Reverse proxy NGinx

Configuration
1

Just setting up my first HA. Currently running hassio it in a docker on Ubuntu 17.04 VM.

I already have a Webserver managing running Nginx with reverse proxies Plex, PlexRequests, Organizr etc.

Upon reverse proxying Hass.io the page doesn’t seem to load properly. It does load, but only brings through a blank page with the blue bar across the top.

My nginx location as follows, I mostly copied this from the wiki.

location /Hassio {
    #include C:/WPNXM/bin/nginx/conf/cookie_direct_blocking.conf;
		auth_request /auth-admin;
        proxy_pass http://192.168.0.27:8123;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;	
}

Can anyone see what may be the problem?

Cheers

2

Here is my NGINX working config:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    # Update this line to be your domain
    server_name <MYDOMAINNAME>;

    # These shouldn't need to be changed
    listen 80 ipv6only=off;
    return 301 https://$host$request_uri;
}

server {
    # Update this line to be your domain
    server_name <MYDOMAINNAME>;

    # Ensure these lines point to your SSL certificate and key
    ssl_certificate /etc/letsencrypt/live/<MYDOMAINNAME>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<MYDOMAINNAME>/privkey.pem;
    # Use these lines instead if you created a self-signed certificate
    # ssl_certificate /etc/nginx/ssl/cert.pem;
    # ssl_certificate_key /etc/nginx/ssl/key.pem;

    # Ensure this line points to your dhparams file
    ssl_dhparam /etc/nginx/ssl/dhparams.pem;


    # These shouldn't need to be changed
    listen 443 ipv6only=off http2; # if your nginx version is >= 1.9.5 you can also add the "http2" flag here
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
    ssl on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    access_log /var/log/nginx/hass.access.log;
    error_log /var/log/nginx/hass.error.log;

    proxy_buffering off;

    location / {
        proxy_pass http://<IPorHOSTNAMEtoHASS>:8123;
        proxy_set_header Host $host;
        proxy_redirect http:// https://;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}
1 Like
3

I get a 404 error going straight to domain.com/hass now after adding

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;

However, after adding domain.com/hass/states to the URL it loads the page in the same way it previously loaded

Obviously my nginx config has a lot of other none HA stuff in there so I’m trying to add stuff without effecting what i’ve already added and I can’t see what yours has which I’m missing, at least nothing obvious

4

It’s my understanding there is an issue with using subdirectories, but using subdomains works fine.

5

Ahhh I see, I’ll try that. Thanks.

6

Could you guys add how your docker network is set up, please.
Those ip addresses don’t mean a thing if it’s not explained whether it’s a bridged, host, macvlan, … network.

For example, by default you will not a able to reverse proxy to a container who’s just accessible from a br network.
You might perfectly be able to access a container on 10.10.0.50 via the macvlan network, which is an address in your 10.10.0.0/16 LAN. To get back to home automation, while you might easily access it on http://10.10.0.50:8123 from your LAN, you will not be able to reverse proxy to it, because docker by default blocks communication between its internal network (on which I assume your nginx proxy container resides) and the macvlan network. Unless you add route(s) to achieve that.

7

I use --net=host on my docker containers for nginx and HA. Then everything is just different ports on my Ubuntu machine. I don’t use macvlan for anything.