OpenVSCode and Laravel behind a reverse proxy

[Verhoeckx]

Hello OpenVSCode developers!

Is there someone here who can help me to make the setup below work?

Host
Red Hat Enterprise Linux
Apache used as a reverse proxy

Virtual machine
Red Hat Enterprise Linux
Laravel is installed and reachable with HTTPS
Apache is used as the web server

Now I would like to run OpenVSCode is such away that it can be reached on port 3000 and that I can edit the content of the directory /var/www/html live: I'm not sure this is possible, but I hope so :sweat_smile.

Error
When I now try to reach my.domain.com:3000/?tkn=[token] I get the message 'Unable to connect'.

Note
I opened port 3000 on both the host and the virtual machine with commands below.

sudo firewall-cmd --permanent --zone=public --add-port=3000/tcp
sudo firewall-cmd --reload

Questions

1. Does somebody know what the exact Apache configuration on the host must be?
2. Is there also a Apache configuration needed inside the virtual machine?
   As far as I know NodeJS has its own web server?
3. Is it allowed to mount the directory /var/www/html when running the container?

Al the steps I took so far, can be found here:
https://jeroenverhoeckx.com/build-your-own-online-ide.html

ps. I cleaned up the text of this issue to make it more readable.

[Verhoeckx]

Mmm, I realize that OpenVSCode needs read & write access to the directory /var/www/html.

Did this:

sudo semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html(/.*)?'
sudo restorecon -R '/var/www/html/'

[jeanp413]

@Verhoeckx for the reverse proxy configuration you can take a look at this discussion #96 (comment) hope that helps.

[Verhoeckx]

Should the lines below exist on the host or in the virtual host file on the virtual machine?

    RewriteEngine On
    RewriteCond %{HTTP:Connection} Upgrade [NC]
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteRule /(.*) ws://192.168.122.237:3000/$1 [P,L]

[jeanp413]

I think it should be on the host, btw make sure you are using apache version 2.4.48 or greater as pointed in the linked discussion

[Verhoeckx]

Thanks for the quick reply!

I see that I am using version 2.4.37. Tomorrow I'm going to find how I can upgrade Apache.

$ httpd -v
Server version: Apache/2.4.37 (Red Hat Enterprise Linux)
Server built:   Oct 26 2021 14:18:06

[Verhoeckx]

I have good and bad news:

Good news
I added the lines below to the virtual host / reverse proxy:

RewriteEngine On
RewriteCond %{HTTP:Connection} Upgrade [NC]
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteRule /(.*) ws://192.168.122.237:3000/$1 [P,L]

Bad news
I can't update Apache because 2.4.37 is the latest supported version by RHEL.

ps. I updated the image in this discussion.

[Verhoeckx]

I made some progress: I can now access OpenVSCode on port 3000!

What I did
I made Apache on the host, listen to port 3000 and then all traffic is proxied to the virtual machine.

Now I only get the error The workbench failed to connect to the server (Error: WebSocket close with status code 1006).
So there is some kind of websocket problem.

I updated my online logboek:
https://jeroenverhoeckx.com/build-your-own-online-ide.html

[jeanp413]

Awesome, that error is the same that others mentioned in the linked discussion, it's caused by the outdated apache server

[Verhoeckx]

So the good news is that my configuration is probably right, but the bad news is I can't update Apache because that's not supported.

Let's hope someone from Red Hat will answer my question about that (https://access.redhat.com/discussions/6616111).

@jeanp413: thanks for your help!!

[Verhoeckx]

One more question: do you know if it's allowed to mount the (public) directory /var/www/html to the container?

[jeanp413]

yeah, that should work, also ensure it has the right permissions

[Verhoeckx]

Thanks!!

Docker runs with root privileges so I think its allowed to read/write the files?
Or should, can I run docker as the user Apache (if that's possible)?

About the problem of the outdated Apache: I asked the same question on the mailing list of Apache. Hope that someone knows a workaround!

[jeanp413]

Running docker with root privileges should do it 👍

[Verhoeckx]

I'm waiting from a second response from someone from Apache, but in the mean time I found out the following:

When I try to connect with:

sudo podman run -it --init -p 3000:3000 -v "$(pwd):/var/www/html:cached" gitpod/openvscode-server

And go to the address with the token

https:my.domain.com:3000/?tkn=[generated token]

I see the following error message in Firefox console tab:

Firefox can’t establish a connection to the server at wss://[my.domain.com]:3000/?reconnectionToken=[generated token]&reconnection=false&skipWebSocketFrames=false.

What is surprises me, is that it mentions wss while I don't have that in my Apache virtual host file / reverse proxy. How does it come with the wss?

[jeanp413]

Internally vscode web starts a wss or ws connection depending if you are using https or http

[Verhoeckx]

In my setup HTTPS is 'downgraded' (off-loaded) to HTTP in the proxy because SSL can't be configured in the virtual machine (it's now allowed and possible, as far as I know).

Internet  <-- HTTPS -->  Apache reverse proxy  <-- HTTP -->  Virtual machine

Somehow I need to tell OpenVSCode should use ws and not wss. Is that possible?

The HTTPS part is only to the host machine (this works with my Nextcloud vm).

https://[my.domain.com]:3000/?tkn=[security token]

My virtual host file is

<VirtualHost *:3000>
    ServerName [my.domain.com]

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule /(.*) ws://192.168.122.237:3000/$1 [P,L]

    ProxyPreserveHost On
    ProxyPass / http://192.168.122.237:3000/
    ProxyPassReverse / http://192.168.122.237:3000/

    SSLCertificateFile /etc/letsencrypt/live/[my.domain.com]/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/[my.domain.com]/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLEngine on
</VirtualHost>

[jeanp413]

The config It's fine, apache will forward the requests properly

[Verhoeckx]

I tried to use --connection-secret [absolute path to the security token file], but when I did this, I got a 502 proxy error every time.

I can't go back using this because I already configured a systemd unit file based on the --connection-token argument.

[Verhoeckx]

I reported the problem at Red Hat's bugzilla!