx配置文件路径：/etc/nginx/sites-available/default

当前Nginx配置 #

server {
        listen 80 default_server;
        listen [::]:80 default_server;

        root /var/www/html/mydomain;

        # Add index.php to the list if you are using PHP
        index index.html index.htm index.nginx-debian.html;

        server_name mydomain.com www.mydomain.com;

        location ^~ /assets/ {
                gzip_static on;
                expires 12h;
                add_header Cache-Control public;
  }

        location / {
                proxy_http_version 1.1;
                proxy_cache_bypass $http_upgrade;

                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_pass http://localhost:3000;
        }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/gfrweb.site/fullchain.pem; # managed by Certbot
}

解决方案步骤 #

1. 编辑Nginx配置文件
   打开配置文件进行修改：

   sudo nano /etc/nginx/sites-available/default
   

   将原配置拆分为两个独立的server块：一个专门处理HTTP请求并完成重定向，另一个保留原有的HTTPS处理逻辑。修改后的完整配置如下：

   # HTTP请求重定向块
   server {
       listen 80 default_server;
       listen [::]:80 default_server;
   
       server_name mydomain.com www.mydomain.com;
   
       # 发送301永久重定向到对应HTTPS地址
       return 301 https://$host$request_uri;
   }
   
   # HTTPS请求处理块
   server {
       root /var/www/html/mydomain;
       index index.html index.htm index.nginx-debian.html;
       server_name mydomain.com www.mydomain.com;
   
       location ^~ /assets/ {
           gzip_static on;
           expires 12h;
           add_header Cache-Control public;
       }
   
       location / {
           proxy_http_version 1.1;
           proxy_cache_bypass $http_upgrade;
   
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection 'upgrade';
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
   
           proxy_pass http://localhost:3000;
       }
   
       listen [::]:443 ssl ipv6only=on; # managed by Certbot
       listen 443 ssl; # managed by Certbot
       ssl_certificate /etc/letsencrypt/live/gfrweb.site/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/gfrweb.site/privkey.pem; # 保留Certbot生成的密钥配置
       include /etc/letsencrypt/options-ssl-nginx.conf; # 保留Certbot的SSL选项配置
       ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # 保留Certbot的DH参数配置
   }
   

   注意：务必保留Certbot自动生成的所有SSL相关配置项（如ssl_certificate_key、include语句等），原配置中可能未完整显示，不要遗漏。

2. 验证配置语法正确性
   修改完成后，执行以下命令检查配置是否存在语法错误：

   sudo nginx -t
   

   若输出nginx: configuration file /etc/nginx/nginx.conf test is successful，说明配置有效。

3. 重启Nginx服务使配置生效

   sudo systemctl restart nginx
   

内容的提问来源于stack exchange，提问作者user22336075