Senaite LIMS (Plone 4.3.18) css not working on Nginx with https enabled

Question

I've installed and set up senaite.lims, which is a Plone extension, running on Plone 4.3.18 installed by the Unified Installer, and adding senaite.lims to the buildout.cfg eggs.

It's running fine on port 8080, and I can get Nginx to work redirecting / to :8080, but when I start using https, suddenly the css of the site doesn't work anymore.

I looked at the source, and the produced html page shows a link to the stylesheet with http://.... which I don't know if may cause problems, but if I actually try to open the .css file in the browser it works fine.

I set up and tried both with port 80 redirecting the https, and serving both a version of http and https, but neither one would get the page to render using .css. If anyone has any tips, or sees something wrongly configured in the nginx below, any help would be greatly appreciated.

Here is my nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 768;
}

http {
    default_type  application/octet-stream;
    include /etc/nginx/mime.types;
    sendfile    on;
    keepalive_timeout 75;

    upstream plone {
        server 127.0.0.1:8080;
    }

    server {
        listen              80;
        listen              443 ssl http2;
        server_name         99.99.99.99; # changed for posting on SO
        ssl_certificate     /etc/ssl/certs/nginx-selfsigned.crt;
        ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

        error_log /var/log/nginx/nginx.vhost.error.log;

        location / {
        proxy_pass                http://localhost:8080/;
        proxy_redirect            off;
        proxy_set_header          Host               $host;
        proxy_set_header          X-Real-IP          $remote_addr;
        proxy_set_header          X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header          X-Forwarded-Proto  https;
        proxy_buffer_size         128k;
        proxy_buffers             8 128k;
        proxy_busy_buffers_size   256k;
        }
    }
}

Answer 1

You missed to rewrite the URL, e.g:

rewrite ^(.*)$ /VirtualHostBase/$scheme/$host/senaite/VirtualHostRoot/$1 break;

Here is a complete working config for SENAITE:

server {
    listen 80;
    server_name senaite.mydomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name senaite.mydomain.com;

    # https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04
    include snippets/ssl-senaite.mydomain.com.conf;
    include snippets/ssl-params.conf;
    include snippets/well-known.conf;

    access_log /var/log/nginx/senaite.access.log;
    error_log /var/log/nginx/senaite.error.log error;

    # Allow Cross-Origin Resource Sharing from our HTTP domain
    add_header "Access-Control-Allow-Origin" "http://senaite.ridingbytes.com";
    add_header "Access-Control-Allow-Credentials" "true";
    add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS";
    add_header "X-Frame-Options" "SAMEORIGIN";

    if ($http_cookie ~* "__ac=([^;]+)(?:;|$)" ) {
        # prevent infinite recursions between http and https
        break;
    }
    # rewrite ^(.*)(/logged_out)(.*) http://$server_name$1$2$3 redirect;

    location / {
        set $backend http://haproxy;
        # API calls take a different backend w/o caching
        if ($uri ~* "@@API") {
            set $backend http://api;
        }
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        rewrite                 ^(.*)$ /VirtualHostBase/$scheme/$host/senaite/VirtualHostRoot/$1 break;
        # proxy_pass              $backend;
        proxy_pass              http://plone;
    }
}