2

I'm currently trying to setup a mattermost-1.1.1 instance on an Ubuntu LTS 14, which was pretty straightforward. I configured the service to listen to 127.0.0.1:8065 only and want to do a ReverseProxy via Apache2 on the same host using this configuration

<VirtualHost *:443>
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateChainFile /etc/apache2/ssl/zcore_ORG_chain.pem
  SSLCertificateFile      /etc/apache2/ssl/zcore.intra.pem
  SSLCertificateKeyFile   /etc/apache2/ssl/zcore.intra.key.pem
  ServerName mattermost.zcore.intra
  ServerSignature Off
  ServerAlias mattermost
  ProxyPreserveHost On
  AllowEncodedSlashes NoDecode

  <Location />
    Require all granted
    ProxyPass http://mattermost.zcore.intra:8065
    ProxyPassReverse http://mattermost.zcore.intra:8065
  </Location>

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_error.log
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_forwarded.log common_forwarded
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_access.log combined env=!dontlog
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra.log combined
</VirtualHost>
<VirtualHost *:80>
  ServerName mattermost.zcore.intra
  Redirect permanent / https://mattermost.zcore.intra
</VirtualHost>

The redirect works fine so far, but after a few seconds logged in I get the following message displayed on the site:

We cannot reach the Mattermost service. The service may be down or misconfigured. Please contact an administrator to make sure the WebSocket port is configured properly.

[2015/10/28 10:52:00 CET] [EROR] websocket connect err: websocket: could not find connection header with token 'upgrade'
[2015/10/28 10:52:00 CET] [EROR] /api/v1/websocket:connect code=500 rid=emfn13fxjtnhpgp6nfrmoqdupw uid=f18pts15ib8xz8s4igctmm4ofa ip=192.168.3.128 Failed to upgrade websocket connection [details: ]

I guess there's something missing in my configuration.

Improve this question
1
  • I found the following configuration for nginx that should work... server { server_name mattermost.example.com; location / { client_max_body_size 50M; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Frame-Options SAMEORIGIN; proxy_pass localhost:8065; } }
    – Robert Heine
    Oct 28, 2015 at 12:25

2 Answers 2

Reset to default
1

After a whole night of digging I found a configuration that works fine for me.

<VirtualHost *:443>
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateChainFile /etc/apache2/ssl/zcore_ORG_chain.pem
  SSLCertificateFile      /etc/apache2/ssl/zcore.intra.pem
  SSLCertificateKeyFile   /etc/apache2/ssl/zcore.intra.key.pem
  ServerName mattermost.zcore.intra
  ServerSignature Off
  ServerAlias mattermost

  ProxyPreserveHost On
  ProxyRequests Off

  RewriteEngine on
  RewriteCond %{REQUEST_URI} ^/api/v1/websocket [NC,OR]
  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
  RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
  RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
  RewriteRule .* http://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
  RequestHeader set X-Forwarded-Proto "https"

  <Location /api/v1/websocket>
    Require all granted
    ProxyPassReverse http://127.0.0.1:8065
    ProxyPassReverseCookieDomain 127.0.0.1 mattermost.zcore.intra
  </Location>
  <Location />
    Require all granted
    ProxyPassReverse http://127.0.0.1:8065
    ProxyPassReverseCookieDomain 127.0.0.1 mattermost zcore.intra
  </Location>

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_error.log
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_forwarded.log common_forwarded
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_access.log combined env=!dontlog
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra.log combined
</VirtualHost>
<VirtualHost *:80>
  ServerName mattermost.zcore.intra
  Redirect permanent / https://mattermost.zcore.intra
</VirtualHost>
Improve this answer
1

you also need to do sudo a2enmod headers proxy_wstunnel

My Proxy configuration looks like the follows:

ProxyPreserveHost On
ProxyRequests Off

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/api/v3/users/websocket [NC,OR]
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:11080%{REQUEST_URI} [P,QSA,L]
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:11080%{REQUEST_URI} [P,QSA,L]
RequestHeader set X-Forwarded-Proto "https"

  <Location /api/v3/users/websocket>
    Require all granted
    ProxyPassReverse ws://127.0.0.1:11080/api/v3/users/websocket
    ProxyPassReverseCookieDomain 127.0.0.1 xxxxxx.xx
  </Location>

  <Location />
    Require all granted
    ProxyPassReverse https://127.0.0.1:11080/
    ProxyPassReverseCookieDomain 127.0.0.1 xxxxxx.xx
  </Location>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .