Use relative URLs everywhere

[ameshkov]

The idea is to make it easier to use AGH behind a reverse proxy. See the explanation here:
#1085 (comment)

What needs to be done:

1. Make AGH use relative URLs everywhere
2. Set up Nginx on our test instance and move AGH to a location: http://192.168.10.95/adguard/

[szolin]

To make things work for AGH under a reverse proxy server we need:

1. Fix redirect from /login.html to dashboard.
   UI redirects don't work anymore.
   Check if :

• UI can use window.location and don't touch the left part of it:
  http://server:port/path/path/path/agh/login.html -> http://server:port/path/path/path/agh/

Backup plan:

• The server must return 302 with Location: / to /control/login request.
• UI needs to support this behaviour

2. UI must replace URL for "Sign out" button from /control/logout to control/logout.

[szolin]

nginx config:

        location /agh/ {
            proxy_pass http://AGH_IP:AGH_PORT/;
            proxy_redirect / /agh/;
            proxy_cookie_path / /agh/;
        }

[meizenga]

Some are using Traefik as 'proxy'. This idea might solve the same issue which occurs when you use Traefik.

[ameshkov]

Isn't it possible to have a traefik equivalent to this nginx config?

[ouyi]

caddy config:

:80/agh/* {
    route {
        uri strip_prefix /agh
        reverse_proxy AGH_IP:AGH_PORT {
            header_down Location /login.html /agh/login.html 
        }
    }
}

[lseufer]

nginx config:

        location /agh/ {
            proxy_pass http://AGH_IP:AGH_PORT/;
            proxy_redirect / /agh/;
            proxy_cookie_path / /agh/;
        }

This gives me 502 Bad Gateway.

My full Nginx config is as follows:

server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name redacted.tld;
ssl_certificate /usr/syno/etc/certificate/_archive/petzPz/fullchain.pem;
ssl_certificate_key /usr/syno/etc/certificate/_archive/petzPz/privkey.pem;
add_header Strict-Transport-Security "max-age=0;";
auth_basic “Restricted”;
auth_basic_user_file /etc/nginx/.htpasswd;
location /adguard/ {
proxy_pass http://localhost:3000/;
proxy_redirect / /adguard/;
proxy_cookie_path / /adguard/;
}
}

[szolin]

The default config works fine - just add location settings there.
For example, this is server on port 8080:

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        listen       8080;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location /agh/ {
            #root   html;
            #index  index.html index.htm;
            proxy_pass http://127.0.0.1:3000/;
            proxy_redirect / /agh/;
            proxy_cookie_path / /agh/;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}

[lseufer]

Sorry to be thick but which part do you mean? I have already have another service running at location /. I tried adding root and index but it now gives me a 404.

[szolin]

I mean that you may start with the default nginx config.
Then add there my location settings from here: #1300 (comment)
You may also test the complete config I've shared above.

[alaub81]

I am using Traefik with subpath redirection. Everything is working fine expect, if you are not logged in. Then it redirects to /login.html which isn't reachable for sure. I am using /adguard/ for subdomain.

here are my used labels:

      - "traefik.http.routers.adguardhome.rule=PathPrefix(`/adguardhome`)"
      - "traefik.http.routers.adguardhome.entrypoints=websecure"
      - "traefik.http.routers.adguardhome.tls=true"
      - "traefik.http.routers.adguardhome.middlewares=adguardhome-stripprefix"
      - "traefik.http.middlewares.adguardhome-stripprefix.stripprefix.prefixes=/adguardhome"
      - "traefik.http.middlewares.adguardhome-stripprefix.stripprefix.forceSlash=false"
      - "traefik.http.services.adguardhome.loadbalancer.server.port=80"

Same problem is, when I like to logout, then it goes to /console/logout which brings a 404, too.

I also tried to redirect /adguardhome/ to /adguardhome/login.html but after logging in I couldn't get the Dashboard.

I could not find anything about Traefik, AdGuard Home and subpath setup. So perhaps someone could help me out with that.
There must be a way to do that :-)

[yuzhy8701]

I am using Traefik with subpath redirection. Everything is working fine expect, if you are not logged in. Then it redirects to /login.html which isn't reachable for sure. I am using /adguard/ for subdomain.

here are my used labels:

      - "traefik.http.routers.adguardhome.rule=PathPrefix(`/adguardhome`)"
      - "traefik.http.routers.adguardhome.entrypoints=websecure"
      - "traefik.http.routers.adguardhome.tls=true"
      - "traefik.http.routers.adguardhome.middlewares=adguardhome-stripprefix"
      - "traefik.http.middlewares.adguardhome-stripprefix.stripprefix.prefixes=/adguardhome"
      - "traefik.http.middlewares.adguardhome-stripprefix.stripprefix.forceSlash=false"
      - "traefik.http.services.adguardhome.loadbalancer.server.port=80"

Same problem is, when I like to logout, then it goes to /console/logout which brings a 404, too.

I also tried to redirect /adguardhome/ to /adguardhome/login.html but after logging in I couldn't get the Dashboard.

I could not find anything about Traefik, AdGuard Home and subpath setup. So perhaps someone could help me out with that. There must be a way to do that :-)

As of 2023, the redirect issue can be fixed with a header-rewriting traefik plugin (e.g. https://plugins.traefik.io/plugins/628c9eb5108ecc83915d7758/rewrite-header). Simply add /adguardhome prefix to any absolute path in Location header:

- "traefik.http.middlewares.adguardhome-rewriteheader.plugin.rewriteHeaders.rewrites[0].header=Location"
- "traefik.http.middlewares.adguardhome-rewriteheader.plugin.rewriteHeaders.rewrites[0].regex=^/(.*)"
- "traefik.http.middlewares.adguardhome-rewriteheader.plugin.rewriteHeaders.rewrites[0].replacement=/adguardhome/$1"