> Markdown version of https://yucca.app/en/docs/guides/Nginx/. Documentation index: [llms.txt](https://yucca.app/en/llms.txt), full text in one file: [llms-full.txt](https://yucca.app/en/llms-full.txt). Any page is available as Markdown: append `.md` to its URL without the trailing slash.
# Setting up Nginx + Let's Encrypt reverse proxy in front of Yucca
## Introduction
In this guide I will describe how to set up Nginx and issue a Let's Encrypt SSL certificate that will renew automatically. Nginx will act as a simple web server in front of Yucca for terminating the SSL session and redirecting from port 80 to port 443.
Why install Nginx at all, since Yucca itself can terminate SSL and even has [flags](https://yucca.app/en/docs/configuration.md#cert_file) for it? That's true, but once you occupy port 443, it will be unavailable to other software and you'll have to use a different one, and there will also be no redirect from HTTP to HTTPS — if that's fine with you, you can safely skip the Nginx installation and configuration section, Step 1, and go straight to Step 2.
I'll perform all the steps on Ubuntu Server 22.04, but everything will work the same way on SUSE, CentOS, Fedora, Debian, and so on. The only difference is that everyone has their own package manager, but I hope you can tell apt from zypper 🙂
## Step 0. Preparation
So, here's what we'll need:
1. A host with a public IP address
2. A domain or subdomain pointing to that address
3. [Yucca installed](https://yucca.app/en/docs/install.md)
In this guide I'll use the domain `foobar.yuccastream.com`, your domain will be different.
```sh
nslookup foobar.yuccastream.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: foobar.yuccastream.com
Address: 128.140.2.103
```
[](https://yucca.app/en/assets/files/nginx1-f71285a8a03081e772a4456d3f3b9241.png)
So, I have Yucca, which is available at `http://foobar.yuccastream.com:9910`
## Step 1. Installing and configuring Nginx
Install nginx:
```sh
sudo apt install nginx
```
Check `http://foobar.yuccastream.com`
[](https://yucca.app/en/assets/files/nginx2-e7de29f0a6cc5a16824219d0540ab0f1.png)
Next, create a configuration file for Yucca:
```sh
sudo nano /etc/nginx/conf.d/yucca.conf
```
> **Warning.** You need to replace the domain `foobar.yuccastream.com` with your own
```sh
upstream yucca_upstream {
server 127.0.0.1:9910 fail_timeout=0;
}
server {
listen 80;
server_name foobar.yuccastream.com;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://yucca_upstream;
}
}
```
Save the file and check that the configuration is correct:
```sh
sudo nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```
If everything is correct, you will see *syntax is ok* Reload the nginx configuration:
```sh
nginx -s reload
```
Refresh the page and you'll already see the Yucca web interface at `http://foobar.yuccastream.com`
[](https://yucca.app/en/assets/files/nginx3-4ca009416e84aca46f3096bd20af3521.png)
## Step 2. Installing Certbot and issuing a Let's Encrypt certificate
Install the packages:
```sh
sudo apt install certbot python3-certbot-nginx
```
Issue a certificate for our domain:
> **Warning.** You need to replace the domain `foobar.yuccastream.com` with your own
```sh
sudo certbot --nginx -d foobar.yuccastream.com
```
[](https://yucca.app/en/assets/files/nginx4-257ee55cf8f90940b2c91fc87749bcb0.png)
Certbot will ask for an E-mail (1); I recommend entering your real mailbox, in case the certificate is about to expire and fails to renew automatically, Let's Encrypt will send you a notification about it. You'll also need to agree to the terms and conditions (2), (3). Next, certbot will find the correct configuration file with the required domain on its own, configure the SSL section and the redirect, and show you a link at the end. You can see what the result looks like in the file `/etc/nginx/conf.d/yucca.conf`
```sh
upstream yucca_upstream {
server 127.0.0.1:9910 fail_timeout=0;
}
server {
server_name foobar.yuccastream.com;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://yucca_upstream;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/foobar.yuccastream.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/foobar.yuccastream.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = foobar.yuccastream.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name foobar.yuccastream.com;
return 404; # managed by Certbot
}
```
I recommend making sure that certbot has created a timer for renewing the certificate; it should be active:
```sh
sudo systemctl status certbot.timer
● certbot.timer - Run certbot twice daily
Loaded: loaded (/lib/systemd/system/certbot.timer; enabled; vendor preset: enabled)
Active: active (waiting) since Fri 2023-09-22 11:54:02 UTC; 7min ago
Trigger: Fri 2023-09-22 14:13:25 UTC; 2h 11min left
Triggers: ● certbot.service
Sep 22 11:54:02 foobar systemd[1]: Started Run certbot twice daily.
```
Refresh the page `http://foobar.yuccastream.com` and you'll see everything already working over HTTPS, and the redirect works too.
[](https://yucca.app/en/assets/files/nginx5-8a3f66842bdeabfcf25bef14aa513371.png)
## Step 3. Security configuration
We've set up access via HTTPS through nginx, but Yucca is still available over HTTP at `http://foobar.yuccastream.com:9910`. This is due to this default setting:
```sh
listen_address = ":9910"
```
Go to the Yucca configuration file and edit this parameter:
```sh
sudo nano /opt/yucca/yucca.toml
```
Make Yucca listen on localhost only:
```sh
listen_address = "127.0.0.1:9910"
```
And restart the Yucca server:
```sh
sudo systemctl restart yucca
```
Check that now there's nothing at `http://foobar.yuccastream.com:9910`, while `https://foobar.yuccastream.com` works fine.