2

I'm currently trying to setup a mattermost-1.1.1 instance on an Ubuntu LTS 14, which was pretty straightforward. I configured the service to listen to 127.0.0.1:8065 only and want to do a ReverseProxy via Apache2 on the same host using this configuration

<VirtualHost *:443>
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateChainFile /etc/apache2/ssl/zcore_ORG_chain.pem
  SSLCertificateFile      /etc/apache2/ssl/zcore.intra.pem
  SSLCertificateKeyFile   /etc/apache2/ssl/zcore.intra.key.pem
  ServerName mattermost.zcore.intra
  ServerSignature Off
  ServerAlias mattermost
  ProxyPreserveHost On
  AllowEncodedSlashes NoDecode

  <Location />
    Require all granted
    ProxyPass http://mattermost.zcore.intra:8065
    ProxyPassReverse http://mattermost.zcore.intra:8065
  </Location>

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_error.log
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_forwarded.log common_forwarded
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_access.log combined env=!dontlog
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra.log combined
</VirtualHost>
<VirtualHost *:80>
  ServerName mattermost.zcore.intra
  Redirect permanent / https://mattermost.zcore.intra
</VirtualHost>

The redirect works fine so far, but after a few seconds logged in I get the following message displayed on the site:

We cannot reach the Mattermost service. The service may be down or misconfigured. Please contact an administrator to make sure the WebSocket port is configured properly.

[2015/10/28 10:52:00 CET] [EROR] websocket connect err: websocket: could not find connection header with token 'upgrade'
[2015/10/28 10:52:00 CET] [EROR] /api/v1/websocket:connect code=500 rid=emfn13fxjtnhpgp6nfrmoqdupw uid=f18pts15ib8xz8s4igctmm4ofa ip=192.168.3.128 Failed to upgrade websocket connection [details: ]

I guess there's something missing in my configuration.

Improve this question
1
  • I found the following configuration for nginx that should work... server { server_name mattermost.example.com; location / { client_max_body_size 50M; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Frame-Options SAMEORIGIN; proxy_pass localhost:8065; } } – Robert Heine Oct 28 '15 at 12:25
1

After a whole night of digging I found a configuration that works fine for me.

<VirtualHost *:443>
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLHonorCipherOrder on
  SSLCipherSuite "ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH"
  Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
  SSLCompression Off
  SSLCertificateChainFile /etc/apache2/ssl/zcore_ORG_chain.pem
  SSLCertificateFile      /etc/apache2/ssl/zcore.intra.pem
  SSLCertificateKeyFile   /etc/apache2/ssl/zcore.intra.key.pem
  ServerName mattermost.zcore.intra
  ServerSignature Off
  ServerAlias mattermost

  ProxyPreserveHost On
  ProxyRequests Off

  RewriteEngine on
  RewriteCond %{REQUEST_URI} ^/api/v1/websocket [NC,OR]
  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
  RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
  RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
  RewriteRule .* http://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
  RequestHeader set X-Forwarded-Proto "https"

  <Location /api/v1/websocket>
    Require all granted
    ProxyPassReverse http://127.0.0.1:8065
    ProxyPassReverseCookieDomain 127.0.0.1 mattermost.zcore.intra
  </Location>
  <Location />
    Require all granted
    ProxyPassReverse http://127.0.0.1:8065
    ProxyPassReverseCookieDomain 127.0.0.1 mattermost zcore.intra
  </Location>

  LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
  ErrorLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_error.log
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_forwarded.log common_forwarded
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra_access.log combined env=!dontlog
  CustomLog /var/log/apache2/mattermost.zcore.intra/mattermost.zcore.intra.log combined
</VirtualHost>
<VirtualHost *:80>
  ServerName mattermost.zcore.intra
  Redirect permanent / https://mattermost.zcore.intra
</VirtualHost>
Improve this answer
1

you also need to do sudo a2enmod headers proxy_wstunnel

My Proxy configuration looks like the follows:

ProxyPreserveHost On
ProxyRequests Off

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/api/v3/users/websocket [NC,OR]
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:11080%{REQUEST_URI} [P,QSA,L]
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:11080%{REQUEST_URI} [P,QSA,L]
RequestHeader set X-Forwarded-Proto "https"

  <Location /api/v3/users/websocket>
    Require all granted
    ProxyPassReverse ws://127.0.0.1:11080/api/v3/users/websocket
    ProxyPassReverseCookieDomain 127.0.0.1 xxxxxx.xx
  </Location>

  <Location />
    Require all granted
    ProxyPassReverse https://127.0.0.1:11080/
    ProxyPassReverseCookieDomain 127.0.0.1 xxxxxx.xx
  </Location>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.