无法从服务器URL访问OpenTripPlanner，求Nginx部署解决方案

Hey there! Let's walk through the common issues that might be blocking your OpenTripPlanner (OTP) instance from being accessible via your Nginx server. Here are the key checks and fixes to try:

First off, make sure OTP is actually running and configured to accept connections from outside the server's localhost:

• Check if the OTP process is active: Run ps aux | grep otp.jar or jps in your server's terminal. If it's not running, re-launch it with your usual parameters, double-checking data paths and port settings.
• Confirm OTP is listening on all network interfaces: Use netstat -tulpn | grep 8080 or ss -tulpn | grep 8080. If the output shows 127.0.0.1:8080, OTP is only accessible locally. Fix this by adding --server.address=0.0.0.0 to your OTP startup command (OTP uses Spring Boot, so this parameter will bind it to all available IPs).

This is the most common pitfall. You need to set up Nginx to forward requests from your server's public URL to the local OTP instance:

• Open your Nginx configuration file (usually located at /etc/nginx/nginx.conf or in /etc/nginx/sites-available/). Create a new config file like otp.conf if you prefer separate site configs.
• Add this reverse proxy configuration (replace your-domain.com with your server's public IP or domain):

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://localhost:8080;
        # Pass important headers to OTP
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

• Enable the config (if using sites-available): Run ln -s /etc/nginx/sites-available/otp.conf /etc/nginx/sites-enabled/
• Test the config for errors: nginx -t
• Restart Nginx to apply changes: systemctl restart nginx

Your server's firewall or cloud provider's security group might be blocking incoming traffic:

• For local firewalls (e.g., ufw on Ubuntu): Allow traffic to the port Nginx is listening on (usually 80): ufw allow 80/tcp. If you want to test direct access to OTP's 8080 port temporarily, run ufw allow 8080/tcp (you can remove this later if using Nginx proxy).
• For cloud servers (AWS, Azure, etc.): Head to your provider's console and update the security group to allow inbound traffic on port 80 (or 443 if using HTTPS) from all IP addresses (or restricted to your user base if needed).

Narrow down the issue with incremental tests:

• On the server itself: Run curl http://localhost:8080 — if you don't get OTP's HTML response, OTP isn't running correctly (go back to step 1).
• On the server: Run curl http://your-server-ip:80 — if this fails, Nginx is misconfigured or the local firewall is blocking port 80.
• On your local machine: Try accessing http://your-server-ip in a browser — if this fails, check your cloud security group or network routing issues.

If you want to serve OTP over HTTPS (which is best practice for public sites), use a free Let's Encrypt certificate:

• Install Certbot and get a certificate for your domain.
• Update your Nginx config to listen on port 443 and redirect HTTP to HTTPS:

server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name your-domain.com;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

• Restart Nginx after updating the config.

内容的提问来源于stack exchange，提问作者olivierhsta