Nginx + Lets Encrypt + Https redirect

Question

I've spent the last few hours trying to understand what is happening with the nginx location documentation and questions by other people on serverfault (like this one). From everything I gathered, my solution should work, but it just doesn't.

So as the title says, I'd like to configure nginx such that it will serve the challange file that acme.sh creates, but redirect everything else to a specific https domain of mine configured in the same server (this one works perfectly fine).

My server block:

server {
    listen      80 default_server;
    listen [::]:80 default_server;
    server_name _;
    root /usr/share/nginx/html;

    location ^~ /.well-known/acme-challenge/ {
        try_files $uri /;
    }
    location / {
        return 301 https://example.com$request_uri;
    }
}

For testing purposes, I've created a file myself in this directory: /usr/share/nginx/html/.well-known/acme-challange/somefile. The testing curl command: curl http://example.com/.well-known/acme-challange/somefile

Problem is: No matter which request, everything is always redirected. The moment I remove the / location block, however, the curl command will give me the contents of my test file. Obviously no redirects will be done in that case.

From the nginx documentation, my understanding is with the modifier I put, once the acme prefix matches (which it obviously does since it works when it is the only location block), it should not try to match anything else. I've also tried simply removing the try_files directive, but it makes no difference. Instead of return 301 ... I've also tried to do a rewrite, which also has the exact same behavior: There will always be a redirect no matter which URI is used.

For some reason the / location block is always used once it's there, even if there are more specific locations that match and even if said locations have the ^~ modifier.

Another variant I just tried:

server {
    listen      80 default_server;
    listen [::]:80 default_server;
    server_name _;
    root /usr/share/nginx/html;
    location /.well-known/acme-challenge/ {
        try_files $uri =404;
    }
    return 301 https://example.com$request_uri;
}

Very similar behavior: If the return is present -> redirect. If I comment it out: my test file is served to me with the curl call. One curious thing is that I cannot move the root directive inside the location blocks. If I do, nginx starts to look for files in /etc/nginx/html, which is apparently the default root, and will throw an error in the logs ("no such file or directory") when I do the http request.

Btw, I did not remove anything from this server block, I just changed the domain name to example.com. It is also the only server block listening on port 80 and no other configs are included in the file. Of course, after every change, I also restarted the nginx service. If it matters, my nginx version is 1.18.0

Output of nginx -T as requested in comments (domain name was changed and mime.types file was cut due to character limits here):

2021/04/23 02:21:00 [warn] 88558#88558: could not build optimal types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user html;
worker_processes  auto;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include mime.types;
    default_type application/octet-stream;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES128+EECDH:AES256+EECDH:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256";
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ecdh_curve secp384r1:prime256v1;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    gzip  on;

    # for certificate verification
    server {
        listen      80 default_server;
        listen [::]:80 default_server;
        server_name _;
        root /usr/share/nginx/html;
        location /.well-known/acme-challenge/ {
            try_files $uri =404;
        }
        #return 301 https://example.com$request_uri;
    }

    server {
        listen       443 ssl http2;
        listen  [::]:443 ssl http2;
        server_name  example.com;
        ssl_certificate ssl/example.com.crt;
        ssl_certificate_key ssl/example.com.key;

        #access_log  logs/host.access.log  main;

        root   /usr/share/nginx/html;
        index index.html index.php;
        location / {
            fastcgi_param SCRIPT_FILENAME $document_root/src/index.php;
            include fastcgi_params;
            # override SCRIPT_NAME which was set in fastcgi_params
            fastcgi_param SCRIPT_NAME /src/index.php;
            fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
        }
        location /public/ {
            allow all;
        }
        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        #error_page   500 502 503 504  /50x.html;
        #location = /50x.html {
        #    root   /usr/share/nginx/html;
        #}
    }
}


# configuration file /etc/nginx/mime.types:
types {
 #REMOVED BECAUSE OF CHARACTER LIMIT
}

# configuration file /etc/nginx/fastcgi_params:

fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

Answer 1

I made this to work with the following vhost configuration:

server {
    listen 80;

    server_name example.com;

    location /.well-known/ {
        root /whatever/i/specified/in/certbot/-d/argument;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

(the SSL vhost configuration is not important here)

What is different from yours is that I have root inside location. This setup works very well on multitude of reverse proxy and origin servers.