Websocket error on custom domain with SSL (Synology)

[Djiest]

I have HA running on my Synology NAS with a custom domain from DuckDNS and SSL from LetsEncrypt. I’m using my Synology as proxy server (which basically is nginx).
My router has port forwards for 443 to my Synology

https://foo.duckdns.org shows the Home Assistant login page. However when trying to login, the login page gives an error

Unable to connect to Home Assistant. Retry

In my console I can see that the websocket gives an error

Error during WebSocket handshake: Unexpected response code: 400

Login itself works, because when I enter the wrong credentials, it states

Invalid username or password

Using HA on the local IP works flawless.

Does anybody know why I can not use HA remote via my custom domain & SSL?

Below are screenshots of my configurations

Port forwards on router

Reverse Proxy Rules in Synology

Certificate for domain

I’ve checked my Nginx configuration and it hass a passthrough for HA

And this is in my configuration.yaml

Hope anyone can help!

[fredrike (Fredrik Erlandsson)]

Your HA instance is not running on 127.0.0.1. In HA conf change 127.0.0.1 to the ip of your nas and the info in proxy pass for nginx should definitely not be 127.0.01:8123 more likely the ip ip your nas, (192.1bluuurrr). There is never any point in blurring a private ip…

These are my settings:

http:
  base_url: https://hassio.myds.me
  server_port: 8124
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - 192.168.1.2

[dicko (Martyn)]

Hi

When did this happen ? Mine was also all OK after setting up last week and is now at the same stage as yours when out of the house and on mobile data.

I have tried playing around with the headers info but it did nothing.

I just cant remember when 107.7 came out as it was working up to Thursday I think. With been on lockdown lol.

Thanks

Martyn

[Djiest]

Thanks @fredrike that solved my issue. You truly are a Great Contributor

[Djiest]

@dicko I did a clean install with the Hass.io package by @fredrike

[erik7 (Erik)]

A few questions:
Is the base_url still needed/valid with 0.110 with the External/Internal URL?
Is server_port: 8124 correct?

http:
  base_url: https://hassio.myds.me
  server_port: 8124
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - 192.168.1.2

And last one: I created certificate with DuckDNS addon on HA, but I see in first post it has been added or imported on Synology NAS?
Whenever I go to xxxx.duckdns.org it tell me that certificate is wrong (it uses the already on the NAS existing xxxx.synology.me certificate)

[Mariusthvdb (Marius)]

@erik7

Is the base_url still needed/valid with 0.110

do you see it listed here? HTTP - Home Assistant

Also, did you read this: 0.110: Speed! OpenZWave beta, HomeKit Cameras, ONVIF, Calendars - Home Assistant under Http? it even has a link to Add get_url helper, deprecate base_url by frenck · Pull Request #35224 · home-assistant/core · GitHub

[erik7 (Erik)]

Thanks for being critical! You point is clear!
Sorry i bothered you.

I was asking because I’m struggling already for a long time to get things working, I tried many options and configurations and I’m at the point to give up.

[Mariusthvdb (Marius)]

cool. since your posting in a Synology thread:

are you having issues with Synology, or general issues with in/external_url.
You set your own port, so use the port you set in your own config.

Cant really help you with the Synology question, since I don’t run HA on my Synology.

[erik7 (Erik)]

Believe it or not, it is finally finally working! And the trigger was in post #1.

What didn’t work before did work today, I was able to register the Let’s Encrypt certificate (xxx.duckdns.org) directly on my Synology NAS. I assume some other settings I found here helped as well.

[valepe (Valerio)]

I have a similar setup with external port 18881 (not the real one). Reverse proxy on my Synology to http instance of HA.
All work well but some time when I try to connect remotely it can’t connect. I must retry in a couple of seconds and then works. Same thing for the Google integration. When this happens I saw a websocket error in the log (Disconnected: Did not receive auth message within 10 seconds).
I haven’t configured the http: section but I had add the trusted_networks with the full range of my home network.

[Mulperi]

Thank you, great post.
I got it working with your configurations, both from internal and external by leaving out the base_url and server_port.

[el-Salmon]

It’s not need to configure the http: in Home Assistant. Just enable the SSL websocket in the reverse proxy of NGINX conf:

location /<homeassistant_path_here> {
    proxy_pass ​http://192.168.1.2:8123;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 86400;
}