NGINX反向代理群晖DSM：如何正确代理文件分享链接？

问题描述 #

已配置独立NGINX反向代理群晖DSM，DSM主界面可正常访问，现有配置如下：

server {
    listen 443 ssl http2;
    server_name dsm.mydomain.de;
    ssl_certificate /etc/nginx/ssl/live/dsm.mydomain.de/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/dsm.mydomain.de/privkey.pem;

    location / {
        return 301 https://dsm.mydomain.de/dsm;
    }

    location /dsm/ {
        client_max_body_size 0;
        proxy_pass http://192.168.0.92:5000/;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_buffering on;
        proxy_read_timeout 120;
        proxy_max_temp_file_size 0m;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header Connection "";
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    }

但访问FileStation生成的分享链接https://dsm.mydomain.de/sharing/a4fJsmUYK时，页面一直显示“正在加载...”；直接访问内网地址http://192.168.0.92:5000/sharing/a4fJsmUYK可正常打开文件。

解决方案 #

在server块中新增针对/sharing/路径的反向代理配置，确保请求正确转发并保留必要的请求头。修改后的完整配置如下：

server {
    listen 443 ssl http2;
    server_name dsm.mydomain.de;
    ssl_certificate /etc/nginx/ssl/live/dsm.mydomain.de/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/live/dsm.mydomain.de/privkey.pem;

    location / {
        return 301 https://dsm.mydomain.de/dsm;
    }

    location /dsm/ {
        client_max_body_size 0;
        proxy_pass http://192.168.0.92:5000/;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_buffering on;
        proxy_read_timeout 120;
        proxy_max_temp_file_size 0m;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header Connection "";
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    }

    # 新增文件分享路径的反向代理配置
    location /sharing/ {
        client_max_body_size 0;
        proxy_pass http://192.168.0.92:5000/sharing/;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_buffering on;
        proxy_read_timeout 120;
        proxy_max_temp_file_size 0m;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-NginX-Proxy true;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    }

关键注意事项 #

• proxy_pass必须指定完整的/sharing/路径，确保请求精准转发到群晖DSM的对应接口，不能仅填写内网IP和端口
• 保留Host、X-Forwarded-Proto等核心请求头，群晖DSM依赖这些头信息生成正确的页面资源链接
• 分享页面无需WebSocket支持，可移除Upgrade和Connection "upgrade"配置，避免协议冲突

验证步骤 #

修改配置后，执行以下命令校验配置合法性并重启NGINX：

nginx -t
systemctl restart nginx

重新访问分享链接即可正常加载页面。

内容的提问来源于stack exchange，提问作者Andreas