Reverse Proxy Issue

[AmansRevenger]

• code-server version: v1.1156-vsc1.33.1
• OS Version: Ubuntu 18.04

Description

Reverse Proxy doesnt work at all.

It either results in failed SSL Handshake or

this:

Reverse Proxy Settings with working grafana above:

What am I missing?

[giantcow]

Your proxy pass needs to be http://localhost:8443 not http://giovanni:8443 I believe. I'm not sure where you got giovanni from.

[AmansRevenger]

giovanni is the hostname of the server in the network where the docker containers and services run, nginx itself is a docker container, so localhost wont work...

[fbartels]

To me it seems the issue is that you are trying to proxy Code-Server as a subfolder. AFAIK it has to run in root of the domain.

[AmansRevenger]

So mywebsite.com/vscode would never work?

[fbartels]

No, at least not how it is currently designed. You would need to setup vscode.mywebsite.com.

A lot of programs are designed this way today. With sni and free certs from let's encrypt this is also not much work. Only potential roadblock would be DNS providers not allowing additional DNS entries.

[AmansRevenger]

I already use letsEncrypt, but I dont think I can setup a whole subdomain...

[deansheather]

At the moment (until #722 is merged), code-server doesn't work when it's not mounted at root (/) in your reverse proxy.

You should be able to easily issue a new certificate for a subdomain on your domain through letsencrypt very easily, and then create a new virtual host in nginx.

[abubakar-bilal]

@deansheather I just created a subdomain and added configuration for proxy. But it gives me following error

Nginx conf

server {
  listen 443 ssl;
  server_name ide.mysite.com;

  location / {
    proxy_pass http://localhost:8443;
    proxy_set_header Host            $host:$server_port;
    proxy_set_header X-Forwarded-For $remote_addr;
    add_header 'Access-Control-Allow-Origin' 'https://mysite.com';
    add_header 'Access-Control-Allow-Origin' 'http://localhost';
    add_header 'Access-Control-Allow_Credentials' 'true';
  }
}

Error
WebSocket connection to 'wss://ide.mysite.com/' failed: Error during WebSocket handshake: Unexpected response code: 200

https://ide.mysite.com

[deansheather]

@abubakar-bilal Add the following to your location block:

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;

[abubakar-bilal]

Hey @deansheather

Here is an issue, sub_filter is not working with above #770 (comment) proxy settings. People are saying that because you have gzip enabled therefore it's not working. And when I do this
proxy_set_header Accept-Encoding "";

Code server starts giving me Not Found and console inspect says this

Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-jKkgppGJ08cqS5XKPdlf/Mdph8lsIR979iy7r3fw7Mw='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.

A bad HTTP response code (404) was received when fetching the script.

Can you please guide me how can I achieve this. I want to use sub_filter on nginx level with proxy pass of code server.

[DarkIrata]

Hey!
Having a running server behind a reverse proxy through nginx.

  listen 443 ssl;
  server_name code.MYDOMAIN.TLD;

  location / {
        # redirect all HTTP traffic
        proxy_pass http://10.0.2.5:8443/;

        proxy_set_header  Host 10.0.2.5:8443;
        proxy_set_header  X-Real-IP $remote_addr;
        proxy_set_header  X-Forwarded-Proto https;
        proxy_set_header  X-Forwarded-For $remote_addr;
        proxy_set_header  X-Forwarded-Host $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

...CERTBOT SSL THINGS...

this configuration (even with less proxy_set_header works fine). The reason i have them all is that my problem is that while the reverse proxy works fine, could it be that the forwarded headers gets ignored?
In the code-server log i only see the IP from the nginx server (10.0.2.2).
INFO WebSocket opened / {"client":5,"ip":"10.0.2.2"}

[deansheather]

@abubakar-bilal GH-826 should fix the Accept-Encoding issue you have and allow you to use substitution filters in your reverse proxy.

@DarkIrata code-server doesn't have any mechanism to trust reverse proxies, nor is it needed since code-server doesn't do anything with remote IP addresses (except for logging them). If you'd like to log access to your code-server instance with nginx (or any other reverse proxy), I'd recommend using the access_log.

[yihengli]

@abubakar-bilal GH-826 should fix the Accept-Encoding issue you have and allow you to use substitution filters in your reverse proxy.

Cannot wait to test this fix, as using substitution filters may allow users to add customized styles and fonts resources directly into the browser, potentially a hackaround for #760 .

(Or let me know if there are more native ways for code-server to customized fonts etc.)

[abubakar-bilal]

@deansheather Thanks so much for this fix. I would like to hear how can I test this on my side. Because currently I download the release and running that on my machine. How can I test this PR to see if my issue fixed.

@yihengli Yes if this works, then definitely custom styling issues will be fixed.

Thanks so much for all the support provided by you guys. Really appreciate that.