Web UI not working when running AWX behind reverse proxy on a subdomain

[kralewitz]

ISSUE TYPE

• Bug Report

COMPONENT NAME

• UI

SUMMARY

When running AWX behind a reverse proxy on a subdomain, the UI is broken due to wrong URL in links to static assets. The API is working okay.

ENVIRONMENT

• AWX version: 1.0.1.81
• AWX install method: docker on linux
• Ansible version: 2.4.0.0
• Operating System: Linux 4.9.0-3-amd64 set up shippable ci #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26) x86_64 GNU/Linux
• Web Browser: Chrome Version 62.0.3202.75

STEPS TO REPRODUCE

Set up a reverse proxy in front of awx using a subdomain, example settings for nginx:

    location /awx/ {
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_pass_request_headers on;
        proxy_set_header Connection "keep-alive";
        proxy_pass http://localhost:9080/;
    }

Settings in AWX:

Base URL: https://random-server.org/awx
Remote host headers: HTTP_X_FORWARDED_FOR, REMOTE_ADDR, REMOTE_HOST

EXPECTED RESULTS

The web UI should be working when run from a subdomain

ACTUAL RESULTS

The web UI loads only partially, see attached screenshot

It looks like none of the URLs for static assets respect the subdomain part of the URL, for example:

<script src="/static/rest_framework/js/jquery-1.11.3.min.js"></script>

After running awx-manage print_settings in the web container:

...
MEDIA_URL                                = '/media/'
TOWER_URL_BASE                  = u'https://random-server.org/awx'
INTERNAL_API_URL                  = 'http://awxweb:8052'
...
STATIC_URL                               = '/static/'
LOGIN_URL                                = '/accounts/login/'
...

ADDITIONAL INFORMATION

Screenshot of the broken UI:

[DBLaci]

I use awx with reverse proxy and I haven't experienced the problem you have, all assets loads (images etc, no 404 errors)

My config:

...
      location / {
        proxy_pass http://1.2.3.4:8052/;
        proxy_http_version 1.1;
        proxy_set_header   Host               $host;
        proxy_set_header   X-Real-IP          $remote_addr;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto  $scheme;
        proxy_set_header   Upgrade            $http_upgrade;
        proxy_set_header   Connection         "upgrade";
      }

...

Offtopic but notice the Upgrade and Connection headers. You will need these for websocket to work.

I use the image versions: 1.0.1.203

awx-manage print_settings:

TOWER_URL_BASE                           = u'https://towerhost'
INTERNAL_API_URL                         = 'http://awxweb:8052'

(but I don't see these addresses from the browser!)

In fact I use cloudflare CDN in addition to my reverse proxy (so it is 2 reverse proxy before awx_web)

[matburt]

I also can't reproduce this on a basic reverse proxy configuration.

[kralewitz]

Sorry, looks like I got subdomain and subpath mixed up.

When using a separate domain and running awx from it's root (like awx.mydomain.com/), everything works fine. But when I try to run it on a subpath, the static assets break (base URL is mydomain.com/awx/).

Could you please try to reproduce that?

[matburt]

I'd be skeptical that would work without some more modifications to our internal routing/web server configuration.

[ykisialevich]

Reproduced the same issue by setting up AWX behind reverse proxy in IIS and can confirm UI is broken

[chuegel]

Same issue here.

upstream nas-20-awx {
			       server 10.91.87.11:80;
	}

	server {
	       server_name nas-20-awx
	       listen 80;
	       access_log /var/log/nginx/access_nas-20-awx.log vhost;
		error_log /var/log/nginx/error_nas-20-awx.log;
	location / {
	      proxy_pass       http://nas-20-awx;
         proxy_http_version 1.1;
        proxy_buffering off;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
	    }
	}

[lemmy04]

how should i do this using apache?

[Numblesix]

Same here running it on / works perfectly but on /awx the ui is broken :(

[Geartwo]

proxy_pass http://nas-20-awx;

Same here running it on / works perfectly but on /awx the ui is broken :(

The problem in both cases is that your proxy_pass have no / at the end.
It loads http://localhost:8080static in background and because of that you get an error.

[Climberdav]

Hi same problem with sub-domain
I have many application behind nginx so I can't access my awx, have to tunnel.

# locations.conf
...
location /awx/ {
        proxy_pass http://awx/;
        proxy_http_version 1.1;
        proxy_set_header   Host               $host;
        proxy_set_header   X-Real-IP          $remote_addr;
        proxy_set_header   X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto  $scheme;
        proxy_set_header   Upgrade            $http_upgrade;
        proxy_set_header   Connection         "upgrade";
      }

# upstream.conf
...
upstream awx {
    server 192.168.50.21;
}

Good if you have any workarround

[Climberdav]

Hello,

anybody can help ? for information when I go to the login page, all statics are down :
for exemple I have /static/js/app.bd927cc14dd2d4bf0c9a.js and no /awx/static/js/app.bd927cc14dd2d4bf0c9a.js (and if I put that in my browser it works).
I can't proxy that "static" because I have my main site with "static" too.
I put execpted url in settings.py eg https://myhost/awx/ and restart awx but not working.

thanks
David

[codebard]

Encountered the same issue. Subdomain with nginx reverse proxy, awx in docker proxied by nginx, user/password does not work when trying to login.

[pthall]

@lemmy04
how should i do this using apache?

I adapted this for my Apache reverse proxy based on https://stackoverflow.com/a/34371105
Replace http://localhost:80 with the awx_web backend URL.

RewriteEngine on
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
RewriteRule .* http://localhost:80%{REQUEST_URI} [P]

[lukas-pastva]

+1 here
Basically, we need asnwer for "How to run AWX on subdirectory"

[jpic]

This is because AWX has NPM building the index.html domain. AWX declares its static inside public/static/, this is why the generated index.html is compatible with STATIC_URL=/static/, and that only.

To support other values for STATIC_URL, AWX should use django-webpack/django-webpack-loader. Basically this will change:

• building the UI produces a json containing paths to output chunks,
• use the django-webpack-loader templatetag to load webpack assets which will use both the output json and STATIC_URL.

Then AWX will be able to respect STATIC_URL whenever linking to webpack assets.

@matburt I think the bug is clearly identified and that this issue may be reopened. Please let me know if you have any question... The problem is that this block the ingress_path feature of awx-operator!