Nginx reverse proxy for Ghost: HTTPS, the url setting and redirect loops

Ghost listens on port 2368, and it’s designed to have a proxy in front. There’s only one thing to get right: Ghost must know its public address, and that the visitor came over HTTPS. Otherwise, you get a redirect loop or broken links.

The Nginx Config Generator with these options writes this for your domain.

The config

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Themes and images are uploaded through this, so the default 1 MB isn't enough.
    client_max_body_size 50m;

    location / {
        proxy_pass http://127.0.0.1:2368;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

cd /var/www/ghost
ghost config url https://example.com
ghost restart

{
  "url": "https://example.com",
  "server": {
    "host": "127.0.0.1",
    "port": 2368
  }
}

sudo certbot certonly --standalone -d example.com \
  --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
curl -I https://example.com/

services:
  ghost:
    image: ghost:5-alpine
    restart: unless-stopped
    ports:
      - "127.0.0.1:2368:2368"
    environment:
      url: https://example.com
      database__client: mysql
      database__connection__host: db
      database__connection__user: ghost
      database__connection__password: ${DB_PASSWORD}
      database__connection__database: ghost
    volumes:
      - ghost:/var/lib/ghost/content
    depends_on:
      db:
        condition: service_healthy

  db:
    image: mysql:8.4
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ghost
      MYSQL_USER: ghost
      MYSQL_PASSWORD: ${DB_PASSWORD}
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent"]
      interval: 10s
      retries: 10
    volumes:
      - db:/var/lib/mysql

volumes:
  ghost:
  db:

When it goes wrong

ERR_TOO_MANY_REDIRECTS. Ghost’s url says https://, and it thinks the request was plain HTTP. Check that the line proxy_set_header X-Forwarded-Proto $scheme; is there. If there’s another proxy in front, Nginx’s $scheme is http, so pass on that proxy’s value. More in Too many redirects.

Links or images point at localhost:2368, or the old domain. The url setting is wrong. Fix it, and restart Ghost.

413 Request Entity Too Large when uploading a theme or an image. Raise client_max_body_size: see Nginx 413.

502 Bad Gateway. Ghost isn’t running, which you can check with ghost status or ghost log, or it’s on another port: see Nginx 502.

Ghost-CLI says Ghost is running on an unsupported node version. Each Ghost release supports certain versions of Node.js, so check Ghost’s documentation before upgrading Node.js.

The Ghost admin at /ghost gives a 404, or won’t load. Something in front is rewriting or caching that path. Test directly with curl -I http://127.0.0.1:2368/ghost/.