Nginx instead of Caddy for a Reverse Proxy

[spepperkumc]

I am trying to use Nginx instead of Caddy for a reverse proxy.

It seems to mostly work but after using the simple sign in the redirect gets stuck on the 'auth-success' page with the error
Uncaught DOMException: The operation is insecure.
If I reload the base page I am logged in, but was wondering if anyone else had tried this.

[LEDfan]

Hi

This is usually caused when ShinyProxy isn't aware it's using TLS. This means nginx isn't passing the correct headers, see https://shinyproxy.io/documentation/security/#https-ssl--tls

[spepperkumc]

Hmm, even if i set SPO_CADDY_ENABLE_TLS: "false" the caddy container still boots up so im wondering if my nginx on pointed at 8080 is getting confused here.

I also tried using my custom certs within caddy to avoid nginx, but the input docker volume doesnt seem to be mounting on the docker

-> sudo docker exec sp-caddy ls -l /opt/shinyproxy-docker-operator/input/
ls: /opt/shinyproxy-docker-operator/input/: No such file or directory

[spepperkumc]

Since i couldn't get caddy to load custom certs i pivoted back to nginx. Any idea what is wrong in my config? Its only on the auth-success page i have the issue, the rest of the site works fine and apps load.

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
worker_connections 1024;
}

http {
server_tokens off;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log warn;

sendfile on;

include /etc/nginx/mime.types;
default_type application/octet-stream;

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

#######################
# HTTPS Configuration #
#######################
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # Replace this with your domain name.
    server_name example.com;

    # Paths to your SSL/TLS certificate and key.
    ssl_certificate     /etc/example.cer;
    ssl_certificate_key /etc/example.key;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;

    client_max_body_size 450M;

    location / {
        proxy_pass http://127.0.0.1:80/;
        proxy_http_version 1.1;
        proxy_buffering off;
        proxy_read_timeout 900s;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect http:// https://;
    }
}

}

[LEDfan]

Hi

I also tried using my custom certs within caddy to avoid nginx, but the input docker volume doesnt seem to be mounting on the docker

The certs will be copied to the `` directory, the input directory is only mounted to the operator container (so not the caddy container). Can you check whether you certs were correctly copied to the /opt/shinyproxy-docker-operator/data/sp-caddy/certs directory (on your Docker host)?