SSL / HTTPS proxy

[dkerr64]

When trying to embedd the pyPowerwall current flow graphic into a webpage of my own I ran into the problem that browsers will block attempts to embed a insecure (http) iframe within a secure (https) webpage. I thought I would document how I solved this.

My web server is running lightttpd and it supports https proxy. In the config file I can set...

$SERVER["socket"] == "0.0.0.0:8675" {
     ssl.engine                  = "enable"
     ssl.cipher-list             = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
     ssl.pemfile                 = "/mnt/kd/ssl/webinterface.pem"
     ssl.ca-file                 = "/mnt/kd/ssl/https_ca_chain.pem"
     server.document-root        = ""
     proxy.server += ( "" =>
       ((
         "host" => "192.168.29.48",
         "port" => "8675"
       ))
     )
}

So now in my webpage, instead of pointing the iFrame at the pyPowerwall host, port 8675, I point it at my lighttpd host (as https), same port number, which is then proxy'd over to the non-secure pyPowerwall host. Works like a charm.

Replace the pem and ca-files to point at your own certificates, and the IP address of the pyPowerwall server to point at your server address.

[dkerr64]

Now for accessing weather data at port 8676 I ran into another problem which is that javascript / http requests (which I use to get the weather JSON data) to a different host may also get blocked by the browser with an Access-Control-Allow-Origin error. Again the web server has to be configured to permit that.

Again lighttpd has a config setting for that...

$SERVER["socket"] == "0.0.0.0:8676" {
    setenv.add-response-header = (
      "Access-Control-Allow-Origin" => "*"
    )
    ssl.engine                  = "enable"
    ssl.cipher-list             = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
    ssl.pemfile                 = "/mnt/kd/ssl/webinterface.pem"
    ssl.ca-file                 = "/mnt/kd/ssl/https_ca_chain.pem"
    server.document-root        = ""
    proxy.server += ( "" =>
    ((
      "host" => "192.168.29.48",
      "port" => "8676"
    ))
    )
}

And now my web page can retrieve weather data as well.

Just thought I would post this in case others attempt to do the same and run into similar problems.

[dkerr64]

To close the loop on this with the final piece of the puzzle... to proxy Grafana requires an additional setting to support websocket protocol. You need to enable that with a proxy header statement as shown below...

$SERVER["socket"] == "0.0.0.0:9000" {
     ssl.engine                  = "enable"
     ssl.cipher-list             = "aRSA+HIGH !3DES +kEDH +kRSA !kSRP !kPSK"
     ssl.pemfile                 = "/mnt/kd/ssl/webinterface.pem"
     ssl.ca-file                 = "/mnt/kd/ssl/https_ca_chain.pem"
     server.document-root        = ""
     proxy.server += ( "" =>
       ((
         "host" => "192.168.29.48",
         "port" => "9000"
       ))
     )
     proxy.header = ( "upgrade" => "enable" )
}

Grafana will also run into the Access-Control-Allow-Origin problem described above, but this is best fixed on the Grafana server by adding this statement to the grafana.env file and rebuilding the docker container...

GF_SECURITY_ALLOW_EMBEDDING=true

David

[dngray]

I think I've been having this issue with Traefik. There's a post about it here https://community.traefik.io/t/embedded-http-iframe-on-https-page/18013

I really would like a solution hmm.

[dkerr64]

I am not familiar with Traefik (but from a quick read it looks pretty interesting). As far as I can see there is no reason why the technique I document here could not be implemented in Traefik... it is pretty basic reverse proxy to take all traffic incoming on a given port and proxy it to another server. For this to work it needs to accept HTTPS on the incoming port and proxy to HTTP.

Note that I do have Grafana, pyPowerwall servers proxied through the same server. So the Domain name (or IP address) of the iframe is the same as Grafana... it is the different port numbers that the proxy server keys off to know what the desired target server is.

David

[dngray]

Solution for Traefik was posted here:

1. Create an entry point this example redirects http to https, and provides a secure port for pypowerwall

   entryPoints:
     web:
     address: ":80"
     http:
       redirections:
         entrypoint:
           to: "websecure"
           scheme: "https"
     websecure:
       address: ":443"
     pypw_secure:  # Add the entry point
       address: ":8675" # Specify the port

2. Expose the port on the Traefik container:

   traefik:
       image: traefik:latest
       container_name: traefik
       hostname: traefik
       networks:
         - traefik-proxy
       ports:
         - 80:80
         - 443:443
         - 8080:8080
         - "${PYPOWERWALL_PORTS:-8675:8675}" # Add pypowerwall port here, not on the pypowerwall container
       environment:
         LEGO_CA_CERTIFICATES: "/etc/traefik/certs/root.crt"
       volumes:
         - "/var/run/docker.sock:/var/run/docker.sock:ro"
         - "./traefik.yml:/traefik.yml:ro"
         - "/mnt/container_data/traefik/certs:/etc/traefik/certs:ro"
         - "acme:/etc/acme"
   volumes:
     acme:
   
   networks:
     traefik-proxy:
       external: true

3. Use the same cert you use for grafana. This is because that is hardcoded at:

   window.location.protocol + "//" + window.location.hostname + ":8675/";

   pypowerwall:
     image: jasonacox/pypowerwall:0.6.2t28
     container_name: pypowerwall
     hostname: pypowerwall
     restart: unless-stopped
     user: "${PWD_USER:-1000:1000}"
     env_file:
       - pypowerwall.env
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.pypowerwall.tls=true"
       - "traefik.http.routers.pypowerwall.rule=Host(`grafana.$MY_DOMAIN`)"
       - "traefik.http.routers.pypowerwall.entrypoints=pypw_secure" # Add the entry point here
       - "traefik.http.services.pypowerwall.loadbalancer.server.port=8675"

Remember to remove the entry ports from the containers, ie influx, telegraf, grafana. These ports don't need to be exposed all external traffic will go through Traefik's entry ports.

[rucknapucknavitz]

I can usually follow along, but I’m feeling super dense on this one and can’t seem to get it to work.
Do I understand correctly that traefik Host labels to both the grafana container and pypowerwall container point to the same domain (e.g., powerwall.mydomain.com)?

And then I remove all port mappings from the containers themselves (not just pypowerwall), and open a single traefik port to map to the newly created entrypoint at pypw_secure at 8675?

When I do this, I still can’t get the Power Flow to render when accessed through proxy and I also have lost it it when using local access to the grafana container (for me that’s 192.168.1.189:9900).

I have Powerwall-Dashboard and my Traefik in two separate stacks, and a lot of port overlap so had to re-map a few things on P-D. I wonder if that’s my issue…

[dngray]

Host labels to both the grafana container and pypowerwall container point to the same domain (e.g., powerwall.mydomain.com)?

In my case they did, it was a .env variable, yes they must due to the code being hardcoded to window.location.hostname

I remove all port mappings from the containers themselves (not just pypowerwall), and open a single traefik port to map to the newly created entrypoint at pypw_secure at 8675?

Yes, you won't need port mappings directly on your container, as everything will be accessed through traefik. So you shouldn't be able to access at 192.168.1.189:9900 anymore.

Powerwall-Dashboard and my Traefik in two separate stacks, and a lot of port overlap so had to re-map a few things on P-D.

Possibly, the above configs were just what I had on a machine that runs docker and traefik

[rucknapucknavitz]

Thanks for helping. I’m still totally stuck. I’d appreciate if there’s anything glaringly obvious here, otherwise I may just be stuck on local network access.

I thought maybe it was because my P-D stack was different from my Traefik stack (but same machine), and thus different networks. So I added all P-D containers to my Traefik docker network and they’re reporting as connected in Portainer.

I removed all port references within all the P-D containers.

I opened port 8675:8675 on my Traefik container.

      - target: 8675
        published: 8675
        protocol: tcp
        mode: host

Publishing as a simple - 8675:8675 had the same result.

I added an entryPoints for pypw_secure at address: :8675.

  pypw_secure:
    address: :8675

And published labels on the two P-D containers for pypowerwall and grafana, both pointing at the same domain but with different entry points (using pypw_secure for both didn’t seem to work at all and the graphs wouldn’t load):

    pypowerwall:
        image: jasonacox/pypowerwall:0.6.4t32
        container_name: pypowerwall
        hostname: pypowerwall
        restart: unless-stopped
        user: "${PWD_USER:-1000:1000}"
#        ports:
#            - "${PYPOWERWALL_PORTS:-8675:8675}"
        env_file:
            - pypowerwall.env
        profiles:
            - default
        networks:
            - my_t2_proxy
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.pypowerwall-rtr.tls=true"
            - "traefik.http.routers.pypowerwall-rtr.rule=Host(`powerwall.mydomain.com`)"
            - "traefik.http.routers.pypowerwall-rtr.entrypoints=pypw_secure"
            - "traefik.http.services.pypowerwall-svc.loadbalancer.server.port=8675"

    grafana:
        image: grafana/grafana:9.1.2-ubuntu
        container_name: grafana
        hostname: grafana
        restart: unless-stopped
        user: "${PWD_USER:-1000:1000}"
        volumes:
            - type: bind
              source: ./grafana
              target: /var/lib/grafana
#        ports:
#            - "${GRAFANA_PORTS:-9000:9000}"
        env_file:
            - grafana.env
        depends_on:
            - influxdb
        networks:
            - my_t2_proxy
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.powerwall-rtr.tls=true"
            - "traefik.http.routers.powerwall-rtr.rule=Host(`powerwall.mydomain.com`)"
            - "traefik.http.routers.powerwall-rtr.entrypoints=https"
            - "traefik.http.services.powerwall-svc.loadbalancer.server.port=9000"

I can get the grafana page to load correctly but for the Power Flow animation - which is clearly not being seen via my proxy setup. Any tips on how to troubleshoot the webpanel would be appreciated, too. May point me in the right direction.

[rucknapucknavitz]

I’ve narrowed it to my entryPoint not working. For those who have it working in Traefik are you able to resolve [https://powerwall.mydomain.com:8675/version] directly in your browser (or whatever your specific URL requires)? I’ve got the entryPoints defined, they’re showing in the Traefik dashboard), the Traefik container is managing those ports - 8675:8675, and I’ve even tried opening the 8675 port in my router. It’s as if something in my Traefik config. is blocking the entrypoint. This is going to be a bigger project running down my Traefik gremlins…