LetsEncrypt Fails When Force SSL is On

[MeCJay12]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug
Running NPM behind an Nginx reverse proxy on port 80 (not 443). This is so that Nginx can dynamically redirect LetsEncrypt challenges to any domain rather than having to enter every domain.sub-domain into HAProxy on my router. When behind Nginx, NPM is upgrading LetsEncrypt challenges to HTTPS when the Force SSL switch is on. When switch is off, LetsEncrypt works correctly.

Nginx Proxy Manager Version
v2.9.18

To Reproduce
NPM:

docker run -d \
	--restart always \
	--network better_bridge \
	--name NPM \
	-p 80:80 \
	-p 81:81 \
	-p 443:443 \
	-v /mnt/Docker/NPM/data/:/data/ \
	-v /mnt/Docker/NPM/certs/:/etc/letsencrypt/ \
	-v /mnt/Docker/NPM/conf.d/resolvers.conf:/etc/nginx/conf.d/include/resolvers.conf:ro \
    -e DB_MYSQL_HOST="MySQL." \
    -e DB_MYSQL_PORT=3306 \
    -e DB_MYSQL_USER="NPM" \
    -e DB_MYSQL_PASSWORD="password" \
    -e DB_MYSQL_NAME="NPM" \
	-e X_FRAME_OPTIONS="sameorigin" \
	-e TZ="America/New_York" \
	jc21/nginx-proxy-manager

For questions about the resolvers mount see here.

No config in Custom Locations or Advanced; Most importantly, Force SSL is on:

Nginx proxy in front of NPM:

docker run -d \
	--restart always \
	--network better_bridge \
	-p 82:80 \
	--name Nginx \
	-v /mnt/Docker/Nginx/:/etc/nginx/conf.d/:ro \
	nginx

Where the conf file mounted is:

server {
        listen 80;
        listen [::]:80;

        resolver 127.0.0.11 valid=10s;

        location ^~ /.well-known/acme-challenge/ {
                proxy_pass http://$host$request_uri;
        }

        location / {
                return 301 https://$host$request_uri;
        }
}

Otherwise, pot 80 on my firewall is forwarded to port 82 on my docker host. The ideal flow is ext_ip:80 -> docker:82 -> Nginx container -> NPM which is working but when I pcap my bridge network while running a LetsEncrypt renewal (dry-run) I see the LE challenges being upgraded to HTTPS and the client is reporting a timeout:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/npm-10.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Simulating renewal of an existing certificate for oc.example.com

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
  Domain: oc.example.com
  Type:   connection
  Detail: 1.2.3.4: Fetching https://oc.example.com/.well-known/acme-challenge/YbSLIC2rTEvvQKGEoM2Q5WeNWIfmsJdgS0h6BbPie3w: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Failed to renew certificate npm-10 with error: Some challenges have failed.

Expected behavior
LetsEncrypt should be able to renew certs behind another Nginx proxy.

Operating System
Ubuntu 20

[Schlumpf9]

push, btw duplicate #1625

[MeCJay12]

Whoops