Backend and reverse proxy setup

[vladaurosh]

Is there an existing issue for this?

• I have searched the existing open and closed issues

Is your feature request related to a problem? Please describe

Just continuing discussion from #1416

Hey @jokob-sk @luckylinux
I've briefly checked what's going on based on input and guidance you've provided in the above issue.
What I see is that for some NetalertX features browser will try to connect to backend instead of frontend (this is how it previously worked). And in case you run NetalertX behind reverse proxy, you need to expose the backend as well. Correct me if I am wrong here.
If I am correct, this for sure is one weird setup (not to use some other word).

Since frontend runs on nginx, can we not use nginx and add location(s) for endpoint(s) (called on the backend), and add proxy pass to the backend?
This would make setup much more simple, without a need for new variable for the backend url.

Describe the solution you'd like

N/A

Describe alternatives you've considered

N/A

Anything else?

N/A

Am I willing to test this? 🧪

• I will do my best to test this feature on the netlertx-dev image when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.

Can I help implement this? 👩‍💻👨‍💻

• Yes
• No

[luckylinux]

Hi @vladaurosh

Please Read again the part I wrote (@jokob-sk unsure why the online Documentation doesn't have an Anchor Link whereas GitHub does):

https://docs.netalertx.com/REVERSE_PROXY/

Scroll down to Caddy + Authentik Outpost Proxy SSO, in particular the Section Flow:

The Part where your Browser "directly" contacts the Backend (on Port 20212 in the Documentation, although I will update it to Port 8443 I think, just tested it on my Side, I'll do an Update of the Documentation as soon as @jokob-sk will tell me what I also need to fix in terms of Layout since the generated Documentation Style seems a bit buggy) is shown in BLUE:

Do you need Caddy ? Nope.

You can do it:

• With built-in NGINX
• With APACHE2
• With traefik
• With NPM (NGINX Proxy Manager)
• ...

Once again there are many Ways to do it, none are "right" or "wrong" 😉.

Same as Authentik, Authelia, ... You can also use Keycloak, Zitadel, Oauth2-Proxy, etc.

@jokob-sk: Maybe I should split off Authentik SSO Part (I just saw there was a separate Authelia Chapter which I didn't see before) so we keep the Reverse Proxy better focused. Let me know if I should do that.

@vladaurosh: if all you care is about TLS Termination, you could just the built-in NGINX, and just double up & create another server Directive with a Different Port. Maybe there are ways to do with a separate Path (also with Caddy/Traefik/etc) but I guess it will just be more complicated for no apparent Reason.

Lazily copied and UNTESTED based on what I did for the REVERSE_PROXY Page and unsure if correct, but basically just create another Server that listens on a separate Port (let's go with 8443 for the Sake of Argument, I think I/will update the Documentation to that).

I just saw we might want to add another Template Variable LISTEN_ADDR_IPV6 so we could listen to both IPv4 and IPv6 at the same Time.

# Set number of worker processes automatically based on number of CPU cores.
worker_processes auto;

# Enables the use of JIT for regular expressions to speed-up their processing.
pcre_jit on;

# Configures default error logger.
error_log /tmp/log/nginx-error.log warn;

pid /tmp/run/nginx.pid;

events {
    # The maximum number of simultaneous connections that can be opened by
    # a worker process.
    worker_connections 1024;
}

http {

    # Mapping of temp paths for various nginx modules.
  client_body_temp_path /tmp/nginx/client_body;
  proxy_temp_path /tmp/nginx/proxy;
    fastcgi_temp_path /tmp/nginx/fastcgi;
    uwsgi_temp_path /tmp/nginx/uwsgi;
    scgi_temp_path /tmp/nginx/scgi;

    # Includes mapping of file name extensions to MIME types of responses
    # and defines the default type.
    include /services/config/nginx/mime.types;
    default_type application/octet-stream;

    # Name servers used to resolve names of upstream servers into addresses.
    # It's also needed when using tcpsocket and udpsocket in Lua modules.
    #resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001];

    # Don't tell nginx version to the clients. Default is 'on'.
    server_tokens off;

    # Specifies the maximum accepted body size of a client request, as
    # indicated by the request header Content-Length. If the stated content
    # length is greater than this size, then the client receives the HTTP
    # error code 413. Set to 0 to disable. Default is '1m'.
    client_max_body_size 1m;

    # Sendfile copies data between one FD and other from within the kernel,
    # which is more efficient than read() + write(). Default is off.
    sendfile on;

    # Causes nginx to attempt to send its HTTP response head in one packet,
    # instead of using partial frames. Default is 'off'.
    tcp_nopush on;


    # Enables the specified protocols. Default is TLSv1 TLSv1.1 TLSv1.2.
    # TIP: If you're not obligated to support ancient clients, remove TLSv1.1.
    ssl_protocols TLSv1.2 TLSv1.3;

    # Path of the file with Diffie-Hellman parameters for EDH ciphers.
    # TIP: Generate with: `openssl dhparam -out /etc/ssl/nginx/dh2048.pem 2048`
    #ssl_dhparam /etc/ssl/nginx/dh2048.pem;

    # Specifies that our cipher suits should be preferred over client ciphers.
    # Default is 'off'.
    ssl_prefer_server_ciphers on;

    # Enables a shared SSL cache with size that can hold around 8000 sessions.
    # Default is 'none'.
    ssl_session_cache shared:SSL:2m;

    # Specifies a time during which a client may reuse the session parameters.
    # Default is '5m'.
    ssl_session_timeout 1h;

    # Disable TLS session tickets (they are insecure). Default is 'on'.
    ssl_session_tickets off;


    # Enable gzipping of responses.
    gzip on;

    # Set the Vary HTTP header as defined in the RFC 2616. Default is 'off'.
    gzip_vary on;


    # Specifies the main log format.
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
        '$status $body_bytes_sent "$http_referer" '
        '"$http_user_agent" "$http_x_forwarded_for"';

    # Sets the path, format, and configuration for a buffered log write.
    access_log /tmp/log/nginx-access.log main;


    # Virtual host config (redirect HTTP to HTTPS)
    server {
        listen  ${LISTEN_ADDR}:80 default_server;

        # We don't currently have LISTEN_ADDR_IPv6 defined, we might want to add it
        listen  ${LISTEN_ADDR_IPv6}:80 default_server;

        server_name netalertx-server;

        location / {
            return 301 https://$host$request_uri;
        }
    }

    # Virtual host config (encrypted)
    # WebUI
    server {
        listen ${LISTEN_ADDR}:443 ssl http2;

        # Enable SSL/TLS Certificates
        ssl_certificate /certificates/fullchain.pem;
        ssl_certificate_key /certificates/privkey.pem;

        root /app/front;
        index index.php;
        add_header X-Forwarded-Prefix "/app" always;

        server_name netalertx-server;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        client_body_buffer_size 512k;
          large_client_header_buffers 64 128k;

        location ~* \.php$ {
            # Set Cache-Control header to prevent caching on the first load
            add_header Cache-Control "no-store";
                  fastcgi_pass unix:/tmp/run/php.sock;
            include /services/config/nginx/fastcgi_params;
                  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                  fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            fastcgi_connect_timeout 75;
            fastcgi_send_timeout 600;
            fastcgi_read_timeout 600;
        }
    }

    # Virtual host config (encrypted)
    # GraphQL Backend
    server {
        listen ${LISTEN_ADDR}:8443 ssl http2;

        # Enable SSL/TLS Certificates
        ssl_certificate /certificates/fullchain.pem;
        ssl_certificate_key /certificates/privkey.pem;

        server_name netalertx-server;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Contact the GraphQL Backend (Python)
        proxy_pass http://0.0.0.0:20219/;
    }

}

As I said, this is UNTESTED so I don't know if there are Syntax Errors etc.

I also don't know if this is fully Secure.

As I probably said in the other Discussion (or somewhere else), especially about proxy_set_header X-Forwarded-Proto $scheme; (or Equivalent), that's basically the Reverse Proxy saying "trust me, this Connection is encrypted". Similarly proxy_set_header X-Real-IP $remote_addr; and/or proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; will basically tell the GraphQL what your PC real IP Address is, which is needed for proper Logging and Access Control (particularly if publicly accessible Website).

[adamoutler]

There are some problems with proxy and CORS (recently introduced) right now. Eventually we will be able to configure it. but I'd say it's best to close this right now as proxies will likely not work.

[luckylinux]

@adamoutler: that's not very clear or specific as to what/why it doesn't work.

What exactly happened ?

[adamoutler]

@luckylinux We need to merge the backend and frontend ports. There are situations where the backend cannot be forwarded to the same domain name as the front. I'm going to fix it by adding a /server reverse proxy.

[adamoutler]

I pushed a PR that fixes it for me. Once #1450 is merged you can do a reverse proxy by setting BACKEND_API_URL to https://my.netalertx.com/server. Whatever your normal http/https URL is and add /server to it.

[vladaurosh]

Hey @luckylinux
There was probably misunderstanding here. What I asked about has nothing to do with reverse proxy, SSO or TLS.

It was exactly the PR @adamoutler has added:
proxy_pass http://127.0.0.1:20212/;
in the internal nginx.

Thanks @adamoutler Exactly what I was pointing to. With this change I think BACKEND_API_URL will not be needed anymore, as it is going to be NetAlertX URL (REPORT_DASHBOARD_URL) + /server

[luckylinux]

@vladaurosh: it was ABSOLUTELY not clear 👎.

[luckylinux]

@adamoutler: I admit I don't know about CORS, and e.g. I didn't know that the same Subdomain on a different Port would be seen as a Cross-Origin.

At the same Time I am a bit confused though 😕. If "already" you cannot do CORS on the same Subdomain on a different Port, you shouldn't be able to have any Remote (think: curl or Python requests) GraphQL Access anymore, should you ?

Does this mean that now we'll only have API as a possibility for remote unattended Access ?

I'm personally not a fan of GraphQL at all, but I would still like to understand where we stand.

There will be a lot of Documentation to update then.

[luckylinux]

@adamoutler: I created #1452 to describe the Changes that I/somebody needs to do to the REVERSE_PROXY.md Documentation.

Please have a look and provide Feedback (I just did a quick Edit of the Flow Diagram).

[adamoutler]

... I didn't know that the same Subdomain on a different Port would be seen as a Cross-Origin.

It's not that it's cross origin to use a different port. It's that in order to make this work on https://my.nax.com, you have to set up a reverse proxy. But because there are two ports you have to set up reverse proxy and port forwardinf and break internal IP access.

My use case: easy access on my LAN using https://NetAlertX.adamoutler.com. I can do the following

• Establish reverse proxy

• Change backend to whatever I'm using as proxy address.

• And

  • Set up fixed port forwarding on my firewall LAN so it's attached to all sites using the proxy IP on port 20212. This works but now I'm

1. exposing port 20212 outside the proxy
2. I can't manage the port using the proxy
3. I'm stuck using the proxy without the possibility of using the IP unless I reconfigure something each time I want to switch between DNS name and IP.

• Or
  • Create a subfolder proxy (this PR)

The PR handles item 1 & 2. Future work can handle CORS whitelist addresses so that I can switch between IP and Proxy.

[luckylinux]

I'm not against the PR nor your Idea (it also would work for my Case), I'd just like to better understand the Reasoning behind it 😉.

It's not that it's cross origin to use a different port. It's that in order to make this work on https://my.nax.com, you have to set up a reverse proxy. But because there are two ports you have to set up reverse proxy and port forwardinf and break internal IP access.

Why is the Case ? You just need to port forward (and NAT for IPv4) 2 Ports instead of only 1. Its further Work that can be avoided, sure. I just don't see why it would break internal IP access though.

That would be an issue in terms of "split DNS" or internal vs external DNS rather, wouldn't it ?

Sure 1 Port is easier than 2 (provided that the /path/ doesn't Mess up other Parts of the System, we could in Theory do the same for the Authentik Proxy Outpost by the Way), but I don't see 2 Ports breaking either internally or externally. Internal access shall have DNS resolve to internal IP, while external Access shall have DNS resolve to external IP.

Or, of course, GraphQL Requests shall be made local-only (127.0.0.1).

What I wanted to understand a while Back (cannot remember issue number, I think it was mainly with @jokob-sk though) was: what is the Requirement for GraphQL Access ? Is there a need for external Access (API-like via e.g. curl), or there is only a need for the GraphQL to communicate with the WebUI (in which case it should be done via 127.0.0.1 only) ? And if there is a requirement for external Access to the GraphQL Endpoint, which are they exactly and how should they be protected ?

[vladaurosh]

Reasoning behind it? Simplier setup. Why expose another port if not needed.

[luckylinux]

@vladaurosh:

You seem to have a problem both reading and writing. Not sure if I want to waste more of my Time frankly. As it's CLEARLY written above, I acknowledged that it's indeed a bit easier.

However, that's yet ANOTHER change from my Perspective (plus all the Documentation Updates) since I now need to change all the Endpoints on my End.

So yeah sure we can do Change for the sake of Change, but that's not a good Argument.

[adamoutler]

You seem to have a problem both reading and writing. Not sure if I want to waste more of my Time frankly. As it's CLEARLY written above, I acknowledged that it's indeed a bit easier.

Please be kinder to other contributors.

However, that's yet ANOTHER change from my Perspective (plus all the Documentation Updates) since I now need to change all the Endpoints on my End.

So yeah sure we can do Change for the sake of Change, but that's not a good Argument.

The PR doesn't force anyone to do anything yet. It exposes a properly configured /server endpoint which solves the different origin problem and simplifies installation. We can figure out how to use relative paths automatically later. For now the entire system will operate with both :20212 and /server. Once validated for reverse proxy we can decide if there remains any use case for 20212 or if this will be the default way to access the backend.

There is no commitment to anything right now. Only the possibility of easy access for those using reverse proxy.