I have a fresh install of 9.0.2 CE, and syncing is working with Seafile clients. One issue I haven’t been able to figure out is getting 403 Forbidden responses on anything coming from the /media path. It mostly works correctly if I access the UI through the IP and port instead of the domain (the avatars aren’t loading even this way though, I did double-check the symlink). I suspect the referrer policy might be to blame (strict-origin-when-cross-origin), and I’ve been messing with my nginx and Seafile/Seahub configs but as far as I can tell they are configured correctly. Any ideas?
Thanks!
Nginx Config:
# Seafile configuration
#
log_format seafileformat '$http_x_forwarded_for $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $upstream_response_time';
server {
server_name mysubdomain.mydomain.com;
proxy_set_header X-Forwarded-For $remote_addr;
location / {
proxy_pass http://localhost:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_read_timeout 1200s;
client_max_body_size 0;
access_log /var/log/nginx/seahub.access.log seafileformat;
error_log /var/log/nginx/seahub.error.log;
}
location /seafhttp {
rewrite ^/seafhttp(.*)$ $1 break;
proxy_pass http://127.0.0.1:8082;
client_max_body_size 0;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 36000s;
proxy_read_timeout 36000s;
proxy_send_timeout 36000s;
proxy_request_buffering off;
send_timeout 36000s;
access_log /var/log/nginx/seafhttp.access.log seafileformat;
error_log /var/log/nginx/seafhttp.error.log;
}
location /media {
root /home/myusername/seafile/seafile-server-latest/seahub;
access_log /var/log/nginx/media.access.log seafileformat;
error_log /var/log/nginx/media.error.log;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/mysubdomain.mydomain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/mysubdomain.mydomain.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = mysubdomain.mydomain.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name mysubdomain.mydomain.com;
listen 80;
return 404; # managed by Certbot
}
