From fc6d4d2191b49baebd0a0253f05a9cb3db38b959 Mon Sep 17 00:00:00 2001 From: Nick Vigilante Date: Wed, 12 Aug 2026 21:34:09 +0000 Subject: [PATCH] docs: correct nginx X-Forwarded-Proto and certbot instructions flavor reverse-proxy-nginx.md set X-Forwarded-Proto from $http_x_forwarded_proto, a client-controlled (spoofable) header. In an nginx TLS-terminating reverse proxy it should be $scheme, which nginx derives from the actual connection. Also point the Certbot instructions link at the nginx flavor (ws=nginx) instead of apache. Fixes DOCS-642. > This PR was created with AI assistance (Coder Agents). --- docs/tutorials/reverse-proxy-nginx.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/tutorials/reverse-proxy-nginx.md b/docs/tutorials/reverse-proxy-nginx.md index c6053a8de9a42..a1d0d6764ddea 100644 --- a/docs/tutorials/reverse-proxy-nginx.md +++ b/docs/tutorials/reverse-proxy-nginx.md @@ -54,7 +54,7 @@ you're using `coder.example.com` as your subdomain. ## Install and configure LetsEncrypt Certbot 1. Install LetsEncrypt Certbot: Refer to the - [CertBot documentation](https://certbot.eff.org/instructions?ws=apache&os=ubuntufocal&tab=wildcard). + [CertBot documentation](https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal&tab=wildcard). Be sure to pick the wildcard tab and select your DNS provider for instructions to install the necessary DNS plugin. @@ -134,7 +134,7 @@ providers, refer to the proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_set_header X-Forwarded-Proto $scheme; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; } }