Steps

Once NginX forwards requests to XWiki on port 80, a second server block on port 443 serves the same wiki over HTTPS and the port 80 one redirects to it. This procedure continues Configure NginX Server as a Proxy on a Linux OS, and the directives it adds are described in NginX Server Key Configurations.

1. Obtain a TLS certificate and its private key for the wiki's domain.
2. Add the HTTPS block to /etc/nginx/sites-available/xwiki, carrying every proxy directive of the port 80 block:

   server {
       listen 443 ssl;
       server_name wiki.example.com;
   
       ssl_certificate /etc/ssl/certs/wiki.example.com.crt;
       ssl_certificate_key /etc/ssl/private/wiki.example.com.key;
   
       access_log /var/log/nginx/xwiki-access.log;
       error_log /var/log/nginx/xwiki-error.log;
   
       client_max_body_size 0;
   
       location = / {
           return 301 /xwiki/;
       }
   
       location /xwiki {
           proxy_pass http://localhost:8080;
   
           proxy_set_header Host $http_host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
           proxy_set_header X-Forwarded-Host $http_host;
           proxy_set_header Forwarded "";
   
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $connection_upgrade;
   
           proxy_redirect off;
       }
   }

3. Replace the body of the port 80 block in the same file with a redirect to HTTPS:

   server {
       listen 80;
       server_name wiki.example.com;
   
       location ^~ /.well-known/acme-challenge/ {
           root /var/www/html;
       }
   
       location / {
           return 301 https://$host$request_uri;
       }
   }

4. Set xwiki.home in the xwiki.cfg configuration file to the public base address, scheme and trailing slash included and without the /xwiki path: xwiki.home=https://wiki.example.com/.
5. Recommended: make the Servlet Container trust the forwarded headers as well, following Configure Tomcat to Find Proxy Headers.
6. Check the configuration and reload NginX: sudo nginx -t then sudo systemctl reload nginx.
7. Open https://wiki.example.com in a browser. The browser reports the connection as secure, the plain HTTP address redirects to it, and the wiki's own links all use https://.

FAQ

Why does the redirect use $host when the proxy headers use $http_host?

Because $host carries no port and $http_host does: in the redirect the port of the plain HTTP listener would end up in an https:// address, while the proxy headers need the port so that the wiki builds its own URLs with it.

Why does the ACME location need the ^ prefix?

Without it a regular-expression location elsewhere in the same server block wins over the prefix, and the certificate challenge is redirected to HTTPS instead of being answered, which breaks automatic renewal.

Do I have to configure the TLS protocols and ciphers?

No. Since NginX 1.23.4 ssl_protocols already defaults to TLSv1.2 TLSv1.3, so a hardening snippet copied from an older guide usually only pins something weaker.

How do I make browsers use HTTPS without going through the redirect first?

Add add_header Strict-Transport-Security "max-age=63072000" always; to the port 443 block, once every part of the wiki is served over HTTPS, since a browser then refuses plain HTTP for the whole max-age. A location that declares an add_header of its own inherits none of the outer ones and needs the line repeated.

How do I do this on Windows?

The two blocks are the same. Put them in conf\nginx.conf in place of the port 80 one, name the certificate and the key with Windows paths, and reload with nginx -s reload.

Related

• Configure NginX Server as a Proxy on a Windows OS.
• Configure Tomcat to Find Proxy Headers.
• NginX Configuring HTTPS servers.
• Configuration.