Introduction
This article covers the topic of configuring SSL passthrough certificates for Nginx reverse proxy in a Paperless-ngx setup. The focus is on providing a detailed explanation of the concept and the necessary steps in order to properly implement it; thus, enabling a secure and efficient flow of data and resources.
Prerequisites
Before beginning, ensure that you have a basic understanding of the following:
- Docker and Docker Compose
- SSL/TLS certificates
- Nginx reverse proxy
- Paperless-ngx
Setup Overview
In this guide, we assume that you have a Paperless-ngx Docker Compose setup exposing a single port (8050), and that you have a domain configured (e.g., https://paperless.example.com). The next step is to configure an Nginx reverse proxy to handle SSL passthrough certificates. This configuration will ensure that all incoming requests are encrypted and properly forwarded to the Paperless-ngx application.
Configuring Nginx Reverse Proxy
Begin by creating a new Nginx configuration file (nginx.conf) with the following content:
server {
listen 80;
server\_name paperless.example.com;
location / {
proxy\_pass http://localhost:8050;
proxy\_set\_header Host $host;
proxy\_set\_header X-Real-IP $remote\_addr;
proxy\_set\_header X-Forward-For $proxy\_add\_x\_forwarded\_for;
}
}
This configuration listens for incoming requests on port 80 for the paperless.example.com domain and proxies the requests to the Paperless-ngx application listening on localhost:8050. Note that we are not handling SSL at this point.
SSL Passthrough Certificates
To add SSL passthrough certificates, we need to first obtain the necessary SSL/TLS certificates and private keys. For this, you can use services such as Let's Encrypt or a trusted certificate authority.
Once you have the SSL/TLS certificates and private keys, you can update the Nginx configuration to include these files:
server {
listen 443 ssl;
server\_name paperless.example.com;
ssl\_certificate /path/to/cert.pem;
ssl\_certificate\_key /path/to/privkey.pem;
location / {
proxy\_pass http://localhost:8050;
proxy\_set\_header Host $host;
proxy\_set\_header X-Real-IP $remote\_addr;
proxy\_set\_header X-Forward-For $proxy\_add\_x\_forwarded\_for;
}
}
The updated configuration now listens for incoming requests on port 443 using SSL, and includes cert.pem and privkey.pem for SSL certificate and private key, respectively. The incoming requests are still being proxied to the Paperless-ngx application on localhost:8050.
Note:
When using Let's Encrypt, you can automate the process of obtaining and renewing SSL/TLS certificates using tools such as Certbot or Letsencrypt nginx plugin.
Testing the Setup
To test the setup, run the Nginx reverse proxy and ensure that you can access the Paperless-ngx application using the configured domain with SSL (e.g., https://paperless.example.com). If you encounter any issues, check the Nginx error logs for more information.
In this article, we learned how to configure Nginx reverse proxy for SSL passthrough certificates in a Paperless-ngx Docker Compose setup. By following the steps outlined in this guide, you can ensure a secure and efficient flow