我想要做的总结如下。 我有一个NGinx服务器，承载了三种不同的东西：GitLab，NextCloud和一个专有服务。 GitLab充当Oauth供应商，用户必须通过authentication才能访问我们托pipe的任何网站。 因此，我在Nginx中使用了一个反向代理。
我成功地能够authentication并访问我们的GitLab和我们专有的软件。 但NextCloud和Oauth不想一起工作。
我还应该提到，现在我们正在混淆我们服务的url。 例如，我正在尝试在https://oursite.com/test-test/提供NextCloud，但是当您第一次访问该网站时，您应该将其redirect到GitLab，然后再跳回到NextCloud。
我还应该提到，我正在使用oauth处理程序侦听端口4180和4181的oauth2_proxy应用程序。
这里是使用的configuration：
Base Nginxconfiguration
server { listen 80; server_name oursite.com; client_max_body_size 10m; location /api/ { proxy_pass http://127.0.0.1:4180/api/; proxy_set_header Host $host; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; } location /obfuscated-url-1/ { proxy_pass http://127.0.0.1:4180; proxy_set_header Host $host; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; } location /obfuscated-url-2/ { proxy_pass http://127.0.0.1:8081/obfuscated-url-2/; proxy_set_header Host $host; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; } location / { deny all; } location /test-test/ { proxy_pass http://127.0.0.1:4181; proxy_set_header Host $host; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; } } server { listen 8082; client_max_body_size 10m; location /api/ { # pass API calls to gunicorn proxy_pass http://127.0.0.1:8000/; proxy_read_timeout 600s; } location /obfuscated-url-1/docs/ { # pass documentation to the right place alias /path/to/proprietary/; } location /obfuscated-url-1/ { # This serves up the frontend alias /path/to/proprietary/; try_files $uri $uri/ /index.html?/$request_uri; } }
NextCloud Nginx Conf
server { listen 8888; # Add headers to serve security related headers add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; # Path to the root of your installation root /opt/nextcloud/; location = /robots.txt { allow all; log_not_found off; access_log off; } location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } location ~ /.well-known/acme-challenge { allow all; } # set max upload size client_max_body_size 512M; fastcgi_buffers 64 4K; # Disable gzip to avoid the removal of the ETag header gzip off; error_page 403 /core/templates/403.php; error_page 404 /core/templates/404.php; location / { rewrite ^ /index.php$uri; } location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { deny all; } location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { deny all; } location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) { include fastcgi_params; fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; #Avoid sending the security headers twice fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; fastcgi_pass unix:/run/php/php7.0-fpm.sock; fastcgi_intercept_errors on; fastcgi_request_buffering off; } location ~ ^/(?:updater|ocs-provider)(?:$|/) { try_files $uri/ =404; index index.php; } # Adding the cache control header for js and css files # Make sure it is BELOW the PHP block location ~* \.(?:css|js)$ { try_files $uri /index.php$uri$is_args$args; add_header Cache-Control "public, max-age=7200"; # Add headers to serve security related headers (It is intended to # have those duplicated to the ones above) add_header X-Content-Type-Options nosniff; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; # Optional: Don't log access to assets access_log off; } location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ { try_files $uri /index.php$uri$is_args$args; # Optional: Don't log access to other assets access_log off; } }
我遇到的问题在于：
location /test-test/ { proxy_pass http://127.0.0.1:4181; proxy_set_header Host $host; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; }
因此，在这一节中，我可以访问https://oursite.com/test-test/然后我退到GitLab上，然后我就可以login了。然后我就开始使用https://oursite.com/test-test/login但页面显示302 Bad Redirect错误。 奇怪的是，如果我将proxy_pass行更改为：
proxy_pass http://127.0.0.1:4181/;
（注意尾随/ ）
然后，我可以看到NextCloudloginIF和只有如果我已经对GitLab进行身份validation。 如果我尝试使用GitLab进行身份validation，而该行有尾随/那么“使用GitLablogin”button会中断，我无法login。