Running behind reverse proxy

[Funky185540]

Hello,

I'm currently looking for a wiki with user-management for my private server. I stumbled upon this after a friend of mine recommended Gollum to me. I'm quite fond of the idea that's presented in the README!

The networking setup of my server requires me to run the service behind a reverse proxy - there is no way past that. I did a quick test running the container behind the proxy and here's what I found so far:

• The service won't answer when I redirect to port 80 (regular HTTP), but only on port 8443 as https
• If I redirect to port 8443, the service will trigger another redirect to "localhost:8443/..." which is wrong
• If additionally I supply the FQDN as environment variable I get to the actual login screen

After logging in with "admin"/"admin" I then see this:

500
Internal Server Error
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Which I can't make any sense of... Is there some place I can look for more helpful output of what went wrong?

It also seems to me that the services communicate with each other directly through the host (FQDN), which means that I can't make any path-based HTTP routing as that would break the services expectations about where "/scm", "/smeagol" and "/cas" are located (in that case: Not directly under the FQDN) .

Also I'd like to have a way of disabling the TLS certificate generation, as my reverse proxy performs TLS termination already, and all internal traffic is handled via HTTP (which is OK, as it's the same host and everything runs in containers). Is there a way to do this in the current state?

Thanks a lot!

[schnatterer]

Hi @Funky185540 ,

My schedule is a bit strained right now but I'll answer your questions as good as I can. The good news is that I'm successfully running smeagol galore behind a reverse proxy. There is an example for that use case in the example directory. Did you have a look at the general example? It covers more aspects than the reverse proxy but this is pretty much what works for me.

You can disable cert generation via an env var. See readme. The cert error you reported might go away of your reverse proxy delivers a valid cert and you disabled LetsEncrypt.

Changing the context path is not supported right now. I always ran SG on its own subdomain. Is that not an option for you? Context paths shouldn't be too hard to implement. If you need it please open an issue. But I can't promise when I'll find the time.

[schnatterer]

No response in almost two months, so I presume this is no longer of interest. Closing.