-

Wed, 29 Dec 2021 20:42:08 +0100

adminsforum@hubzilla.org

Scriptura wrote the following post Wed, 29 Dec 2021 20:41:52 +0100

Problem making Cnnections

I recently moved my hub from a remote VPS to a BananaPi at my home. And that is connected by a reverse proxy on my main webserver at home. Everything seems to function well, except when making local connections. When the connection is confirmed, the balloons stay red and no extra privileges are given. When I make a connection with someone on another hub, then it works like expected (balloons turn green). I cannot reproduce this on my old hub (the VPS), although I used the same procedure on the install. The only difference is that I used a Reverse Proxy now.
I went through all logfiles etc, but no clue.

Can anybody help me how to find the problem?
Or give me the conf-files on how to set-up a Apache Reverse Proxy?

My old hub is on hadron.soleus.nu and the new one on hub.hoteldaan.nl

Thanks, Daniel

Thu, 30 Dec 2021 01:36:50 +0100

oRx-Qx pirateradio

michal@node9.org

@Scriptura

Yes, you are making a http connection from proxy (besides the websockets part). At the backend m1px.daninet.lan vhost you have to set HTTPS server variable and pass it to PHP. In Nginx it is done by
fastcgi_param HTTPS 'on';

But for "internal" connections the problem can also be in DNS. Your domain should resolve to the proxy address for everything to work the same as from outside. Your proxy also does not store original IP in headers for backend to extract it. It can cause another issues.

What I use is HAProxy, where you can use TCP mode, which does not touch packets at all sending them to backend server and there you can terminate SSL in regular vhost not having any issue with proxy ever. In this case you can have local DNS resolving to backend server itself.

Fri, 31 Dec 2021 00:22:10 +0100

oRx-Qx pirateradio

michal@node9.org

@Scriptura And what is your backend webserver? The http server directly serving Hubzilla?
Putting
fastcgi_param HTTPS 'on'; (in case of Nginx)
SetEnv HTTPS "on" (in case of Apache)
into vhost should solve the Hz webfinger SSL demand.

2) Possible, just ensure the proxy does not verify the self-signed cert

As for HAProxy, just install it and edit the config to something like this (in frontends you put your proxy IP, in backends you put your backend IP)

frontend http
    bind    35.154.100.100:80
    mode tcp
    default_backend http_pool

frontend https
    bind    35.154.100.100:443
    mode tcp
    default_backend https_pool

backend http_pool
    mode tcp
    server m1px 10.233.32.143:80 check

backend https_pool
    mode tcp
    server m1px 10.233.32.143:443 check