From 40a6a5b8d24ad3b54d3bfa74f3992bfc8a3b7c87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Sun, 30 Aug 2026 10:34:36 +0100 Subject: [PATCH] nginx redirects stay relative MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It sits behind the proxy that terminates TLS, so it believes it is serving plain HTTP. Asked for /home/gallery/16 it correctly redirects to the directory and wrote the Location as http://host/home/gallery/16/ — downgrading an HTTPS visitor to HTTP for a round trip before the proxy sent them back where they came from. absolute_redirect off emits just the path, and the browser keeps the scheme it already had. Co-Authored-By: Claude Opus 5 (1M context) --- api/static-site.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/api/static-site.ts b/api/static-site.ts index 91885d4..a82df2a 100644 --- a/api/static-site.ts +++ b/api/static-site.ts @@ -218,6 +218,14 @@ const NGINX_CONF = `server { root /usr/share/nginx/html; index index.html; + # Redirects stay relative, so they keep the scheme and host the visitor arrived on. + # + # nginx sits behind the proxy that terminates TLS, so it believes it is serving plain HTTP. Asked for + # /home/gallery/16 it correctly redirects to the directory — and wrote the Location as + # http://host/home/gallery/16/, downgrading an HTTPS visitor to HTTP for a round trip before the + # proxy sent them back. Off emits just the path, and the browser keeps the scheme it had. + absolute_redirect off; + # Text compresses; the images and video here are already compressed formats and would only burn CPU. gzip on; gzip_vary on;