Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

SERVER_PATH not properly applied behind proxy #218

Open
ZweiEuro opened this issue Dec 30, 2023 · 0 comments
Open

SERVER_PATH not properly applied behind proxy #218

ZweiEuro opened this issue Dec 30, 2023 · 0 comments

Comments

@ZweiEuro
Copy link

Version
v1.5

Describe the bug
I am running a docker compose. The UI is behind a rproxy with nginx which is handling all the ssl stuff. LDAP should be behind the /ldap subpath. I added SERVER_PATH as well.
Navigating to example.at/ldap works fine, the top left button there does navigate to example.org/ldap, but the login button navigates to example.at/log_in which throws everything off. example.at/ldap/log_in shows the page i would expect.

Is there some text replacement incorrect?

compose:

version: '3.8'

services:
  openldap:
    image: osixia/openldap:1.5.0
    container_name: openldap
    volumes:
      - ./ldap_storage/ldap_db:/var/lib/ldap
      - ./ldap_storage/ldap_config:/etc/ldap/slapd.d
    environment:
      - LDAP_ORGANISATION=example-at
      - LDAP_DOMAIN=example.at
      - LDAP_ADMIN_PASSWORD=admin
      - LDAP_CONFIG_PASSWORD=config
      - LDAP_RFC2307BIS_SCHEMA=true
      - LDAP_REMOVE_CONFIG_AFTER_SETUP=true
      - LDAP_TLS_VERIFY_CLIENT=never

  openldapUi:
    image: wheelybird/ldap-user-manager:v1.5
    container_name: openldapUi
    environment:
      - LDAP_URI=ldap://openldap
      - LDAP_BASE_DN=dc=example,dc=at
      - LDAP_REQUIRE_STARTTLS=false
      - LDAP_ADMINS_GROUP=admins
      - LDAP_ADMIN_BIND_DN=cn=admin,dc=example,dc=at
      - LDAP_ADMIN_BIND_PWD=admin
      - LDAP_IGNORE_CERT_ERRORS=true
      - NO_HTTPS=true # we are behind an https proxy
      - PASSWORD_HASH=SSHA
      - SERVER_HOSTNAME=localhost
      - SERVER_NAME=example.at
      - SERVER_PATH=/ldap
      # For some reason it still attempts to create a CA which i will not allow in certbot folders
      # - SERVER_KEY_FILENAME=privkey.pem
      # - SERVER_CERT_FILENAME=fullchain.pem
    #volumes:
    #- ./certbot_storage/conf/live/example.at:/opt/ssl:ro
    depends_on:
      - openldap
    expose:
      - '80'

  certbot:
    container_name: certbot
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./certbot_storage/conf:/etc/letsencrypt:rw
      - ./certbot_storage/www:/var/www/certbot:rw
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

  rproxy:
    container_name: rproxy
    build:
      context: ./rproxy
      dockerfile: ./Dockerfile
    ports:
      # https
      - '443:443'
      # http
      - '80:80'
    depends_on:
      - openldapUi
    restart: unless-stopped
    volumes:
      - ./certbot_storage/conf:/etc/letsencrypt:ro
      - ./certbot_storage/www:/var/www/certbot:ro

nginx:

server {
    listen 80;
    listen [::]:80;

    server_name example.at www.example.at;
    server_tokens off;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://example.at$request_uri;
    }
}

server { ## Catch https requ to www. and redirect to non www.
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name www.example.at;
    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/example.at/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.at/privkey.pem;

    return 301 https://example.at$request_uri;
}

server {
    listen 443 default_server ssl http2;
    listen [::]:443 ssl http2;

    server_name example.at;
    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/example.at/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.at/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

	
    # forward to nginx node frontend container

    location ~ ^/ldap(.*)$ {
        resolver 127.0.0.11;

        proxy_pass http://openldapUi$1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;

    }

    location / {
        default_type text/html;
        return 200 "Intentionally left blank";
    }

}


# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant