通过OpenVPN隧道配置Nginx-Proxy：借助DigitalOcean VPS访问内网服务

Alright, let's get your subdomain access set up with Nginx Proxy through the OpenVPN tunnel. You've already got the core VPN infrastructure working, so we just need to tie the proxy layer into that existing setup. Here's a step-by-step breakdown tailored to your environment:

• Make sure your subdomain nextcloud.example.com points directly to your DigitalOcean VPS's public IP address. Create an A record in your domain registrar's DNS settings for this—no fancy proxy records needed here, since the VPS will handle forwarding traffic into the tunnel.

Since you're already using Docker for OpenVPN, I'd recommend sticking with the jwilder/nginx-proxy Docker image for consistency. If you prefer a native Nginx installation, that works too, but Docker will make it easier to manage alongside your OpenVPN container.

For Docker-based Nginx Proxy: #

1. Create a Docker network to streamline service communication:

   docker network create nginx-proxy
   

2. Start the nginx-proxy container, mapping ports 80 and 443 to the VPS's public interface:

   docker run -d \
     --name nginx-proxy \
     --network nginx-proxy \
     -p 80:80 \
     -p 443:443 \
     -v /var/run/docker.sock:/tmp/docker.sock:ro \
     jwilder/nginx-proxy
   

You need two key IPs to configure the proxy:

• The OpenVPN tunnel IP of your pfSense client (check your OpenVPN server logs on the VPS or pfSense's client status—this is likely something like 10.8.0.2)
• The local LAN IP of your Nextcloud server (e.g., 192.168.1.100—you already know this since you can access it over VPN)

Since we're forwarding to a service on the OpenVPN tunnel (not a local Docker container), we'll create a custom vhost configuration for nginx-proxy.

1. Create a directory for custom vhosts in the container:

   docker exec nginx-proxy mkdir /etc/nginx/vhost.d
   

2. Create a config file for your subdomain:

   docker exec -it nginx-proxy nano /etc/nginx/vhost.d/nextcloud.example.com
   

3. Paste this configuration (replace the IP with your actual Nextcloud LAN IP, and adjust the port if your Nextcloud uses something other than 443):

   location / {
       proxy_pass https://192.168.1.100;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
   }
   

4. Reload nginx to apply changes:

   docker exec nginx-proxy nginx -s reload
   

If You're Using Native Nginx: #

Create a new server block in /etc/nginx/sites-available/nextcloud.example.com:

server {
    listen 80;
    server_name nextcloud.example.com;

    location / {
        proxy_pass https://192.168.1.100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable it and reload nginx:

ln -s /etc/nginx/sites-available/nextcloud.example.com /etc/nginx/sites-enabled/
nginx -s reload

To get HTTPS working (required for proper Nextcloud functionality), use the letsencrypt-nginx-proxy-companion container with your nginx-proxy:

docker run -d \
  --name nginx-proxy-letsencrypt \
  --network nginx-proxy \
  -v /var/run/docker.sock:/tmp/docker.sock:ro \
  -v /etc/nginx/certs:/etc/nginx/certs:rw \
  --volumes-from nginx-proxy \
  jrcs/letsencrypt-nginx-proxy-companion

The companion will automatically fetch and renew SSL certificates for your subdomain as long as DNS is correctly configured.

• On your DigitalOcean VPS: Ensure ports 80 and 443 are open in the VPS firewall (configure this via the DigitalOcean dashboard or ufw on the VPS).
• On pfSense: Add a firewall rule to allow incoming traffic from the OpenVPN tunnel subnet (e.g., 10.8.0.0/24) to your Nextcloud server's LAN IP on ports 80/443. This ensures proxy traffic from the VPS can reach your home Nextcloud.

Edit your Nextcloud config.php file and add nextcloud.example.com to the trusted_domains array:

'trusted_domains' => [
    '192.168.1.100',
    'nextcloud.example.com',
],

This prevents Nextcloud from throwing an access error when you visit it via the subdomain.

Once all steps are complete, visit https://nextcloud.example.com in your browser—you should be redirected to your home Nextcloud instance through the OpenVPN tunnel, no manual VPN connection required on your client device.

内容的提问来源于stack exchange，提问作者Svarto