Self-hosted Docker Stack with Ghost/NGINX/MySQL, SSL broken

Developer help
1

https://www.etcvfx.com
http://www.etcvfx
Ghost v5.115.1
Node v18.20.8
nginx version: nginx/1.27.4
MySQL 8.0+
Cloudflare domain/DNS

Ghost is installed via a Docker Stack in Portainer, ala…

version: '3.8'

services:
  nginx:
    image: nginx:alpine
    container_name: nginx
    ports:
      - "8080:80"
      - "8443:443"
    volumes:
      - /var/lib/docker/volumes/ghost-stack/nginx/default.conf:/etc/nginx/conf.d/default.conf
      - /etc/letsencrypt:/etc/letsencrypt:ro # Read-only access to SSL certificates

    depends_on:
      - ghost
    networks:
      - ghost-net

  mysql:
    image: arm64v8/mysql:8.0   # Switch to MySQL 8 image for aarch64
    container_name: mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: ***
      MYSQL_DATABASE: ghost_db
      MYSQL_USER: ghost
      MYSQL_PASSWORD: ***
    volumes:
      - /var/lib/docker/volumes/ghost-stack/mysql:/var/lib/mysql
    networks:
      - ghost-net

  ghost:
    image: ghost:5-alpine
    container_name: ghost
    restart: always
    environment:
      NODE_ENV: production  # Change to production for the live environment
      url: https://www.etcvfx.com  # Change this to your production HTTPS URL
      #NODE_ENV: development
      #url: http://10.0.0.254:8443   # Change to your desired IP address and port
      database__client: mysql
      database__connection__host: mysql   # Update to MySQL service name
      database__connection__user: ghost
      database__connection__password: ***
      database__connection__database: ghost_db
    volumes:
      - /var/lib/docker/volumes/ghost-stack/ghost/content:/var/lib/ghost/content
      - /etc/letsencrypt:/etc/letsencrypt:ro # Read-only access to SSL certificates
    depends_on:
      - mysql   # Update to MySQL service name
    #healthcheck:
    #  test: ["CMD", "curl", "-f", "http://localhost:2368/health"]
    #  interval: 30s
    #  retries: 5
    networks:
      - ghost-net

networks:
  ghost-net:
    driver: bridge

In its current state, when I go to the url www.etcvfx.com, it simply hangs…
But before that I was getting a lot of 301 errors in some kind of loop. I attempted to address this through the following steps/files.

nginx - default.conf

server {
    listen 80;
    server_name www.etcvfx.com;
    return 301 https://$host$request_uri;  # Redirect HTTP to HTTPS
}
server {
    listen 443 ssl;
    server_name www.etcvfx.com;

    ssl_certificate /etc/letsencrypt/live/www.etcvfx.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.etcvfx.com/privkey.pem;

    location / {
        proxy_pass http://ghost:2368;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Ghost - config.development.json / config.production.json(inside the container)
I can see an obvious issue here… localhost, but for some reason I feel like it keeps reverting to this on it’s own?

  "url": "http://localhost:2368",
  "server": {
    "port": 2368,
    "host": "::"
  },
  "mail": {
    "transport": "Direct"
  },
  "logging": {
    "transports": [
      "file",
      "stdout"
    ]
  },
  "process": "systemd",
  "paths": {
    "contentPath": "/var/lib/ghost/content"
  }
}

I have gone to Cloudflare a few times. Purged the cache, turned off proxy (set to DNS Only), Always Use HTTPS, and set Custom SSL/TLS to Full.

I’ve spent a good amount of time already trying to figure this out and I feel like I have the settings right, I’m just not sure what the issue could be.

I appreciate any help! Thank you all!

2

I think you need to set it to Full (Strict)