Firefly behind reverse proxy nginx

[dflahaut]

I used the script Firefly III LXC to run this app on http://192.168.1.17. It works well. Now I want to access from internet with an address like firefly.xxx.xxx. I tried these lines in nginx.conf (https://docs.firefly-iii.org/references/faq/install/#i-am-using-nginx-and-want-to-expose-firefly-iii-under-budget) : it doesn't work.

I tried some others lines ... but I've still errors.

location /
proxy_pass http://192.168.1.17;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header Content-Security-Policy "base-uri 'self' http://192.168.1.17/; default-src 'self' https:;";

Do you have any idea ?

[Toastyyy3]

What do you mean it doesn‘t work? What error do you get?

[dflahaut]

for example

[Toastyyy3]

I had that issue earlier today. The problem is probably the following (please confirm:) the base href was always http. In other words: when you view the source of the webpage (so in the browser -> right click -> show source code of page) and then look for <base href=[http://YOUR.FIREFLY.DOMAIN] />.
If it says http://your.firefly.domain, it won't work and your browser won't allow you filling out forms and fields and such and it won't parse the site properly as it thinks it's insecure. If it already is https://your.firefly.domain in your case, then the problem is something else which I don't know as of now. As for the former, you somehow have to let nginx know that it's https.
So in my case that meant:

• In my reverse Proxy, if the requested protocol was https (which it always is because I enforce it), set the X-Forwarded-Proto Header to "https"
• Tell apache to look for that X-Forwarded-Proto header and if it is "https", treat the session as https.

Unfortunately, I can't help you with the specific nginx config as I use haproxy as reverse proxy and apache as webserver but the owner of firefly published his nginx config here where someone had the exact same problem:
https://github.com/orgs/firefly-iii/discussions/9569

Edit: Oh and, if applicable, remember to set TRUSTED_PROXIES in the .env file to ** as mentioned here

[SSScholl]

@dflahaut in case you never got an answer to this problem
I'm pretty sure you can update things to be 443 but in the LXC

nano /etc/apache2/sites-enabled/firefly.conf

Then add APP_URL and TRUSTED_PROXIES

<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /opt/firefly/public/

<Directory /opt/firefly/public>
Options FollowSymLinks
AllowOverride All
Require all granted

ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined

SetEnv APP_URL "https://budget.example.com"
SetEnv TRUSTED_PROXIES "*"

[SSScholl]

Well ignore what I said considering it can break things in the future. Just edit the .env variable "nano /opt/firefly/.env"