nginx misconfiguration

While troubleshooting an error related to safari users not being able to resolve the site in browser, I came to find that the nginx configuration needs tweaking.

First, I found that there was an error in the nginx logs.

The command docker exec -ti nginx_mattermost watch cat /var/log/nginx/error.log

I kept seeing the error:

No resolver defined to resolve r3.o.lencr.org while requesting certificate status, responder: r3.o.lencr.org

Based on replies to this thread here it seems this is related to OSCP. I notice the latest commit with this file comments out the resolver 1.1.1.1 line. Was this a regressive move?

I've tried to modify the nginx default.conf file unsuccessfully so far.

Using the default config and issuing docker exec -ti nginx_mattermost nginx -t -c /etc/nginx/conf.d/default.conf results in:

nginx: [emerg] "proxy_cache_path" directive is not allowed here in /etc/nginx/conf.d/default.conf:6
nginx: configuration file /etc/nginx/conf.d/default.conf test failed

This brings me to try many variations so far all unsuccessful. Interestingly, this failed config somehow doesn't result in a reboot loop and the image does run as-is.

I'm requesting someone look into the standard docker nginx config. Why was the resolver removed, why does the default config fail, and what should be shifted to ensure the correct configuration passes nginx config test?

Start with the standard Docker nginx default.conf and reproduce the reported check using docker exec -ti nginx_mattermost nginx -t -c /etc/nginx/conf.d/default.conf. Review the nginx error-log command and the recent change that commented out resolver 1.1.1.1. Done means the standard configuration passes nginx config test and the Safari certificate-status resolution issue is addressed.