在DigitalOcean上配置带SSL的Strapi（Nginx反向代理）遇502错误求助

问题背景 #

在DigitalOcean云服务器上配置Nginx带SSL反向代理Strapi服务时，出现502 Bad Gateway错误。此前直接开放8011端口通过DNS访问一切正常，nginx -t验证配置语法无问题，已多次重启Nginx服务，SSL证书有效。

相关配置文件 #

1. /etc/nginx/conf.d/upstream.conf

# Strapi server
upstream strapi {
  server 127.0.0.1:8011;
}

2. /etc/nginx/sites-available/default

server {
        # Listen HTTP
        listen 80;
        server_name losslessly-api.djkato.net;

        # Redirect HTTP to HTTPS
        return 301 https://$host$request_uri;
}

server {
        # SSL configuration
        listen 443 ssl;
        listen [::]:443 ssl;

        ssl_certificate     /etc/nginx/certificate/losslessly-api.djkato.net.crt;
        ssl_certificate_key /etc/nginx/certificate/losslessly-api.djkato.net.key;

        server_name losslessly-api.djkato.net;

        # Proxy Config
        location / {
        proxy_pass http://strapi;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_pass_request_headers on;
    }
}

3. ./config/server.js

module.exports = ({ env }) => ({
  host: env('HOST', '0.0.0.0'),
  port: env.int('PORT', 8011),
  url: 'https://losslessly-api.djkato.net',
});

4. sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
8011/tcp                   DENY        Anywhere
Nginx HTTP                 ALLOW       Anywhere
Nginx HTTPS                ALLOW       Anywhere
8011                       DENY        Anywhere
Nginx Full                 ALLOW       Anywhere
OpenSSH (v6)               ALLOW       Anywhere (v6)
8011/tcp (v6)              DENY        Anywhere (v6)
Nginx HTTP (v6)            ALLOW       Anywhere (v6)
Nginx HTTPS (v6)           ALLOW       Anywhere (v6)
8011 (v6)                  DENY        Anywhere (v6)
Nginx Full (v6)            ALLOW       Anywhere (v6)

排查与解决步骤 #

1. 确认Strapi服务本地监听状态 #

502错误核心是Nginx无法连接后端服务，先验证Strapi是否在127.0.0.1:8011正常运行：

• 执行本地请求测试：curl http://127.0.0.1:8011
• 查看端口监听情况：netstat -tulpn | grep 8011，输出需包含0.0.0.0:8011或127.0.0.1:8011

如果本地请求失败，检查Strapi服务是否启动，或确认启动命令中未覆盖host/port配置。

2. 检查系统安全限制（SELinux/AppArmor） #

部分Linux发行版默认启用的安全模块会阻止Nginx连接本地端口：

• 临时关闭SELinux测试：sudo setenforce 0，重启Nginx后再次访问。若恢复正常，添加永久规则：

  sudo setsebool -P httpd_can_network_connect 1
  

• AppArmor测试：临时禁用服务：sudo systemctl stop apparmor，验证是否解决问题。

3. 优化Nginx代理配置 #

调整代理头和缓冲设置，避免连接异常：
修改location /块为：

location / {
    proxy_pass http://strapi;
    proxy_http_version 1.1;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_upgrade;
    proxy_pass_request_headers on;
    proxy_buffering off;
}

4. 配置Strapi信任反向代理 #

Strapi需明确知晓运行在代理之后，修改./config/middlewares.js中的strapi::security配置：

module.exports = [
  // 保留其他中间件
  {
    name: 'strapi::security',
    config: {
      proxy: {
        enabled: true,
        headers: {
          host: true,
          protocol: true,
          ip: true,
        },
      },
    },
  },
  // 保留其他中间件
];

5. 通过Nginx错误日志定位细节 #

若以上步骤无效，查看Nginx错误日志获取具体原因：

tail -f /var/log/nginx/error.log

访问域名后，日志会显示具体错误（如connection refused表示Strapi未启动，permission denied表示权限限制）。

内容的提问来源于stack exchange，提问作者djkato