Nginx 反向代理到启用了 Apache SSL 的站点

Question

我有一个与此处发布的问题非常相似的问题

使用 Nginx 代理通道（反向代理）为 Apache 托管的站点提供 SSL 服务

服务器 1 - 带有 nginx 和其自己的 SSL 证书的邮件服务器（mail.mydomain.com） 服务器 2 - 带有 apache 和其自己的 SSL 证书的 nextcloud（cloud.mydomain.com）

如果将我的 80/443 端口转发路由器更改为其内部 IP，则两个站点都可以正常工作。

我想使用 nginx 转发/反向代理 nextcloud 网站，但我不确定如何做到这一点。

server {
 listen 80;
 listen [::]:80;
 server_name mail.mydomain.com;

 return 301 https://$server_name$request_uri;
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name mail.mydomain.com;
    root /usr/share/nginx/roundcubemail/;
    index index.php index.html index.htm;

  error_log /var/log/nginx/roundcube.error;
  access_log /var/log/nginx/roundcube.access;

  location / {
    try_files $uri $uri/ /index.php;
  }

  location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
    deny all;
  }
  location ~ ^/(bin|SQL)/ {
    deny all;
  }

  location ~ \.php$ {
   try_files $uri =404;
    fastcgi_pass unix:/run/php/php7.3-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
  }

  location ~ /.well-known/acme-challenge {
    allow all;
  }

          ####################################################################
          # SSL Stuff
          # https://mozilla.github.io/server-side-tls/ssl-config-generator/
          ####################################################################
          

          # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
          ssl_certificate           /etc/letsencrypt/live/mydomain.com/fullchain.pem;
          ssl_certificate_key       /etc/letsencrypt/live/mydomain.com/privkey.pem;
          ssl_session_timeout 1d;
          ssl_session_cache shared:SSL:50m;
          ssl_session_tickets off;


          # modern configuration. tweak to your needs.
          ssl_protocols TLSv1.2;
          ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
          ssl_prefer_server_ciphers on;

          # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
          add_header Strict-Transport-Security " max-age=15768000";

          # OCSP Stapling ---
          # fetch OCSP records from URL in ssl_certificate and cache them
         ssl_stapling on;
          ssl_stapling_verify on;


      ###################################
          # REVERSE PROXY LOCATION SETTINGS #
          ###################################
          location /calibre/ {
                proxy_pass http://192.168.1.83:8084/;
                proxy_set_header     Host            $host ;
                proxy_set_header     X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-Proto $scheme;
                add_header              Front-End-Https        on;
                proxy_redirect       off;
          }

          ##########################################################
          # Sonarr needs additional config regarding reverse proxy
          # Settings -> General -> URL Base: /sonarr
          ##########################################################
          location /sonarr/ {
                proxy_pass http://192.168.1.77:8989;
                proxy_set_header     Host            $host;
                proxy_set_header     X-Real-IP       $remote_addr;
                proxy_set_header     X-Forwarded-For      $proxy_add_x_forwarded_for;
          }

 location /sabnzbd/ {
                proxy_pass http://192.168.1.77:8080;
                proxy_set_header     Host            $host ;
                proxy_set_header     X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-Proto $scheme;
                add_header              Front-End-Https        on;
                proxy_redirect       off;
    }


}

让 cloud.mydomain.com 工作的唯一方法是创建一个指向其内部 IP 的主机条目（显然这只在内部网络上有效）

我需要对我的 nginx 配置做什么？