[HA Core] Nginx - Received X-Forwarded-For header from untrusted proxy

Configuration
1

Hello,
I’ve updated my HA-Core to 0.115 (yes, I know it is old) and I can’t login anymore.
I configured Nginx as a reverse proxy to access my HA (it worked up to 0.114 version) in this way:

server {
    listen       443 ssl;
    server_name  MY_DOMAIN;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/MY_DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/MY_DOMAIN/privkey.pem;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass http://localhost:8123;
        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /api/websocket {
        proxy_pass http://localhost:8123/api/websocket;
        proxy_set_header Host $host;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

This is most relevant part of my HA configuration file:

homeassistant:
  # Name of the location where Home Assistant is running
  name: Home
  # Impacts weather/sunrise data (altitude above sea level in meters)
  elevation: 52
  # metric for Metric, imperial for Imperial
  unit_system: metric
  external_url: "https://my.domain.tdl"
  internal_url: "http://127.0.0.1:8123"

http:
  # I also tried to comment follow line, but without success
  server_host: 0.0.0.0 
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - ::1

And this is the warning log I found in home-assistant.log, since nginx has no log in error.log file:
WARNING (MainThread) [homeassistant.components.http.forwarded] Received X-Forwarded-For header from untrusted proxy ::1, headers not processed

How can I solve this issue?

2

What is install method?

You need to add nginx server to list of trusted proxies. If docker install, need to add docker up for nginx

3

I’ve installed HA-Core in a virtual environment (via pip) on a raspberry.
Nginx is on the same machine, for this I only put 127.0.0.1 e ::1 in trusted proxies

4

comment out server_host

I believe your HA is currently only allowing the ipv4 connections and blocking ipv6

server_host list | string (Optional, default: 0.0.0.0, ::

Only listen to incoming requests on specific IP/host. By default the http integration auto-detects IPv4/IPv6 and listens on all connections. Use server_host: 0.0.0.0 if you want to only listen to IPv4 addresses. The default listed assumes support for IPv4 and IPv6.

5

As I wrote in a comment of my configuration file, I also tried to comment server_host but without success.
I also tried to disable IPv6 on my loopback to force IPv4 requests but in that case I have no log.
These are the log I found just before HA starting:

2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Setup failed for image: Requirements for image not found: ['pillow==7.2.0'].
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Unable to set up dependencies of person. Setup failed for dependencies: image
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Setup failed for person: Could not set up all dependencies.
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Unable to set up dependencies of onboarding. Setup failed for dependencies: person
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Setup failed for onboarding: Could not set up all dependencies.
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Unable to set up dependencies of frontend. Setup failed for dependencies: onboarding
2021-04-22 08:40:34 ERROR (MainThread) [homeassistant.setup] Setup failed for frontend: Could not set up all dependencies.
2021-04-22 08:40:35 ERROR (MainThread) [homeassistant.setup] Unable to set up dependencies of safe_mode. Setup failed for dependencies: frontend
2021-04-22 08:40:35 ERROR (MainThread) [homeassistant.setup] Setup failed for safe_mode: Could not set up all dependencies.
2021-04-22 08:40:35 INFO (MainThread) [homeassistant.bootstrap] Home Assistant initialized in 23.42s
2021-04-22 08:40:35 INFO (MainThread) [homeassistant.core] Starting Home Assistant
2021-04-22 08:40:35 INFO (MainThread) [homeassistant.core] Timer:starting

but I do not think this is the problem because the request does not arrive

6

You can login when no accessing through proxy and using direct HA ip correct?

what device/browser you login with?
issue occur with windows/linux?

I see breaking changes for http in 115. Nothing that obviously create an issue.

7

I cannot login in any way. I tried with different browsers and OS and I always get the same error.
I tried with a curl on my internal IP, but I get the same 404 error.
The only warning log is ::1, even though I added it to trusted proxies.
This configuration worked up to 0.144 version

8

In that case are you sure HA is started/running?
you should check with breaking changes.

9

The last log is “Starting Home Assistant”.
I tried a rollback to 0.114 with the same configuration and everything works.
I also tried to start HA (0.115) without any configuration (group, light, etc) using this configuration file:

homeassistant:
  # Name of the location where Home Assistant is running
  name: Home
  # Location required to calculate the time the sun rises and sets
  latitude: 41.8919300
  longitude: 12.5113300
  # Impacts weather/sunrise data (altitude above sea level in meters)
  elevation: 52
  # metric for Metric, imperial for Imperial
  unit_system: metric
  external_url: "https://my.domain.tdl"
  internal_url: "http://127.0.0.1:8123"

  # Customization file
  #customize: !include customize.yaml
  #customize_glob: !include customize_glob.yaml
  #packages: !include_dir_named packages

  auth_mfa_modules:
    - type: totp
      name: Authenticator app
    - type: notify

# Show links to resources in log and frontend
# introduction:

# Enables the frontend
frontend:

# Enables configuration UI
config:

logger:
  #default: critical
  default: info
  logs:
    homeassistant.components.http.ban: warning

# Uncomment this if you are using SSL/TLS, running in Docker container, etc.
http:
   use_x_forwarded_for: true
   trusted_proxies:
     - 127.0.0.1
     - ::1


# Checks for available updates
# Note: This component will send some information about your system to
# the developers to assist with development of Home Assistant.
# For more information, please see:
# https://home-assistant.io/blog/2016/10/25/explaining-the-updater/
updater:
  # Optional, allows Home Assistant developers to focus on popular components.
  # include_used_components: true

# Discover some devices automatically
discovery:

# Allows you to issue voice commands from the frontend in enabled browsers
conversation:

# Enables support for tracking state changes over time
history:

# View all events in a logbook
logbook:

# Enables a map showing the location of tracked devices
map:

# Track the sun
sun:

#group: !include groups.yaml
#automation: !include automations.yaml
#script: !include scripts.yaml
#switch: !include switch.yaml
#light: !include light.yaml
#input_boolean: !include input_boolean.yaml

bu I always get 404 error.
The only things I couldn’t turn off are HACS and alexa (installed via HACS)

10

115 is working but is also old version

At this point I think it better to try to get recent version of HA, like 2021.4.4, running without any config and logging in locally on PC browser. After that working setup your HA with NGINX.

It is possible the issue is with nginx but since you cannot login locally I am beginning to suspect OS not starting or other HA issue but unclear since nothing clearly indicated by log or behavior to me. It easier to start at beginning and add from that.

EDIT
it occurs to me that nginx logs will also show detail of connections so you should be able to see device connect and rejection or “server not found” type error if HA down

11

Eventually I did a fresh installation of last version of HA Core and I will reconfigure everything.
Thank you for your support and your suggestions.