NGINX issues since 0.17

[auanasgheps]

Version

Version: 0.17.2

Bug description

Since the update to 0.17, here's what looks like.

If I go to Space settings, it says I have 20 recipes (correct).

Something in the upgrade went wrong. What should I do? I can't access my recipes!

[smilerz]

@auanasgheps how is Tandoor setup (manual, docker, other)? can you share the logs? also if hit F12 the developer console might provide some additional context.

[auanasgheps]

@smilerz I'm using docker.
Anyway I managed to do some troubleshooting and it's about the nginx config.
If I go straight to the container works fine.
I'll keep you posted

[smilerz]

check out #953 and see if that points you in the right direction.

[MaxJa4]

@auanasgheps I had the same exact issue since 0.17.0...
My nginx reverse proxy was the cause, I had to add the following lines inside the nginx site config (in the location region):
proxy_set_header X-Forwarded-Proto $scheme;
I also added proxy_set_header Host $Host;, but I don't know if that's necessary.
This is partially mentioned in the FAQs

[MaxJa4]

Seems like 0.17.0 got some new links which are not relative but absolute (just an assumption).
proxy_set_header Host $Host; fixed the issue for some kind of worker which had problems with that.
proxy_set_header X-Forwarded-Proto $scheme; fixed some 'mixed content' errors.
All of that can be seen in the web browser console (F12).

[smilerz]

@vabene1111 does the included nginx config need to be updated?

[auanasgheps]

This is may config before it broke down (pre 0.17).

If I add proxy_set_header Host $Host; I get "Bad Request (400)" and the page doesn't load.
In the past I've already fought with Recipes and Nginx. Here we go again.

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable the next two lines for ldap auth
        #auth_request /auth;
        #error_page 401 =200 /ldaplogin;

        # enable for Authelia
        #include /config/nginx/authelia-location.conf;

        include /config/nginx/proxy.conf;
        resolver 127.0.0.11 valid=30s;
        set $upstream_app recipes-app;
        set $upstream_port 8080;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
	proxy_set_header X-Forwarded-Proto $scheme;
    }
}

[MaxJa4]

Maybe proxy_set_header Host $http_host; works better like mentioned in the issue that @smilerz mentioned

[auanasgheps]

@MaxJa4 tried and I still get 400.

In the meantime here's the browser console

[smilerz]

@auanasgheps after setting the host and scheme as mentioned above clear the cache on the page - some of the URLs are constructed from settings set in LOCAL_STORAGE. Maybe(?) those are not getting overridden correctly? I'd restart the docker as well to make sure that no information is cached anywhere.

[MaxJa4]

@auanasgheps That's the exact same errors I got.
Did you add both "proxy_set_header Host" and "proxy_set_header X-Forwarded-Proto"? If so, then maybe the caching is the issue here like smilerz said. After that, I'm out of ideas (other than restarting nginx once more just to be sure).

[auanasgheps]

I added both "proxy_set_header Host $Host" and "proxy_set_header X-Forwarded-Proto $scheme"
Restarted nginx
Browed to Recipes
CTRL + F5 to clear cache

Bad Request (400)

[vabene1111]

So first of all the included nginx config and all recommended/documented setups have been tested and were working.

The paths are not absolute but django has several build in ways that manage constructing paths, if a proxy setup in front of django does not pass trough the correct headers than django is not able to determine where it is actually running from and thus cannot tell the frontend components the correct routes to make request to.

From what i can see @auanasgheps you are getting requests blocked because django thinks that its running on http but it actually is served over https. This can happen if the proxy enforces https for the main requests (which it is able to do since it passes trough it) but it cannot rewrite the urls that django determines it needs to use for making api requests.

Please make sure you set proxy_set_header Host $http_host; (http_host not host as stated in the docs and issue #953) the other header proxy_set_header X-Forwarded-Proto $scheme; looks correct. If that does not help please remove all configuration entries from your nginx config that are not clearly mentioned in the installation guide and verify the problem still exists. If it does please post detailed information about your setup (folder locations, OS versions, all relevant config files env/nginx/etc.)

[MaxJa4]

My nginx config (of the host system, as reverse proxy) looks like this:

server {
    if ($host = SUB.DOMAIN.TLD) {
        return 301 https://$host$request_uri;
    }

    server_name SUB.DOMAIN.TLD;
    listen 80;
    return 404;
}
server {
    server_name SUB.DOMAIN.TLD;
    listen 443 ssl;

    ssl_certificate /etc/letsencrypt/live/SUB.DOMAIN.TLD/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/SUB.DOMAIN.TLD/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

        location / {
                proxy_pass http://127.0.0.1:PORT;
                proxy_redirect http://127.0.0.1:PORT https://SUB.DOMAIN.TLD;
                proxy_set_header Host $Host;
                proxy_set_header X-Forwarded-Proto $scheme;
        }
}

Be sure to replace SUB.DOMAIN.TLD (6x) and PORT (2x) in all spots ofc. This is by far not a perfect config but it works for me. If you don't use certbot or letsencrypt, you might need to change some stuff.