How do I fix an infinite redirect loop on a self-hosted nginx server?

Question

I'm learning how to build and host my own website using Python and Flask, but I'm unable to make my website work as I keep getting an infinite redirect loop when I try to access my website through my domain name.

I've made my website using Python, Flask, and Flask-Flatpages. I uploaded the code to GitHub and pulled it onto a Raspberry Pi 4 that I have at my house. I installed gunicorn on the RasPi to serve the website and set up two workers to listen for requests. I've also set up nginx to act as a reverse proxy and listen to requests from outside. Here is my nginx configuration:

server {
    if ($host = <redacted>.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    # listen on port 80 (http)
    listen 80;
    server_name <redacted>.com www.<redacted>.com;
    location ~ /.well-known {
        root /home/pi/<redacted>.com/certs;
    }
    location / {
        # redirect any requests to the same URL but on https
        return 301 https://$host$request_uri;
    }


}

server {
    # listen on port 443 (https)
    listen 443;
    ssl on;
    server_name <redacted>.com www.<redacted>.com;

    # location of the SSL certificate
    ssl_certificate /etc/letsencrypt/live/<redacted>.com/fullchain.pem; # m$
    ssl_certificate_key /etc/letsencrypt/live/<redacted>.com/privkey.pem; #$

    # write access and error logs to /var/log
    access_log /var/log/blog_access.log;
    error_log /var/log/blog_error.log;

    location / {
        # forward application requests to the gunicorn server
        proxy_pass http://localhost:8000;
        proxy_redirect off;
        proxy_set_header X_Forwarded_Proto $scheme;
        proxy_set_header Host $host;

    location /static {
        # handle static files directly, without forwarding to the application
        alias /home/pi/<redacted>.com/blog/static;
        expires 30d;
    }

}

When I access the website by typing in the local IP of the RasPi (I've set up a static IP address in /etc/dhcpcd.conf), the website is served just fine, although it seems like my browser won't recognize the SSL certificate even though Chrome says the certificate is valid when I click on Not Secure > Certificate next to the .

To make the website public, I've forwarded port 80 on my router to the RasPi and set up ufw to allow requests only from ports 80, 443, and 22. I purchased a domain name using GoDaddy, then added the domain to CloudFlare by changing the nameservers in GoDaddy (I'm planning to set up cloudflare-ddns later, which is why I added the domain to CloudFlare in the first place). As a temporary solution, I've added the current IP of my router to the A Record in the CloudFlare DNS settings, which I'm hoping will be the same for the next few days.

My problem arises when I try to access my website via my public domain name. When I do so, I get ERR_TOO_MANY_REDIRECTS, and I suspect this is due to some problem with my nginx configuration. I've already read this post and tried changing my CloudFlare SSL/TLS setting from Flexible to Full (strict). However, this leads to a different problem, where I get a CloudFlare error 522: connection timed out. None of the solutions in the CloudFlare help page seem to apply to my situation, as I've confirmed that:

I haven't blocked any CloudFlare IPs in ufw
The server isn't overloaded (I'm the only one accessing it right now)
Keepalive is enabled (I haven't changed anything from the default, although I'm unsure whether it is enabled by default)
The IP address in the A Record of the DNS Table matches the Public IP of my router (found through searching "What is my IP" on google)

Apologies if there is a lot in here for a single question, but any help would be appreciated!

score 0 · Answer 1 · answered Aug 02 '21 at 16:40

I only see one obvious problem with your config, which is that this block that was automatically added by certbot should probably be removed:

    if ($host = <redacted>.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

Because that behavior is already specified in the location / {} block, and I think the Certbot rule may take effect before the location ~ /.well-known block and break that functionality. I'm not certain about that, and I don't think that would cause the redirects, but you can test the well-known functionality yourself by trying to access http://yourhost.com/.well-known and seeing if it redirects to HTTPS or not.

On that note, the immediate answer to your question is, get more information about what's happening! My next step would be to see what the redirect loop is - your browser may show this in its network requests log, or you can use a command-line tool like curl or httpie or similar to try to access your site via the hostname and see what requests are being made. Is it simply trying to access the same URL over and over, or is it looping through multiple URLs? What are they? What does that point at?

And as a side note, it makes sense that Chrome wouldn't like your certificate when accessing it via IP - certificates are tied to one or more hostnames, so when you're accessing it over an IP address, the hostname doesn't match, so Chrome is probably (correctly) pointing that out and warning you that you're not at the hostname the certificate says you should be at.

How do I fix an infinite redirect loop on a self-hosted nginx server?

1 Answers1