[HELP] Docker install throws "400: Bad Request" when accessed through reverse proxy

[alexanderharm]

To Reproduce Steps to reproduce the behaviour:

1. docker compose up -d
2. connect locally http://localhost:8001: works fine
3. connect remotely through reverse proxy https://kimai.example.org: "400: Bad Request" (redirect from / to /en/homepage still works)
4. localhost:8001 10.71.1.10 - - [01/Feb/2023:10:53:15 +0000] "GET /en/homepage HTTP/1.1" 400 675 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0"

Server (please complete the following information):

• OS: Debian Bullseye
• Docker version: 20.10.23
• Docker compose version: 2.15.1

Docker compose file (with passwords redacted)

services:
  mariadb:
    image: mariadb:10.7
    container_name: kimai-db
    environment:
      - TZ=Europe/Berlin
      - MARIADB_ROOT_PASSWORD=aaaaaaaaaa
      - MARIADB_DATABASE=kimai
      - MARIADB_USER=kimai
      - MARIADB_PASSWORD=bbbbbbbbbb
      - MARIADB_AUTO_UPGRADE=true
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /srv/kimai/db:/var/lib/mysql
    restart: unless-stopped
    networks:
      - kimai-net

  kimai:
    image: kimai/kimai2:apache
    container_name: kimai
    environment:
      - TZ=Europe/Berlin
      - DATABASE_URL=mysql://kimai:bbbbbbbbbb@mariadb:3306/kimai
      - ADMINMAIL=sysadmin@example.com
      - ADMINPASS=cccccccccc
      - TRUSTED_HOSTS=10.71.1.10,localhost,127.0.0.1
      - TRUSTED_PROXIES=10.71.1.10
    volumes:
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 8001:8001
    restart: unless-stopped
    depends_on:
      - mariadb
    networks:
      - kimai-net

networks:
  kimai-net:

Additional context

• reverse proxy is traefik on 10.71.1.10 (added to trusted_proxies and trusted_hosts)
• curl from reverse proxy and kimai itself curl -L 'http://10.71.2.10:8001/en/homepage' fails with same error
• only using http://localhost:8001 works

[alexanderharm]

I guess I misunderstood the "TRUSTED_HOSTS". It needs to be kimai.example.com,10.71.2.10,localhost,127.0.0.1. Sorry for the noise.