# Server configuration with reverse proxy returns timeout and proxy errors

**URL:** <https://forum.getodk.org/t/server-configuration-with-reverse-proxy-returns-timeout-and-proxy-errors/33868>\
**Category:** Support\
**Tags:** odk-central\
**Created:** [June 8, 2021, 3:07pm UTC](https://forum.getodk.org/t/server-configuration-with-reverse-proxy-returns-timeout-and-proxy-errors/33868 "2021-06-08T15:07:15Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![yanokwa](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/yanokwa/32/1695_2.png) [@yanokwa](https://forum.getodk.org/u/yanokwa)\
**Post date:** [June 8, 2021, 4:02pm UTC](https://forum.getodk.org/t/server-configuration-with-reverse-proxy-returns-timeout-and-proxy-errors/33868/2 "2021-06-08T16:02:08Z")

</div>

Hi @jary! Thanks for laying the groundwork for the upstream SSL features we added to Central v1.2.

Your `.env` file looks fine to me. I have a very similar config with an nginx proxy routing traffic to two servers. The proxy's nginx config is embedded below. The only difference seems to be I route everything over HTTP, but then in Central's nginx config, we set [X-Forwarded-Proto to HTTPS](https://github.com/getodk/central/blob/master/files/nginx/odk-setup.sh#L31) to https.

> **nginx.conf**
>
> ```auto
> server {
> server_name prod.central.example.com;
> location / {
> proxy_pass http://0.0.0.0:8080;
> }
> listen [::]:443 ssl;
> listen 443 ssl;
> ssl_certificate /etc/ssl/certs/example.com.crt;
> ssl_certificate_key /etc/ssl/certs/example.com.key;
> ssl_trusted_certificate /etc/ssl/certs/example.com.pem;
> ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
> ssl_prefer_server_ciphers on;
> ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
> ssl_dhparam /etc/dh/nginx.pem;
> }
> 
> server {
> server_name test.central.example.com
> location / {
> proxy_pass http://0.0.0.0:9080;
> }
> listen [::]:443 ssl;
> listen 443 ssl;
> ssl_certificate /etc/ssl/certs/example.com.crt;
> ssl_certificate_key /etc/ssl/certs/example.com.key;
> ssl_trusted_certificate /etc/ssl/certs/example.com.pem;
> ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
> ssl_prefer_server_ciphers on;
> ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
> ssl_dhparam /etc/dh/nginx.pem;
> }
> 
> server {
> if ($host = prod.central.example.com) {
> return 301 https://$host$request_uri;
> }
> if ($host = test.central.example.com) {
> return 301 https://$host$request_uri;
> }
> listen 80 ;
> listen [::]:80 ;
> server_name prod.central.example.com test.central.example.com;
> return 404;
> }
> 
> ```

What happens if you disable your on-machine firewall entirely as described at [https://docs.getodk.org/central-upgrade/#upgrading-to-central-v0-9](https://docs.getodk.org/central-upgrade/#upgrading-to-central-v0-9)? iptables interacts with Docker in strange ways...

Is there any chance you are using an external database? Maybe with special characters in the password? If so, see [Connection timeout after upgrading to Central v1.2 - #5 by Matthew\_White](https://forum.getodk.org/t/connection-timeout-after-upgrading-to-central-v1-2/33690/5)

Are there any other changes to your `~/central` directory?

---

_[View the full topic](https://forum.getodk.org/t/server-configuration-with-reverse-proxy-returns-timeout-and-proxy-errors/33868)._