btcpay: fix https://github.com/btcpayserver/btcpayserver/issues/1040

BTCPayServer/BTCPayServer_on_the_RaspiBlitz.md

@@ -177,6 +177,54 @@ The username is raspibolt and the password is what you set while installing rasp
 ```
 ## start of Nginx config
 
+# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
+# scheme used to connect to this server
+map $http_x_forwarded_proto $proxy_x_forwarded_proto {
+  default $http_x_forwarded_proto;
+  ''      $scheme;
+}
+# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
+# server port the client connected to
+map $http_x_forwarded_port $proxy_x_forwarded_port {
+  default $http_x_forwarded_port;
+  ''      $server_port;
+}
+# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
+# Connection header that may have been passed to this server
+map $http_upgrade $proxy_connection {
+  default upgrade;
+  '' close;
+}
+# Apply fix for very long server names
+#server_names_hash_bucket_size 128;
+# Prevent Nginx Information Disclosure
+server_tokens off;
+# Default dhparam
+# Set appropriate X-Forwarded-Ssl header
+map $scheme $proxy_x_forwarded_ssl {
+  default off;
+  https on;
+}
+
+gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+log_format vhost '$host $remote_addr - $remote_user [$time_local] '
+                 '"$request" $status $body_bytes_sent '
+                 '"$http_referer" "$http_user_agent"';
+access_log off;
+# HTTP 1.1 support
+proxy_http_version 1.1;
+proxy_buffering off;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $proxy_connection;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
+proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+# Mitigate httpoxy attack (see README for details)
+proxy_set_header Proxy "";
+
 server {
     listen 80 default_server;
     server_name _;

BTCPayServer/README.md

@@ -17,7 +17,7 @@ To download and run:
 `wget https://raw.githubusercontent.com/openoms/bitcoin-tutorials/master/BTCPayServer/btcpay_to_blitz.sh && bash btcpay_to_blitz.sh`
 
 
-### [Manual instructions](BTCPayServer/BTCPayServer_on_the_RaspiBlitz.md)
+### [Manual instructions](/BTCPayServer/BTCPayServer_on_the_RaspiBlitz.md)
 
 ### Setting up BTCPayServer
 

BTCPayServer/btcpay_to_blitz.sh

@@ -172,6 +172,55 @@ sudo ufw allow 443
 sudo rm -f /etc/nginx/sites-enabled/default
 
 echo "
+# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
+# scheme used to connect to this server
+map \$http_x_forwarded_proto \$proxy_x_forwarded_proto {
+  default \$http_x_forwarded_proto;
+  ''      \$scheme;
+}
+# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
+# server port the client connected to
+map \$http_x_forwarded_port \$proxy_x_forwarded_port {
+  default \$http_x_forwarded_port;
+  ''      \$server_port;
+}
+# If we receive Upgrade, set Connection to \"upgrade\"; otherwise, delete any
+# Connection header that may have been passed to this server
+map \$http_upgrade \$proxy_connection {
+  default upgrade;
+  '' close;
+}
+# Apply fix for very long server names
+#server_names_hash_bucket_size 128;
+# Prevent Nginx Information Disclosure
+server_tokens off;
+# Default dhparam
+# Set appropriate X-Forwarded-Ssl header
+map \$scheme \$proxy_x_forwarded_ssl {
+  default off;
+  https on;
+}
+
+gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+log_format vhost '\$host \$remote_addr - \$remote_user [\$time_local] '
+                 '\"\$request\" \$status \$body_bytes_sent '
+                 '\"\$http_referer\" \"\$http_user_agent\"';
+access_log off;
+# HTTP 1.1 support
+proxy_http_version 1.1;
+proxy_buffering off;
+proxy_set_header Host \$http_host;
+proxy_set_header Upgrade \$http_upgrade;
+proxy_set_header Connection \$proxy_connection;
+proxy_set_header X-Real-IP \$remote_addr;
+proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto \$proxy_x_forwarded_proto;
+proxy_set_header X-Forwarded-Ssl \$proxy_x_forwarded_ssl;
+proxy_set_header X-Forwarded-Port \$proxy_x_forwarded_port;
+# Mitigate httpoxy attack (see README for details)
+proxy_set_header Proxy \"\";
+
+
 server {
     listen 80 default_server;
     server_name _;