digitalfondue / lavagna

Lavagna: issue tracker/project management tool
http://lavagna.io
GNU General Public License v3.0
635 stars 109 forks source link

problem with Proxypass and SSL with websocket #127

Closed joegyoung closed 4 years ago

joegyoung commented 4 years ago

How do I put Lavagna behind Apache's Proxypass? I am having problems with wss to ws. Here is my site configuration for Apache.

<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile    /etc/ssl/mycerts/cert.crt
    SSLCertificateKeyFile /etc/ssl/mycerts/public.key
    SSLCertificateChainFile /etc/ssl/mycerts/gd_bundle
SSLProxyEngine on
 RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule .* "wss://127.0.0.1:8080%{REQUEST_URI}" [P]
ProxyRequests On
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/
</VirtualHost>

When my client connects with the websocket, it gets the error-- Error during WebSocket handshake: Invalid status line

joegyoung commented 4 years ago

Closing ticket. I ended up using this Apache config

<VirtualHost *:443>
    ServerName project.<domain>

    LogLevel warn
    ErrorLog ${APACHE_LOG_DIR}/lavagna_ssl_error.log
    CustomLog ${APACHE_LOG_DIR}/lavagna_ssl_access.log combined

    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM
    SSLEngine On
    SSLCertificateFile    /etc/ssl/mycerts/<domain>.crt
    SSLCertificateKeyFile /etc/ssl/mycerts/<domain>.public.key
    SSLCertificateChainFile /etc/ssl/mycerts/gd_bundle-g2-g1.crt

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*)            ws://localhost:8080/$1 [P,L]

    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyRequests Off

       ## Not sure if I needed this 
    ProxyPass /.well-known !
    ProxyPassReverse /.well-known !
    ProxyPass /robots.txt !
    ProxyPassReverse /robots.txt !

    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

    #AddOutputFilterByType INFLATE;SUBSTITUTE;DEFLATE text/html
    #Substitute "s|<base href=\"/lavagna/\">|<base href=\"/\">|n"
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    RequestHeader set  Origin "http://project.<domain>"
    RequestHeader set Access-Control-Allow-Origin: "https://project.<domain>"
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Max-Age "1000"
    Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
</VirtualHost>