URL prefix for reverse proxy

[trichner]

Following scenario:

 ______        _______         ______ 
| User | <--> | Host  | <-->  | lwp  |
|      |   443| nginx |   5000|      |    
 ------        -------         ------ 
             Reverse Proxy

Since lwp is not the only HTTPS service, it is desirable to run it with a prefix such as example.com/lxc, otherwise one must have a certificate for a subdomain or run lwp on a different port.

It would be nice if one can configure lwp to run with a specific URL prefix such as '/lxc', otherwise most ressource URLs are broken (e.g. those to example.com/lxc/static/* are example.com/static/*). I realize that this is fixable by rewriting all URLs with rewrite rules in the reverse proxy, but this seems like a workaround and not a solution.

Thoughts? Is this already possible and I didn't find the config option?

[claudyus]

You can try to set value to APPLICATION_ROOT as described here http://stackoverflow.com/questions/18967441/add-a-prefix-to-all-flask-routes

This can be read and set here https://github.com/claudyus/LXC-Web-Panel/blob/master/lwp/app.py#L30, I will merge a PR for that if proposed :)

[lukasraska]

I think APPLICATION_ROOT doesn't work with blueprint-based routes (at least in a way it can be used with nginx). Fortunately, there is url_prefix parameter, which can be used.

There were few issues with routing (bad url generation). I've fixed that, but it seems request object doesn't provide routing argument values (so for now active state in sidebar for containers doesn't work with custom prefix).

@trichner Can you test the version from my branch? If it works for you, I can create PR (I've tested it, but it's possible I missed something)

[trichner]

Thanks for the fast reaction!

A few URLs are not working because of missing prefix:

• https://example.com/_refresh_info (ajax call)
• https://example.com/_refresh_memory_mycontainer (ajax call)
• Static files are not prefixed (intended?), with a second proxy this works fine.

Edit: Refresh seems to be a problem of hardcoded URLs in client code

Edit: my nginx proxy config

server {
    listen 443 default_server;
    listen [::]:443 default_server ipv6only=on;

    # Make site accessible from http://localhost/
    server_name localhost example.com;

    # TLS setup
    ssl on;
    ssl_certificate /etc/nginx/tls/example.com.crt.pem;
    ssl_certificate_key /etc/nginx/tls/host.key;

    # Cipher config
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

    location /lxc/ {
                proxy_pass http://localhost:5000/lxc/;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;

                # Rewrite HTTPS requests from WAN to HTTP requests on LAN
                proxy_redirect http:// https://;
        }

        location /static/ {
                proxy_pass http://localhost:5000/static/;

                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;

                # Rewrite HTTPS requests from WAN to HTTP requests on LAN
                proxy_redirect http:// https://;
        }
}

[lukasraska]

Thanks, I've made some adjustements and it's now properly served (tested with your nginx snippet). All ajax calls should now use generated paths according to set prefix. And also deleting user now works.

[trichner]

I updated, looks good, no problems so far. Thanks again!

Small detail:

flynn@tron:~/lwp$ sudo ./bin/lwp
[sudo] password for flynn: 
 * Auth type: database
 * Running on http://0.0.0.0:5000/ (Press CTRL+C to quit)

Would be nice to see the prefix there ;)

[lukasraska]

Yup, that also came to my mind, unfortunately this seems to be handled exclusively by Flask, so I can add another message for prefix at most.

[trichner]

meh, doesn't matter that much

[lukasraska]

I've tested it properly and fixed one last issue, so since nobody had any issue with this, I proposed PR

[claudyus]

in master and released in 0.8-16