# Does rclone serve s3 not support using subdirectories as a reverse proxy?

**URL:** <https://forum.rclone.org/t/does-rclone-serve-s3-not-support-using-subdirectories-as-a-reverse-proxy/54111>\
**Category:** Help and Support\
**Created:** [August 6, 2026, 4:19am UTC](https://forum.rclone.org/t/does-rclone-serve-s3-not-support-using-subdirectories-as-a-reverse-proxy/54111 "2026-08-06T04:19:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tty725](https://forum.rclone.org/user_avatar/forum.rclone.org/tty725/32/21678_2.png) [@Tty725](https://forum.rclone.org/u/Tty725)\
**Post date:** [August 6, 2026, 4:19am UTC](https://forum.rclone.org/t/does-rclone-serve-s3-not-support-using-subdirectories-as-a-reverse-proxy/54111/1 "2026-08-06T04:19:05Z")

</div>

In nginx, I set up a reverse proxy with the URI `/s3/`, but I get an error when using it.

```auto
PS D:Downloads> rclone lsd myS3:
2026/08/06 12:11:55 ERROR : error listing: operation error S3: ListBuckets, https response error StatusCode: 403, RequestID: , HostID: , api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
2026/08/06 12:11:55 NOTICE: Failed to lsd with 2 errors: last error was: operation error S3: ListBuckets, https response error StatusCode: 403, RequestID: , HostID: , api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.

```

rclone serve s3

```auto
2026/08/06 12:11:55 INFO : serve s3: Access Denied: 127.0.0.1:50612 => /?x-id=ListBuckets

```

But using `/` works fine, and that's the only difference in the configuration.

Do I still need to set up anything extra?

---

<div class="post-metadata">

**Author:** ![ncw](https://forum.rclone.org/user_avatar/forum.rclone.org/ncw/32/18_2.png) [@ncw](https://forum.rclone.org/u/ncw)\
**Post date:** [August 7, 2026, 3:20pm UTC](https://forum.rclone.org/t/does-rclone-serve-s3-not-support-using-subdirectories-as-a-reverse-proxy/54111/2 "2026-08-07T15:20:33Z")

</div>

Hi @Tty725

This isn't currently supported.

The problem is that the client literally signs the request it uses to access the s3 service, and by the time it has got to gofakes3 it has changed.

To get it working we'd need to do a bit of plumbing in the gofakes3 library we use.

The standard work-around would be to use a subdomain e.g. `s3.example.com` (which is in fact what MinIO and friends recommend).

Some things you should bear in mind with nginx (not that they will fix the problem but if it is ever going to work...)

1. nginx must not re-normalize the path: `proxy_pass` with any URI component makes nginx decode/re-encode, which breaks signatures on keys containing `+`, `=`, spaces, etc. `proxy_pass http://127.0.0.1:PORT;` with no URI passes it byte-for-byte.
2. `Host` is a signed header, so either `proxy_set_header Host $http_host;` or leave the SDK to sign the backend host.
3. Don't add/modify anything in the `SignedHeaders` list.

Let me know if the subdomain will work for you, if not I'll have a go at a fix.

---

<div class="post-metadata">

**Author:** ![system](https://forum.rclone.org/uploads/default/original/2X/3/39ad3235f6ffec76ccd0c81616bd55697b4c300d.png) [@system](https://forum.rclone.org/u/system)\
**Post date:** [September 6, 2026, 3:20pm UTC](https://forum.rclone.org/t/does-rclone-serve-s3-not-support-using-subdirectories-as-a-reverse-proxy/54111/3 "2026-09-06T15:20:39Z")

</div>

Closed on September 6, 2026, 3:20pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.