Setting Up Motion Software for HTTPS Streaming with Nginx Reverse Proxy

Setting up Motion (a software motion detector) behind an Nginx reverse proxy on a Linux system involves several steps. Here's a guide to get you started. This guide assumes you have basic knowledge of Linux, Nginx,  and networking.

Prerequisites
Linux Server: A server with a Linux distribution installed.
Nginx: Make sure Nginx is installed and running.
Motion: Install Motion on your server.
Domain Name (Optional): For accessing your Motion setup via a domain.

Step 1: Configure Nginx as a Reverse Proxy
Create an Nginx Configuration File:
Create a new file in /etc/nginx/conf.d/ or /etc/nginx/sites-available/ (depending on your Nginx setup). Name it motioneye.conf or something similar.

Edit the Configuration File:
Here’s a basic example configuration. Adjust as needed, especially if you're using SSL or a specific domain name.

server {
   listen 80;
   server_name your_motioneye_domain.com;
   location / {
       proxy_pass http://localhost:xxxx/;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
   }
}

Replace your_motioneye_domain.com with your domain or IP address, replace xxxx with the port number of the camera you want to setup https for.

Enable the Configuration:
If you placed the configuration in /etc/nginx/sites-available/, create a symlink to /etc/nginx/sites-enabled/.

sudo ln -s /etc/nginx/sites-available/motioneye.conf /etc/nginx/sites-enabled/

Check Nginx Configuration:
Validate your Nginx configuration with:

sudo nginx -t

Reload Nginx:
Apply the changes by reloading Nginx:

sudo systemctl reload nginx

Step 2: Secure Your Setup

Setting up an SSL certificate for your Nginx server involves several steps. A common approach is to use Let's Encrypt, a free, automated, and open Certificate Authority. The Certbot tool from the Electronic Frontier Foundation (EFF) makes obtaining and installing Let's Encrypt certificates relatively straightforward. Below is a guide on how to set this up:

2.1 Install Certbot
The first step is to install Certbot and its Nginx plugin. The installation steps might vary depending on your Linux distribution. For Ubuntu/Debian systems, you can use:

sudo apt update
sudo apt install certbot python3-certbot-nginx

For other distributions, you can check the Certbot website for specific instructions.

2.2 Obtain and Install the SSL Certificate

Run Certbot with the Nginx plugin to automatically obtain and install a certificate:

sudo certbot --nginx

Certbot will ask for some information and modify your Nginx configuration to use the new certificate.

2.3 Verify Automatic Renewal
Let's Encrypt certificates are valid for 90 days, but Certbot should set up automatic renewal. Check the automatic renewal process with:

sudo certbot renew --dry-run

This command simulates certificate renewal without making any changes.

2.4 Adjust Nginx Configuration (if needed)
Certbot usually modifies your Nginx configuration files correctly, but it's a good practice to check. Open your domain's Nginx configuration file (e.g., /etc/nginx/sites-available/your_domain.conf) and make sure the SSL certificate and key lines point to the Let’s Encrypt certificate:

ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;

2.5 Test Nginx Configuration
After making changes to your Nginx configuration files, always test the configuration:

sudo nginx -t

If there are no errors, restart Nginx to apply the changes:

sudo systemctl restart nginx

2.6 Access Your camera feed using HTTPS
Now, try accessing your camera using https://. It should have a valid SSL certificate.

By following these steps, you should have a working MotionEye camera setup behind an Nginx reverse proxy. This setup enhances security and provides more flexibility in how you access your MotionEye interface.