Console does not respond (behind NGINX proxy)

[abrari]

Description

Using Portainer behind NGINX reverse proxy with this configuration:

server {
        server_name portainer.example.id;
        location / {
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                proxy_pass http://localhost:9000;
        }
        location /api/websocket/ {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket/;
        }
}

I opened a container's console and connect using /bin/bash. The connection was successful, the terminal was opened and showing bash prompt, but it did not respond (i.e. typing any command did nothing).

The console works well if Portainer is accessed directly (http://example.id:9000).

Technical details:

• Portainer version: 1.11.3
• Portainer Docker image tag (latest/arm/windows...): latest
• Target Docker version (the host/cluster you manage): 1.13.0
• Platform (windows/linux): linux
• Browser: Google Chrome 49

[abrari]

Oh, I forgot to mention that the browser's console displayed no errors. Inspecting the websocket request, the typed commands were sent but no response received.

[deviantony]

Hmm, that is strange, I'll try to reproduce. What if you try exactly our provided reverse proxy configuration: http://portainer.readthedocs.io/en/stable/faq.html#how-can-i-configure-my-reverse-proxy-to-serve-portainer

It is pretty similar but we know that this one is working.

[sn00pster]

I can't even get that far, I have a reverse proxy set up and everything in the UI appears to work fine apart from the console, doesn't even get to opening a black box, safari error console shows:

[Error] WebSocket connection to 'ws://docker.mydomain.com/api/websocket/exec?id=66497ad3afddd527d98c55afdc302047627194fc2f6aae5daf283024f1b80c50' failed: Unexpected response code: 301

I have the same config that appears on the link above, except that portainer is on the root rather than in a /portainer sub directory.

[sn00pster]

I think there's an erroneous (missing?) slash somewhere in a URI in the console stuff somewhere in the code, adding this extra location to the proxy config solves the problem with the console not working for me:

    location /api/websocket/exec {
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_http_version 1.1;
            proxy_pass http://portainer/api/websocket/exec;
    }

[deviantony]

Ah that's interesting ! I'll investigate.

[galindro]

@deviantony , it not works too when the reverse proxy is configured with a non-root path, like this:

server {
        server_name i.sb;
        location /portainer {
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                proxy_pass http://localhost:9000;
        }
        location /portainer/api/websocket/ {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket/;
        }
}

It not works even putting /exec at end of http://localhost:9000/api/websocket/, like showed by @sn00pster

[deviantony]

@galindro

Could you try (note the removal of the extra /):

location /portainer/api/websocket {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket;
        }

Instead of:

location /portainer/api/websocket/ {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket/;
        }

[galindro]

@deviantony, without the last / , the websocket proxy worked.
Now I have only one more question about reverse proxy: In my case (using my config), I need to put a final slash to connect to the home page. Why?

This is my current proxy config:

server {
        server_name i.sb;
        location /ui {
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                proxy_pass http://localhost:9000;
        }
        location /ui/api/websocket {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket;
        }
}

This is the problem in browser without the last slash. It seems that, without it, angular can't find some files....

[deviantony]

You mean that you need to use the following config ?

server {
        server_name i.sb;
        location /ui {
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                proxy_pass http://localhost:9000/;
        }
        location /ui/api/websocket {
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_http_version 1.1;
                proxy_pass http://localhost:9000/api/websocket;
        }
}

[galindro]

👍

[deviantony]

Honestly, no idea and I don't really have time to debug reverse proxy configs at the moment. My suggestion is that if you found a working configuration, just use it :)

Otherwise you can join us on Slack, we have a dedicated channel where we can discuss reverse-proxies issues: http://portainer.io/slack/

[galindro]

It works if I access http://i.sb/ui/. But if I access http://i.sb/ui , the browser isn't redirected to http://i.sb/ui/#/auth

[deviantony]

Looks like this issue was solved, feel free to re-open if I'm wrong.

[Joshua2504]

I'm not sure if this is fixed or not.

My domain is a sub-sub-domain: sub.sub.main.net
Portainer CE 2.18.4
Plesk acting as reverse proxy

My config:

location / {
	# Do not allow connections from docker 1.5 and earlier
	# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
	if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
		return 404;
	}

	proxy_pass                          http://localhost:9000;
	proxy_set_header  Host              $http_host;   # required for docker client's sake
	proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
	proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
	proxy_set_header  X-Forwarded-Proto $scheme;
	proxy_read_timeout                  900;
	client_max_body_size 10G;
}

I followed #609 (comment) and console works:

location / {
	# Do not allow connections from docker 1.5 and earlier
	# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
	if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
		return 404;
	}

	location /api/websocket/exec {
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_http_version 1.1;
		proxy_pass http://localhost:9000/api/websocket/exec;
	}

	proxy_pass                          http://localhost:9000;
	proxy_set_header  Host              $http_host;   # required for docker client's sake
	proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
	proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
	proxy_set_header  X-Forwarded-Proto $scheme;
	proxy_read_timeout                  900;
	client_max_body_size 10G;
}

[Twistar60]

location /api/websocket/exec {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_http_version 1.1;
proxy_pass http://portainer/api/websocket/exec;
}

I can confirm for at the time of this comment, this work perfectly. i had the issues on my proxy. Thanks @deviantony for the help!