Struggling to make NGINX reverse proxy work with Meshcentral

[jrosetto]

I have meshcentral on a vps and NGINX running on another in the same network. I have tried the guides but keep getting ERR_TOO_MANY_REDIRECTS when trying to browse to the page.

Config

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "meshcentral.redacted.com",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "_AliasPort": 443,
    "redirPort": 80,
    "TlsOffload": "192.168.3.5"
  },
  "domains": {
    "": {
      "_title": "Title",
      "_title2": "Title2",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true,
      "certUrl": "https://meshcentral.redacted.com:443"
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "redacted",
    "names": "meshcentral.redacted.com",
    "skipChallengeVerification": true,
    "production": false
  }
}

NGINX

server {
    server_name meshcentral.redacted.com; # managed by Certbot
    return 301   https://$host$request_uri;

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/meshcentral.redacted.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/meshcentral.redacted.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

        # MeshCentral uses long standing web socket connections, set longer timeouts.
        proxy_send_timeout 330s;
        proxy_read_timeout 330s;

        # We can use the MeshCentral generated certificate & key
        ssl_certificate webserver-cert-public.crt;
        ssl_certificate_key webserver-cert-private.key;
        ssl_session_cache shared:WEBSSL:10m;

        location / {
            proxy_pass https://192.168.3.3:443/;
            proxy_http_version 1.1;

            # Allows websockets over HTTPS.
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;

            # Inform MeshCentral about the real host, port and protocol
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

}
server {
    if ($host = meshcentral.redacted.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen       80 ;
    listen       [::]:80 ;
    server_name meshcentral.redacted.com;

        location / {
            proxy_pass http://192.168.3.3:80/;
            proxy_http_version 1.1;

            # Inform MeshCentral about the real host, port and protocol
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

    return 404; # managed by Certbot

Meshcentral log

Apr 30 15:06:09 managedservices systemd[1]: Started MeshCentral Server.
Apr 30 15:06:10 managedservices node[1954]: MeshCentral HTTP redirection server running on port 80.
Apr 30 15:06:10 managedservices node[1954]: MeshCentral v1.1.22, Hybrid (LAN + WAN) mode, Production mode.
Apr 30 15:06:14 managedservices node[1954]: MeshCentral Intel(R) AMT server running on meshcentral.redacted.com:4433.
Apr 30 15:06:15 managedservices node[1954]: MeshCentral HTTP server running on port 443.
Apr 30 15:06:15 managedservices node[1954]: Loaded web certificate from "https://meshcentral.redacted.com:443", host: "meshcentral.redacted.com"
Apr 30 15:06:15 managedservices node[1954]:   SHA384 cert hash: 22df373305ec560b88ff3ae0ffb909f8571a94ae9a147f963c9bbbd57ba881effd6e09d53ed9871e6d7bb

Help would be greatly appreciated as I am stumped

[si458]

you have put return 301 https://$host$request_uri; under the very first server which is running on port 443
so its trying to redirect https to https to https, etc...
remove the very first return 301 and leave the second on above listen 80

[jrosetto]

Thanks for the quick response. That did it. Wasn't paying attention to the LetsEncrypt generated config.

Working great now.