Issue with setting up a custom domain for droplet

Heya,

Your current nginx configuration file for pocketbase.artdots.co has several issues that might be causing the problems you’re facing. Here’s an analysis of the key areas and suggestions to resolve the issues:

Missing SSL Files or Permissions

• Cause: Incorrect or inaccessible SSL certificate and key files can cause the HTTPS server block to fail.
• Fix: Verify the paths and permissions of ssl_certificate and ssl_certificate_key

ls -l /etc/ssl/certs/certificate.pem
ls -l /etc/ssl/private/private.key

nsure they are readable by the nginx user.

CORS Headers Repeated Inside OPTIONS Blocks

• Cause: You’re adding CORS headers twice: globally and inside OPTIONS blocks. This redundancy can cause confusion.
• Fix: Since you already have global CORS headers (add_header Access-Control-Allow-*;) outside location blocks, remove the duplicates from the OPTIONS sections.

Incorrect Handling of OPTIONS Requests

• Cause: Preflight OPTIONS requests are being conditionally handled but not properly matched.
• Fix: Use a dedicated location block for OPTIONS requests:

location / {
    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Origin, Content-Type, Accept, Authorization";
        add_header Content-Length 0;
        add_header Content-Type text/plain;
        return 204;  # No Content
    }
    # Other rules go here...
}

Conflicting location Blocks

• Cause: The = location for /api/collections/waiting_list/records will only match exactly that path, while the ~ regex for /api/collections/(artists|artworks)/records may cause unexpected behavior.
• Fix: Change the strict match (=) to a prefix match (^~) for consistency:

location ^~ /api/collections/waiting_list/records {
    # POST-specific rules
}

---

Improved Configuration

Here is the revised configuration:

server {
    listen 80;
    server_name pocketbase.artdots.co;

    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name pocketbase.artdots.co;

    # SSL configuration
    ssl_certificate /etc/ssl/certs/certificate.pem;
    ssl_certificate_key /etc/ssl/private/private.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'HIGH:!aNULL:!MD5';
    ssl_prefer_server_ciphers on;

    # Global CORS headers
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
    add_header Access-Control-Allow-Headers "Origin, Content-Type, Accept, Authorization";

    # Handle POST requests for waiting_list
    location ^~ /api/collections/waiting_list/records {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Handle GET requests for artists and artworks
    location ~ ^/api/collections/(artists|artworks)/records {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Default location block for all other requests
    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Test and troubleshoot

1. Test the nginx configuration:

nginx -t 
systemctl reload nginx

2. Verify your Pocketbase server at http://127.0.0.1:8090 is running and accessible locally.
3. Check DNS propagation for pocketbase.artdots.co.
4. Use a tool like curl to verify HTTP and HTTPS responses:

curl -X OPTIONS https://pocketbase.artdots.co/api/collections/waiting_list/records 
curl -X GET https://pocketbase.artdots.co/api/collections/artists/records`

5. Monitor logs for errors:

`` tail -f /var/log/nginx/access.log /var/log/nginx/error.log

Let me know how it goes!