TLS for default site (congratulations page)

[wjcarpenter]

(I know a fair bit about HTTP and TLS, but I'm a novice at nginx. This tool is so great at preventing me from needing to become an nginx expert that I want you to solve all my problems for me. 😄)

I set up my NPM on my home network pretty much according to the documentation. I'm using a wildcard Let's Encrypt certificate with DNS challenge. That works great for all my proxied sites. I have a half dozen, all recognized by server name.

When I try an unrecognized name to get the default site (congratulations page), it works OK in a Chrome browser because (I think) Chrome tries HTTPS first and then falls back to HTTP (with the usual browser safety warning). If I try the same thing with curl, directly trying HTTPS, I get this (the only change I made was to swap "example.org" for my actual domain):

$ curl -k -v https://home.example.org
* Host home.carpenter.org:443 was resolved.
* IPv6: (none)
* IPv4: 192.168.1.247
*   Trying 192.168.1.247:443...
* Connected to home.example.org (192.168.1.247) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, unrecognized name (624):
* OpenSSL/3.0.13: error:0A000458:SSL routines::tlsv1 unrecognized name
* Closing connection
curl: (35) OpenSSL/3.0.13: error:0A000458:SSL routines::tlsv1 unrecognized name

So, my question is ... is there a way to get a TLS connection to that default site? Of course, I'm sure there is such a way in nginx ... I mean, is there a way built into NPM that I just haven't figured out?

[wjcarpenter]

Here's how I got what I wanted (without learning too much about nginx configuration 😄). I'd be interested to hear if there is some built-in way of doing this. I also wouldn't mind hearing if there were improvements that could be made to the config file pasted below.

I should first clarify that what I wanted is more specific than the question I asked above. What I really wanted was to show a custom HTML page when users go to home.example.org (only with an actual domain name, not example.org). The custom HTML page just shows a simple menu of the available proxied services. I hand-crafted the HTML based on detailed suggestions from Google Gemini.

My solution was to copy one of the generated numbered proxy config files from data/nginx/proxy_host/ that behaved close the way I wanted my menu address to behave. I stripped out stuff that looked to me like it was only needed for proxying, tweaked mentions of host names to home.example.org, and copied in a bit of stuff from the generated data/nginx/default_host/site.conf file for showing custom HTML. I saved the result into data/nginx/proxy_host/home.conf, trusting that NPM will leave it alone.

FWIW, here's the result, which works the way I'd hoped:

# ------------------------------------------------------------                                                                                                  
# home.example.org                                                                                                                                            
# ------------------------------------------------------------                                                                                                  

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  listen 80;
  listen [::]:80;

  listen 443 ssl;
  listen [::]:443 ssl;

  server_name home.example.org;
  http2 on;

  # Let's Encrypt SSL                                                                                                                                           
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-cache.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-2/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-2/privkey.pem;
  # Block Exploits                                                                                                                                              
  include conf.d/include/block-exploits.conf;
  # Force SSL                                                                                                                                                   
  include conf.d/include/force-ssl.conf;

  access_log /data/logs/home_access.log proxy;
  error_log /data/logs/home_error.log warn;

  root /data/nginx/default_www;
  location / {
    try_files $uri /index.html;
  }
}

[wjcarpenter]

I just came across this technique (see link). I probably would have done that if I had discovered it yesterday.
#1794