Two domains on one droplet with one SSL certificate

It seems the problem has been solved now with the above configuration. I had to remove the first domain from the sites-enabled first though. After that the second domain worked. When I re-added the first domain to the sites-enabled, they both worked properly.

These are the only 2 configuration files, I have removed the default file from the sites-enabled. Domain 1 as following:

#domain1

server {
        listen 80 default_server;
        server_name www.domain1.com domain1.com;
        return 301 https://$server_name$request_uri;
}

server {
        server_name www.domain1.com domain1.com;
        listen 443 ssl http2;

        ssl_certificate /etc/letsencrypt/live/www.domain1.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.domain1.com/privkey.pem;
        include /etc/nginx/snippets/ssl-params.conf;

    location / {
        proxy_pass http://localhost:3001;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
     }
     location ~ /.well-known {
             allow all;
    }
}

And domain2:

#domain2
server {
    listen 80;
    server_name domain2.com www.domain2.com;
    return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2;
  server_name domain2.com www.domain2.com;

  root /home/Bas/domain2;
  index index.html index.htm;

  ssl_certificate /etc/letsencrypt/live/domain2.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/domain2.com/privkey.pem;

  include /etc/nginx/snippets/ssl-params.conf;

  location / {
         try_files $uri $uri/ =404;
         }
}

@basmariot

What’s inside of /etc/nginx/snippets/ssl-params.conf?

…

As far as the server blocks go, let’s start with the two that listen on Port 80.

When you’re proxying requests, you don’t need the same directives that you would need if you were not. We can shrink down the first two server blocks.

domain1.com

This:

server {
        listen 80 default_server;

        root /home/Bas/domain1;
        index index.html index.htm;

        server_name www.domain1.com domain1.com;
        return 301 https://$server_name$request_uri;
}

Becomes:

server {
    listen 80;
    server_name www.domain1.com domain1.com;
    
    return 301 https://$server_name$request_uri;
}

domain2.com

The second domain is already using the shrunken down version, so no changes are needed.

…

Now let’s focus on the server blocks listening on Port 443 (SSL). Your first domain looks ok in terms of basic setup, though domain2.com is where the issue is.

domain2.com

This is where the issue is:

  location / {
         try_files $uri $uri/ =404;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-NginX-Proxy true;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_pass http://localhost:80/;
         proxy_ssl_session_reuse off;
         proxy_set_header Host $http_host
         proxy_cache_bypass $http_upgrade;
         proxy_redirect off; 
 }

1). When proxying, don’t use try_files, so the first step is removing that line.

2). When proxying, you can’t proxy to Port 80 and have a redirect that redirects 80 back to 443, this is what’s causing the endless loop.

So the above should look like:

location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://localhost:80/;
    proxy_ssl_session_reuse off;
    proxy_set_header Host $http_host
    proxy_cache_bypass $http_upgrade;
    proxy_redirect off; 
}

But you need to change proxy_pass http://localhost:80/; and change 80 to the port of your app.