I have been running HA (in virtual machine) behind Apache httpd reverse proxy without issues.
Starting yesterday (after upgrading to 2022.3.1?) I can no longer access HA using the reverse proxy. Accessing local HA url still works fine.
No (proxy) error in HA log.
In my Apache log:
[proxy:error](70007)The timeout specified has expired: AH00957: http: attempt to connect to <my_internal_ha_ip>:8123 (<my_internal_ha_ip>) failed
[proxy_http:error] [pid 28562] [client <my_external_ip>:61064] AH01114: HTTP: failed to make connection to backend: <my_internal_ha_ip>
The client <my_external_ip>
mentioned in the Apache error is in the list of trusted_proxies of the HA config:
http:
use_x_forwarded_for: true
trusted_proxies:
- <my_external_ip>
- <my_internal_ip>
Suggestions?
To reproduce using curl
(without having to provide token) I have created a test file in my www folder
(echo "test" >| config/www/test.txt
)
Works:
curl -v http://homeassistant.local:8123/local/test.txt
Fails:
curl -v https://<my_external_url>/local/test.txt
(and the same for loading HA in the browser)
I don’t see a proxy related error in the HA log.
So, this error is NOT in the log:
ERROR (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from <an_ip_address>, but your HTTP integration is not set-up for reverse proxies
Using default logging level: warning
My Apache httpd config:
<VirtualHost *:443>
ServerName <my_external_url>
ProxyPreserveHost On
ProxyRequests off
ProxyPass / http://<my_internal_ha_ip>:8123/
ProxyPassReverse / http://<my_internal_ha_ip>:8123/
ProxyPass /api/websocket ws://<my_internal_ha_ip>:8123/api/websocket
ProxyPassReverse /api/websocket ws://<my_internal_ha_ip>:8123/api/websocket
RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) ws://<my_internal_ha_ip>:8123/$1 [P,l]
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
RewriteRule /(.*) http://<my_internal_ha_ip>:8123/$1 [P,l]
CustomLog "/var/log/apache2/home_access_log" combinedvhost
ErrorLog "/var/log/apache2/home_error_log"
# tried with X-Frame-Options, same result
# Header set X-Frame-Options SAMEORIGIN
# tried with remoteip_module / X-Forwarded-For, same result
#<IfModule remoteip_module>
# RemoteIPHeader X-Forwarded-For
# RemoteIPTrustedProxy <my_internal_ip>
# # also tried:
# RemoteIPInternalProxy <my_internal_ip>
#</IfModule>
SSLProxyEngine On
SSLCertificateFile /etc/letsencrypt/live/.../fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/.../privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/.../chain.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>