haishanh / yacd

Yet Another Clash Dashboard
http://yacd.haishan.me
MIT License
4.16k stars 736 forks source link

Page errors when HTTPS reverse proxied by Nginx Proxy Manager #707

Closed MakiseKurisu closed 2 years ago

MakiseKurisu commented 2 years ago

yacd, clash, and npm both hosted in the same docker host. Reverse proxy works when accessing yacd via HTTP. When trying to access via HTTPS Uncaught DOMException: The operation is insecure. were thrown out. Tried to reverse HTTPS proxy clash endpoint as well. However, the result is the same.

The code is minified so can't give you exact function that errors out. There is some reference on WebSocket so I enabled that in npm as well with no avail.

Takunsyo commented 2 years ago

yacd or maybe every dashboard when running SSL requires clash api also be SSL. Maybe try reverse proxy clash api also? server {

SSL configuration

    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/sites/clashapi.local/clashapi.local_bundle.crt;
    ssl_certificate_key /etc/ssl/sites/clashapi.local/clashapi.local.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    server_name clashapi.local;
    location / {
            # For clash api, web socket over https is needed.
            proxy_http_version 1.1;
            proxy_redirect off;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass  http://172.30.2.117:9090/; #clash api address.
    }

} server { listen 80; listen [::]:80; server_name clashapi.local; return 301 https://$host$request_uri; }

MakiseKurisu commented 2 years ago

We are using self-signed cert, and when trying to add now https-proxied clash endpoint I got CORS failure, which according to Mozilla's doc is expected result of using untrusted cert. We will keep using http protocol then. Thanks.