internal reverse proxy from 20212 to 20211/server

[adamoutler]

Summary

Adds a reverse proxy to netalertx:20211/server. This is intended to assist with CORS errors by ensuring the backend API is accessible under the same origin as the frontend.

Security Considerations

• Backend and Frontend Access Levels: No security concerns. Access to the frontend inherently requires the browser to have access to the backend to function for API use, so exposing the backend at the same access level does not introduce additional risk.

Known Limitations

This PR does not address the current behavior where backend-provided URLs (e.g., https://my.netalertx.com/server) are not respected by the UI. For example, the /server prefix is ignored in some JavaScript-generated requests. This issue is related to frontend logic and is outside the scope of this PR.

Future Work

This PR provides the necessary access method (/server) so that the JavaScript/PHP behavior of URL truncation of BACKEND_API_URL can be corrected or properly implemented in a future update.

Summary by CodeRabbit

• Infrastructure
  • Enabled API server accessibility through /server/ path with improved request routing, header management, and timeout handling.
  • Updated API documentation to load correctly under the new server path configuration.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Configures a new reverse-proxy endpoint at /server/ in nginx that routes requests to a backend service on port 20212, and updates Swagger UI to use relative paths for the OpenAPI specification to support multiple hosting contexts.

Changes

Cohort / File(s)	Summary
New /server/ reverse-proxy configuration install/production-filesystem/services/config/nginx/netalertx.conf.template	Added reverse-proxy location block for /server/ that routes to http://127.0.0.1:20212/. Includes HTTP method whitelisting, proxy headers (Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto), Authorization header propagation, extended 24h timeouts, and X-Powered-By header suppression. Redirect from /server to /server/ included.
Swagger UI OpenAPI spec path update server/api_server/openapi/swagger.html	Changed OpenAPI spec URL from absolute path (/openapi.json) to relative path (openapi.json) to support loading under different hosting contexts (e.g., /docs or /server/docs).

Sequence Diagram

sequenceDiagram
    participant Client
    participant Nginx as nginx<br/>(/server/)
    participant Backend as Backend Service<br/>(:20212)

    Client->>Nginx: GET /server/api/endpoint
    Nginx->>Nginx: Validate HTTP method
    Nginx->>Backend: Forward request with headers<br/>(Host, X-Real-IP, Authorization,<br/>X-Forwarded-Prefix: /server)
    Backend->>Backend: Process request
    Backend->>Nginx: Response
    Nginx->>Nginx: Normalize redirect<br/>to /server/
    Nginx->>Client: Response with<br/>X-Powered-By hidden

Loading

Poem

🐰 A proxy path, so neat and clean,
Routes to port twenty-two-twelve, unseen,
With relative specs, the Swagger blooms,
In any hosted room! 🏠✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title clearly and concisely describes the main change: adding an internal reverse proxy configuration that routes requests from port 20212 to port 20211's /server endpoint.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@server/api_server/openapi/swagger.html`:
- Around line 18-21: The Swagger UI is using a relative spec URL causing 404s
when swagger.html is served under a subpath; update the SwaggerUIBundle
configuration so the url property points to the absolute backend spec path (e.g.
"/openapi.json") or compute the absolute path from the page base (using
window.location.origin + '/openapi.json' or reading a <base> tag) inside the
swagger.html initialization (the object passed to SwaggerUIBundle where url:
'openapi.json' is currently set) so the UI always requests the spec from the
correct absolute endpoint.

[adamoutler]

Actually, this does solve the problem. I'm able to use a reverse proxy with this setup. eg.

However, changing the backend url requires a server restart. A refresh doesn't handle it. The backend has a problem refreshing data. Normally you can refresh using the icon at the top, and then refresh the page in developer mode, but the backend doesn't get updated here in this case. Since CORS was introduced I was not able to view this page on a DNS.

Maybe there will be no future work.

[vladaurosh]

@adamoutler Is BACKEND_API_URL actually needed after this change? If it is set internally to REPORT_DASHBOARD_URL/server I guess it's not needed anymore.

[adamoutler]

@adamoutler Is BACKEND_API_URL actually needed after this change? If it is set internally to REPORT_DASHBOARD_URL/server I guess it's not needed anymore.

That could be a future improvement.

[luckylinux]

#1452 will track the Change needed to REVERSE_PROXY.md in what concerns the Documentation Aspect.

[adamoutler]

this is kinda a standalone change just exposing the port 20212 on /server instead of making it mandatory to access two separate ports.

flowchart LR
  client[Client] -->|Direct| p20211[(Server :20211)]
  client -->|Direct| p20212[(Server :20212)]

  p20212 -->|Reverse proxy| rp[Proxy rules]
  rp -->|/server -> :20211/server| p20211
  svc20211[20212 Service on :20211<br> path /server]
  p20211 --> svc20211

Loading

[jokob-sk]

Doesn't this have to be dynamic if someone changes the default PORT?

[adamoutler]

No. With this system we can eventually stop exposing the port. This will be a fixed port only available to 127.0.0.1 as far as I know. There is no external access.

[adamoutler]

Users will configure the frontend port. the frontend port will automatically handle /server as a part of itself.