Problem setting up reverse proxy with docker compose

[nickchen120235]

Hi community! I'm trying to secure my setup with https. Here's what I have so far.

docker-compose.yml

services:
  app:
    image: marcobaobao/yt-dlp-webui
    volumes:
      - /mnt/ssd/Downloads:/downloads # replace <your dir> with a directory on your host system
    healthcheck:
      test: curl -f http://localhost:3033 || exit 1
    restart: unless-stopped
  reverse-proxy:
    image: 'nginx:1-alpine'
    restart: unless-stopped
    volumes:
      - type: bind
        source: /path/to/cert.pem
        target: /path/to/cert.pem
      - type: bind
        source: /path/to/privkey.pem
        target: /path/to/privkey.pem
      - type: bind
        source: ./app.conf
        target: /etc/nginx/conf.d/app.conf
    depends_on: [app]
    ports: [127.0.0.1:3033:443]

app.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    #listen 443 quic reuseport;
    listen 443 ssl;
    server_name yt-dlp.my-domain.dev;

    location / {
        proxy_pass http://app:3033/;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        client_max_body_size    20000m;
        proxy_connect_timeout   3000;
        proxy_send_timeout      3000;
        proxy_read_timeout      3000;
        send_timeout            3000;
    }

    #location /rpc/ws {
    #    proxy_pass http://app:3033/rpc/ws;
    #    proxy_http_version 1.1;
    #    proxy_set_header Host $host;
    #    proxy_set_header Upgrade $http_upgrade;
    #    proxy_set_header Connection $connection_upgrade;

    #    client_max_body_size    20000m;
    #    proxy_connect_timeout   3000;
    #    proxy_send_timeout      3000;
    #    proxy_read_timeout      3000;
    #    send_timeout            3000;
    #}

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/privkey.pem;
}

While the https connection succeeds (aka I can load the webpage), the underlying websocket connection doesn't seem to work. It does switch to websocket but it is not receiving any message.

Any help would be appreciated. Thanks!

[marcopiovanello]

hello @nickchen120235!

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    #listen 443 quic reuseport;
    #listen 443 ssl;
    listen 80;
    server_name localhost;

    location / {
        proxy_pass http://app:3033;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        client_max_body_size    20000m;
        proxy_connect_timeout   3000;
        proxy_send_timeout      3000;
        proxy_read_timeout      3000;
        send_timeout            3000;
    }

    #ssl_certificate /path/to/cert.pem;
    #ssl_certificate_key /path/to/privkey.pem;
}

this is working for me with http, try reintroduce https and let me know!

[nickchen120235]

Hi thanks for replying. On localhost it works fine.

[nickchen120235]

Hmm. So I apply this config on my production server and it works fine now. Outside the reverse proxy there's still a layer of zero trust framework (for fun) that handles the outgoing connection and DNS resolving, The reverse-proxy container is actually exposed on localhost only. I guess this problem is on my side. Anyway thanks for the help.