Rewrite CGI for nginx support

[Kline-]

Would it be possible to see some of the modules requiring CGI, such as proc, re-written to be non-CGI so that they will work with nginx without a lot of phony FastCGI setup and fiddling?

If not, a note in the documentation/FAQ would be nice just to highlight that some things won't work (or just have Webmin disable the modules by default). I couldn't figure out why the proc module just kept displaying a connection refused error in Chrome until I ran an strace on Webmin and noticed it was attempting to execute a CGI file.

[jcameron]

So are you looking to run Webmin under Nginx, instead of Apache or the built-in webserver?

[Kline-]

Correct. I've setup Apache to reverse proxy Webmin before without issues so I only have one SSL cert/web server to manage. In setting up a new server last night I decided to use nginx as I don't need the heavy lifting of Apache.

Most things are working fine, but the proc module was the first thing I noticed that didn't work and after working with Webmin a bit further many of the redirects back to a module page after submitting data fail the redirect, but work otherwise. Example: Create a new user, enter details, hit submit -- user is successfully created but the redirect back to the main user management module fails.

[jcameron]

Oh, so you only have Nginx proxying to Webmin? Or is Nginx running the Webmin CGIs directly?

I recommend the proxy approach, and in a virtual host instead of a sub-directory.

[Kline-]

Only as a proxy. I think I have narrowed down things some but still don't fully understand what isn't working here, but changing Webmin's redirects from "Protocol, host, port and path" to "Path only" now has nginx returning 501 errors in some places (saving a user modificaton) and simply doing nothing at all in others (trying to access the proc module).

Previously the redirects would fail, so seeing 501 errors is something new. Here is the actual error from the nginx logs:

[error] 2513#0: *120 rewrite or internal redirection cycle while internally redirecting to "/index.html", client: xxx.xxx.xxx.81, server: my.server, request: "GET /useradmin/index.cgi?mode=users HTTP/1.1", host: "xxx.xxx.xxx.19", referrer: "https://xxx.xxx.xxx.19/webmin/useradmin/edit_user.cgi?user=myuser"

More searching; found someone else having pretty much the same difficulty and probably explains it a bit better: http://witlogs.com/Questions/143022/Proxying-webmin-with-nginx

[jcameron]

Does the nginx proxy also re-write Location: headers (which are used for redirects)? Apache does this, via the ProxyPassReverse directive, which has to be set in addition to ProxyPass. Maybe Nginx needs something similar?

[Kline-]

It does not by default, but there are settings to enable this (which I have enabled).

See: http://wiki.nginx.org/LikeApache

My own settings are

server {
        listen 443;
        server_name my.fqdn;

        ssl on;
        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

        root /usr/share/nginx/www;
        index index.html index.htm;
        location /webmin/ {
                include conf.d/proxy.conf;
                proxy_pass http://127.0.0.1:10000/;
        }
}

and the contents of conf.d/proxy.conf

proxy_set_header        X-Forwarded-Host        $host;
proxy_set_header        X-Forwarded-Server      $host;
proxy_set_header        X-Forwarded-For         $proxy_add_x_forwarded_for;

By everything I've seen it should work without issues...But does not. While scouring Google I did see some mention that Webmin uses non-relative paths for pages in some locations? Not sure if that is correct or not, but it would explain why some modules are behaving a bit differently than others.

[jcameron]

Do you have the line relative_redir=1 in your /etc/webmin/config file? That should force use of a relative redirects.

[jcameron]

Actually, you are right that the proc module uses an absolute redirect in some cases - I'll fix that.

[Kline-]

I do not have relative_redir=1 in my config as I didn't know about it. I had tried webroot without any luck though. I'll give it a spin when I get home today and report back.

[Kline-]

Added relative_redir=1 and your fix for the proc module; no change in status.

[jcameron]

I'm not sure what is going on here, sorry.

Are you proxying a sub-directory of your website to Webmin, or does it have its own virtual host?

[Kline-]

It is being proxied as a sub-directory. I installed with the .deb hosted from your site and am trying to proxy https://my.website.com/webmin to http://localhost:10000

[jcameron]

Do you have the line webprefix=/webmin in your /etc/webmin/config file?

[Kline-]

Yes, I do.

On Thu, May 15, 2014 at 11:21 PM, Jamie Cameron notifications@github.comwrote:

Do you have the line webprefix=/webmin in your /etc/webmin/config file?

— Reply to this email directly or view it on GitHubhttps://github.com/webmin/webmin/issues/146#issuecomment-43295448 .

[jcameron]

I'm out of ideas here, sorry .. this seems more like an Nginx issue.

[jacques]

@Kline- you will need to do some rewriting in nginx for this. For TextDrive I had to remove the trailing hostname out of the URL's when reverse proxying webmin but we were using a load balancer that allowed us to remove the prefix from the URL's.

[Kline-]

Fair enough, and it may entirely be. There doesn't seem to be a lot of information out there for getting Webmin working behind nginx yet (and I'm new to nginx myself).

Getting CherryPy apps to run behind nginx has been as simple as Apache though. I'm not a Perl person at all and even less knowledgeable about writing a web server implemented in Perl, so I won't try to take any guesses at the differences between CherryPy and Miniserv :)

Thanks for all your help! As it sits now it's "functionally working" in that I can perform all the tasks I want to with it except for viewing procs. Redirects back from things like saving a user still error, but the user is still saved so whatever :)

@jacques I'll have to try and play around with that some this weekend, thanks! I haven't tried any rewrite fiddling yet since I never really needed to when using Apache, so I just assumed a similar proxy setup would take care of things.

[jacques]

Trying something like (not sure if this will work but give it a spin).

rewrite  ^/webmin/(.*)  /$1 break;

[tjwebb]

+1 I also see this issue. I have webprefix=/webmin set in my webmin conf and all the other things discussed here.

  location /webmin {
    proxy_pass http://127.0.0.1:10000/;
    proxy_redirect off;
    proxy_read_timeout 3600s;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

I think webmin doesn't perfectly respect some of its own settings, because I still see it trying to redirect some things to myhost:10000 on seemingly random occasion, instead of myhost/webmin.

So the webmin web app is basically usable, but frustrating.