Mastodon LXC实例Nginx反向代理重定向过多问题求助

问题根源 #

代理端（运行WordPress的LXC）的HTTPS服务（443端口）将请求转发到Mastodon LXC的80端口，但Mastodon LXC的Nginx配置强制把80端口的所有请求跳转到HTTPS，形成无限循环：
外部HTTPS请求 → 代理端443 → Mastodon 80 → 跳转HTTPS → 代理端443 → Mastodon 80...

修复步骤 #

1. 修改代理端Nginx配置 #

将转发目标改为Mastodon的443端口，并添加X-Forwarded-Proto头告知Mastodon当前请求已通过HTTPS传输：

server {
    server_name nameysitem.quest;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; # 新增：传递HTTPS协议信息
        proxy_pass https://10.255.192.84:443; # 改为转发到Mastodon的HTTPS端口
        proxy_ssl_verify off; # 若Mastodon使用自签名证书需添加，正式SSL证书可省略
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/nameysitem.quest/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/nameysitem.quest/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31536000" always; # managed by Certbot

    ssl_trusted_certificate /etc/letsencrypt/live/nameysitem.quest/chain.pem; # managed by Certbot
    ssl_stapling on; # managed by Certbot
    ssl_stapling_verify on; # managed by Certbot

}
server {
    if ($host = nameysitem.quest) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name nameysitem.quest;
    location / {
        return 301 https://$host$request_uri; # 直接跳转到HTTPS，无需转发到Mastodon的80端口
    }

    listen 80; # managed by Certbot
}

2. 优化Mastodon LXC端Nginx配置（可选） #

限制Mastodon的80端口仅响应ACME证书验证请求，避免外部直接访问触发不必要的跳转：

server {
    listen 80;
    listen [::]:80;
    server_name nameysitem.quest;
    root /var/www/mastodon/public;

    location /.well-known/acme-challenge/ { allow all; }
    location / { 
        allow 10.255.192.xxx; # 替换为代理端LXC的IP地址
        deny all;
    }
}

3. 重启Nginx服务 #

分别重启代理端和Mastodon端的Nginx：

# 代理端
sudo systemctl restart nginx

# Mastodon LXC端
sudo systemctl restart nginx

验证 #

访问https://nameysitem.quest，确认Mastodon正常加载，浏览器无重定向循环提示。

内容的提问来源于stack exchange，提问作者Richard Perryman-Smalley