website proxy does not support websockets

[iateadonut]

On a server, go to Server Configuration -> Edit Proxy Website

Set "Proxy enabled?" to "Yes". Proxy to url: http://localhost:12809/

Websockets are not enabled.

To fix this, in the apache directives, under RewriteEngine on, the following directives need to be put in place by virtualmin (currently you have to do this by hand) - assuming the previous value is "http://localhost:12809/":

RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://localhost:12809%{REQUEST_URI} [P]

[jcameron]

You're right, only HTTP proxying is supported right now.

[shoulders]

i think this can be closed 😄

HTTPS is the only type of proxying recommended now.

[iateadonut]

This is a discussion about websockets. Would the same issue would still exist even if you're using a secure websocket connection wss rather than ws?

If you point me to the direction in the source code for proxy connections, I'll check it out.

[jcameron]

The relevant code is here : https://github.com/virtualmin/virtualmin-gpl/blob/master/balancer-lib.pl#L57

[iliajie]

Jamie, I think we should also setup WebSocket proxy! We have a tested and perfectly working example described in Webmin FAQ. Please note that for :80 we'd want to setup ws:// and for :443 it should be wss://.

[jcameron]

Good idea, I'll work on this..

[jcameron]

So would these directives actually replace the ProxyPass that we're currently using?

RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://localhost:12809%{REQUEST_URI} [P]

[iliajie]

So would these directives actually replace the ProxyPass that we're currently using?

It won't replace the directives we're currently using. These will be extra.

[iliajie]

Has this been implemented yet in light of the latest commits to the Virtualmin repo?

[jcameron]

Not yet, but it's getting there!

[jcameron]

Is there a good way I can test websockets proxying from the shell, to validate that this feature works?

[iliajie]

Is there a good way I can test websockets proxying from the shell, to validate that this feature works?

No sure .. perhaps using socat util ..

[jcameron]

Ok so I think implementation of this feature is done.

@iateadonut can you tell me how you would use this in practice so I can test with your use case?

[iateadonut]

This is websocat: https://github.com/vi/websocat/

You can download websocat like this:
curl -L https://github.com/vi/websocat/releases/download/v1.9.0/websocat_linux64 -o ./websocat
chmod a+x ./websocat

This is the latest version that works with my architecture as far as I know. You can find other versions here:
https://github.com/vi/websocat/releases

You should install it on the server you are testing and also on the machine you are testing from.

I'm doing this at r.100wires.com.
On that server, i have these lines in my apache config:

RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://localhost:12809%{REQUEST_URI} [P]

Because I have the 12809 in the rewrite rule, I use that port to start a websocket server on the virtualmin server:

./websocat -s 12809

That gives me this response:

./websocat -s 12809
Listening on ws://127.0.0.1:12809/

On my localhost, I can test by doing this:

websocat ws://r.100wires.com

Do NOT add the port on this command, as we are debugging if apache config is set up correctly.

If I do NOT get any response, but it appears to hang, that's good. After that, just type in a little test:

websocat ws://r.100wires.com
test

Then, when I check the terminal on my server, I can see the message popped up:

[r@ns2 ~]$ ./websocat -s 12809
Listening on ws://127.0.0.1:12809/
test

and I can type messages back and forth on the command line that way. As it is a proxy, if ssl is installed on the https domain, I think you should also be able to test through wss without actually installing the cert on the created websocat server:

websocat wss://r.100wires.com

If you are having trouble, you can try to connect first on the server in another terminal (e.g. ./websocat ws://127.0.01:12809) to see if the trouble is the websocket server itself or the proxy.

[jcameron]

Thanks, that suggestion was really useful!

I will consider this feature complete then.

[iateadonut]

Thanks.

How would I download the version of virtualmin with this feature to throw on a VPS to test?

[jcameron]

We don't have pre-release downloads yet, but wait a few days and we'll have a new version out