search

linuxserver / reverse-proxy-confs

These confs are pulled into our SWAG image: https://github.com/linuxserver/docker-swag
GNU General Public License v3.0
1.29k stars 296 forks source link

[FEAT] upstream_proto https to http #640

Closed NLZ closed 6 months ago

NLZ commented 6 months ago

Is this a new feature request?

Wanted change

In some templates upstream_proto is set to https, eg: https://github.com/linuxserver/reverse-proxy-confs/blob/20c5dbdcff92442262ed8907385e477935ea9336/privatebin.subdomain.conf.sample#L42

I would propose to set upstream_proto to http in all the templates. Only a few configs seems to have it:

budge.subdomain.conf.sample
collabora.subdomain.conf.sample
heimdall.subdomain.conf.sample
heimdall.subfolder.conf.sample
kanzi.subdomain.conf.sample
kanzi.subfolder.conf.sample
kasm.subdomain.conf.sample
linkstack.subdomain.conf.sample
nextcloud.subdomain.conf.sample
nextcloud.subfolder.conf.sample
openvpn-as.subdomain.conf.sample
openvscode-server.subdomain.conf.sample
privatebin.subdomain.conf.sample
pydio-cells.subdomain.conf.sample
pydio.subdomain.conf.sample
unifi-controller.subdomain.conf.sample
unifi-network-application.subdomain.conf.sample
warpgate.subdomain.conf.sample

Reason for change

The https upstream_proto requires the website to already have a working https config, but the templates are made for same docker network proxying, so they almost never have a proper cert. And this unexpected default https can cause headaces to troubleshoot for newbies. If someone wants to proxy services with existing https they more likely to know what they are doing. Some configs might require https, but I don't know all of those services to make judgement. But for example privatebin is definitely not needing it.

Proposed code change

No response

aptalca commented 6 months ago

They are set to whatever's appropriate for each app. Various apps only listen for https connections and they have self signed certs. The proxy confs we provide should work out of the box when it comes to the proto.

Roxedus commented 6 months ago

Most of these comes with a self signed cert. When we approve additions to this repo, this is one of the things we check. Personally i check the protocol against the upstream documentation before i merge.

NLZ commented 6 months ago

I see, my bad. Then it only seems to be the PrivateBin.

Do you remember which PrivateBin container you tested with?

283 doesn't specify it.

I'm using the official image but it explicitly says to use a proxy for https:

The Nginx setup supports only HTTP, so make sure that you run a reverse proxy in front of this for HTTPS offloading and reducing the attack surface on your TLS stack.

Maybe they changed it since 2021