Setting up Apache Proxy in Host

[rapkin61]

I try to access the tandoor container behind an apache proxy that is running on the host.
The proxy works well for other containers but tandoor seems to have problems ...
Several things do not work at al - e.g. editing recipes and thus you cannot create any new recipes.
When I click on "create a Recipe" I get redirected to
xxx.xxx.xxx.xxx/new/recipe/
Here I can type in a name and the click on "save"
this leads me to
xxx.xxx.xxx.xxx/edit/recipe/internal/9/
... but this page is almost empty. There is a circle of rotating cooking tools - that's all.
Sometimes there are several popups stating "there was an error while fetching a resource"...

The log looks rather unspectacular:

127.0.0.1 - - [12/Jan/2022:16:47:40 +0100] "POST /new/recipe/ HTTP/1.0" 302 0 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:40 +0000] "GET /edit/recipe/9/ HTTP/1.1" 302 0 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:40 +0100] "GET /edit/recipe/9/ HTTP/1.0" 302 0 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:40 +0000] "GET /edit/recipe/internal/9/ HTTP/1.1" 200 17606 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:40 +0100] "GET /edit/recipe/internal/9/ HTTP/1.0" 200 17606 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:41 +0000] "GET /static/vue/css/chunk-vendors.cc9c75c5ce23.css HTTP/1.1" 200 33932 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/css/chunk-vendors.cc9c75c5ce23.css HTTP/1.0" 200 0 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:41 +0000] "GET /static/django_js_reverse/reverse.a8c8935b7ba2.js HTTP/1.1" 200 4747 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:41 +0100] "GET /static/django_js_reverse/reverse.a8c8935b7ba2.js HTTP/1.0" 200 0 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:41 +0000] "GET /static/vue/css/edit_internal_recipe.ba65faffecc7.css HTTP/1.1" 200 112 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/css/edit_internal_recipe.ba65faffecc7.css HTTP/1.0" 200 0 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
127.0.0.1 - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/js/chunk-vendors.124c48fd4079.js HTTP/1.0" 200 0 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:47:41 +0000] "GET /static/vue/js/chunk-vendors.124c48fd4079.js HTTP/1.1" 200 531349 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
172.16.16.1 - - [12/Jan/2022:15:47:41 +0000] "GET /static/vue/js/edit_internal_recipe.51c5f5566cee.js HTTP/1.1" 200 44271 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/js/edit_internal_recipe.51c5f5566cee.js HTTP/1.0" 200 0 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
172.16.16.1 - - [12/Jan/2022:15:51:12 +0000] "GET /history/ HTTP/1.1" 200 22498 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36" "yyy.yyy.yyy.yyy"
127.0.0.1 - - [12/Jan/2022:16:51:12 +0100] "GET /history/ HTTP/1.0" 200 22498 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"

the access.log (apache) just tells the same:

yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:40 +0100] "POST /new/recipe/ HTTP/2.0" 302 328 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:40 +0100] "GET /edit/recipe/9/ HTTP/2.0" 302 337 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:40 +0100] "GET /edit/recipe/internal/9/ HTTP/2.0" 200 3425 "https://xxx.xxx.xxx.xxx/new/recipe/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/css/chunk-vendors.cc9c75c5ce23.css HTTP/2.0" 200 34357 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:41 +0100] "GET /static/django_js_reverse/reverse.a8c8935b7ba2.js HTTP/2.0" 200 5177 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/css/edit_internal_recipe.ba65faffecc7.css HTTP/2.0" 200 532 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/js/chunk-vendors.124c48fd4079.js HTTP/2.0" 200 531783 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:47:41 +0100] "GET /static/vue/js/edit_internal_recipe.51c5f5566cee.js HTTP/2.0" 200 44703 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"
yyy.yyy.yyy.yyy - - [12/Jan/2022:16:51:12 +0100] "GET /history/ HTTP/2.0" 200 3712 "https://xxx.xxx.xxx.xxx/edit/recipe/internal/9/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36"

Therefore I think this is again a problem with the (CSRF-)cookies and/or the way how the proxy forwards the headers.
This is the config for the virtual host:

SSLEngine on ServerName tandoor.picloud.mydomain.com

SSLCertificateFile   "/etc/letsencrypt/live/picloud.mydomain.com/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/picloud.mydomain.com/privkey.pem"


ErrorLog /var/log/apache2/tandoor-error.log
CustomLog /var/log/apache2/tandoor-access.log combined

RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /notifications/hub(.*) ws://0.0.0.0:8070/$1 [P,L]
ProxyPass / http://0.0.0.0:8070/

ProxyPreserveHost On
ProxyRequests Off
RequestHeader set X-Real-IP %{REMOTE_ADDR}s

Has anyone an idea how it should look?

[vabene1111]

sadly i have zero experience with apache, in general make sure to pass all headers appropriately and this should work.

if you have a working setup feel free to add it to the docs as a community guide

[smilerz]

@rapkin61 Django is heavily reliant on the headers passed. Check out this issue #1043 for discussion of what headers are required.

[rapkin61]

hmmm ... unfortunately I have absolutely no experience with nginx.
So this article to me sounds somewhat like mandarin chinese (-:
Maybe someone knows the apache equivalents for those config parameters?

[MaxJa4]

I had Apache running for a while, so I should have a config somewhere for Tandoor. I just need to probably add some headers to be safe and then I can post it here. Idk if I'll have time tomorrow, but I'll try.
Edit: Just had a look, seems like I don't have these files anymore. But I can create a new Apache config on the weekend. Probably also add it to the docs perhaps.

[MaxJa4]

Try adding these headers too @rapkin61

RequestHeader set X-Forwarded-Proto "https"
RequestHeader set Host %{REMOTE_HOST}s
RequestHeader set X-Forwarded-Host %{REMOTE_HOST}s

[rapkin61]

thanks a lot!

Looks like I got it now - this configuration works:

RequestHeader set X-Forwarded-Proto "https"
RequestHeader set Host xxx.xxx.xxx.xxx
RequestHeader set X-Forwarded-Host xxx.xxx.xxx.xxx

@MaxJa4:
with your configuration I still had these problems with the CSRF-cookies:

e.g. when logging in:
CSRF verification failed. Request aborted.

also there were still those "errors while retrieving a ressource..."

Probably this is because %{REMOTE_HOST} is the address of the client computer - (i.e. the one who submits the request)
But obviously we need to forward the headers to the destination machine (where the actual service runs). I haven't found a variable (like nginx has) in apache that could be used for that, so I had to hard-code the ip-addresses )-:

The complete proxy - section now looks that way:

ProxyPreserveHost On
ProxyRequests Off

RequestHeader set X-Forwarded-Proto https
RequestHeader set Host  xxx.xxx.xxx.xxx
RequestHeader set X-Forwarded-Host  xxx.xxx.xxx.xxx

ProxyPass / http:// xxx.xxx.xxx.xxx:8070/
ProxyPassReverse / http:// xxx.xxx.xxx.xxx:8070/

Remember ... this is only an example for proxy-ing to another ip (and port) - one could do a lot more things here.

[MaxJa4]

Thanks for letting us know. I tried to translate from nginx to Apache and nginx has a $host variable so I assumed the same is true for Apache - which seems to wrong. Glad you got it working though!