nginx proxy manager configuration

[TWART016]

Hi,

I have running a nginx proxy manager instance in docker.
Now I want to configure vikunja with nginx proxy manager.

The vikunja instance in available from the WAN. Just the login failed: Network Error

// 20211005000721
// http://192.168.178.15:3456/api/v1/login

{
  "message": "missing or malformed jwt"
}

In npm I set the domain name with
Scheme http
Forward Hostname / IP: 192.168.178.15
Forward Port: 10002
SSL Certificate
No Advanced configuration

docker-compose von vikunja:

version: '3'

services:
  db:
    image: mariadb:10
    command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    environment:
      MYSQL_ROOT_PASSWORD: supersecret
      MYSQL_USER: vikunja
      MYSQL_PASSWORD: secret
      MYSQL_DATABASE: vikunja
    volumes:
      - ./db:/var/lib/mysql
    restart: unless-stopped
  api:
    image: vikunja/api
    environment:
      VIKUNJA_DATABASE_HOST: db
      VIKUNJA_DATABASE_PASSWORD: secret
      VIKUNJA_DATABASE_TYPE: mysql
      VIKUNJA_DATABASE_USER: vikunja
      VIKUNJA_DATABASE_DATABASE: vikunja
    ports:
      - 3456:3456
    volumes:
      - ./files:/app/vikunja/files
    depends_on:
      - db
    restart: unless-stopped
  frontend:
    image: vikunja/frontend:unstable
    ports:
      - 10002:80
    environment:
      VIKUNJA_API_URL: http://192.168.178.15:3456/api/v1/
    restart: unless-stopped

Does anyone have a proxy configuration for npm?

[kolaente]

Not sure about nginx proxy manager, but have you seen the nginx reverse proxy example in the docs?

[TWART016]

Not sure about nginx proxy manager, but have you seen the nginx reverse proxy example in the docs?

I know this example. But in nginx proxy manager it looks a bit different.

In this issue there is a similar problem.
#2 (comment)

This is the config for the host

server {
  set $forward_scheme http;
  set $server         "192.168.178.15";
  set $port           10002;

  listen 80;
listen [::]:80;

listen 443 ssl http2;
listen [::]:443;

  server_name todo.mydomain;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-10/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-10/privkey.pem;

  access_log /data/logs/proxy_host-5.log proxy;

  location / {
    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

[kolaente]

So the file at conf.d/include/proxy.conf contains the proxy config adapted from the docs? Where do you proxy the api requests? If all is set up correctly, you should be able to reach /api/v1/info through the proxy - on the same domain/ip +port as the frontend.

Or you could just continue to expose the api ports and use the api directly, but that kind of defeats the purpose of a proxy.

I'm not sure if I can help you here, while I know my way around nginx I don't know how the nginx proxy manager is different. You might want to ask in the forum, someone else might be able to help you there.

[TWART016]

I created a topic in the forum
https://community.vikunja.io/t/nginx-proxy-manager-configuration/385

This is the configuration of npm. It is automatic stored in the volume /data/nginx/proxy_host.

As you can see in the docker-compose #206 the api is available with port 3456.

[TWART016]

Hi @kolaente

which of these strings are variables? Do I need to replace frontend to the IP and api to IP:Port?

server {
    listen 80;

    location / {
        proxy_pass http://frontend:80;
    }

    location ~* ^/(api|dav|\.well-known)/ {
        proxy_pass http://api:3456;
        client_max_body_size 20M;
    }
}

EDIT: listen to 80 or the port (10002) defined in the docker-compose?

  frontend:
    ports:
      - 10002:80

EDIT2: On the login page of the public domain I see this line. Is this correct?
Sign in to your Vikunja account on 192.168.178.15:3456

NPM is running on a different stack than vikunja

[kolaente]

which of these strings are variables? Do I need to replace frontend to the IP and api to IP:Port?

If you did not change the names of the containers or VIKUNJA_SERVICE_INTERFACE you don't need to change anything.

listen to 80 or the port (10002) defined in the docker-compose?

80. That's the internal port of the frontend container.

On the login page of the public domain I see this line. Is this correct?

Does it work?

[TWART016]

VIKUNJA_SERVICE_INTERFACE
I did not set VIKUNJA_SERVICE_INTERFACE or changed the container names.

Is it a problem that vikunja and NPM is not in the same docker network? I always define the IP:Port and not the internal names of the containers.

The login still fails.

// 20211027001333
// http://192.168.178.15:3456/api/v1/login

{
  "message": "missing or malformed jwt"
}

Console:
user-settings.89ce70d7.js:10 Mixed Content: The page at 'https://MYDOMAIN/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://192.168.178.15:3456/api/v1/login'. This request has been blocked; the content must be served over HTTPS.

EDIT: issue on NPM
NginxProxyManager/nginx-proxy-manager#1522

[kolaente]

Is it a problem that vikunja and NPM is not in the same docker network? I always define the IP:Port and not the internal names of the containers.

If the nginx config you showed is the one of the proxy container like in the examples it should be fine.

The login still fails.

The console message you posted tells you everything you need to know: The API URL you configured at the frontend container should be https.

On the other hand, since you are now using a proxy you should be fine to remove it all together as long as you're accessing everything only through that proxy.

[TWART016]

If the nginx config you showed is the one of the proxy container like in the examples it should be fine.

This is my nginx config now

# ------------------------------------------------------------
# MYDOMAIN
# ------------------------------------------------------------

server {
  set $forward_scheme http;
  set $server         "192.168.178.15";
  set $port           10002;

  listen 80;
listen [::]:80;

listen 443 ssl http2;
listen [::]:443;

  server_name MYDOMAIN;

  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-10/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-10/privkey.pem;

  access_log /data/logs/proxy_host-5.log proxy;

  location ~* ^/(api|dav|\.well-known)/ {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_pass       http://192.168.178.15:3456;
    client_max_body_size 20M;
  }

  location / {

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

The console message you posted tells you everything you need to know: The API URL you configured at the frontend container should be https.

I set the parameter in the compose
VIKUNJA_API_URL: http://192.168.178.15:3456/api/v1/

If I change that to https I get the error:

user-settings.89ce70d7.js:10 Mixed Content: The page at 'https://MYDOMAIN/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://192.168.178.15:3456/api/v1/info'. This request has been blocked; the content must be served over HTTPS.
(anonymous)	@	user-settings.89ce70d7.js:10
El	@	user-settings.89ce70d7.js:10
bv	@	user-settings.89ce70d7.js:10
Sr.request	@	user-settings.89ce70d7.js:10
Sr.<computed>	@	user-settings.89ce70d7.js:10
(anonymous)	@	user-settings.89ce70d7.js:9
update	@	index.e4884bbb.js:16
(anonymous)	@	user-settings.89ce70d7.js:9
fe.dispatch	@	user-settings.89ce70d7.js:9
dispatch	@	user-settings.89ce70d7.js:9
beforeCreate	@	index.e4884bbb.js:8
jt	@	user-settings.89ce70d7.js:5
ke	@	user-settings.89ce70d7.js:5
Rf.e._init	@	user-settings.89ce70d7.js:5
l	@	user-settings.89ce70d7.js:5
Xh	@	user-settings.89ce70d7.js:5
init	@	user-settings.89ce70d7.js:5
c	@	user-settings.89ce70d7.js:5
u	@	user-settings.89ce70d7.js:5
(anonymous)	@	user-settings.89ce70d7.js:5
e._update	@	user-settings.89ce70d7.js:5
n	@	user-settings.89ce70d7.js:5
Ee.get	@	user-settings.89ce70d7.js:5
Ee	@	user-settings.89ce70d7.js:5
ff	@	user-settings.89ce70d7.js:5
F.$mount	@	user-settings.89ce70d7.js:5
(anonymous)	@	index.e4884bbb.js:504

user-settings.89ce70d7.js:9 Uncaught (in promise) Error: Network Error
    at xl (user-settings.89ce70d7.js:9)
    at XMLHttpRequest.o.onerror (user-settings.89ce70d7.js:10)
xl	@	user-settings.89ce70d7.js:9
o.onerror	@	user-settings.89ce70d7.js:10
Promise.then (async)		
beforeCreate	@	index.e4884bbb.js:8
jt	@	user-settings.89ce70d7.js:5
ke	@	user-settings.89ce70d7.js:5
Rf.e._init	@	user-settings.89ce70d7.js:5
l	@	user-settings.89ce70d7.js:5
Xh	@	user-settings.89ce70d7.js:5
init	@	user-settings.89ce70d7.js:5
c	@	user-settings.89ce70d7.js:5
u	@	user-settings.89ce70d7.js:5
(anonymous)	@	user-settings.89ce70d7.js:5
e._update	@	user-settings.89ce70d7.js:5
n	@	user-settings.89ce70d7.js:5
Ee.get	@	user-settings.89ce70d7.js:5
Ee	@	user-settings.89ce70d7.js:5
ff	@	user-settings.89ce70d7.js:5
F.$mount	@	user-settings.89ce70d7.js:5
(anonymous)	@	index.e4884bbb.js:504

On the other hand, since you are now using a proxy you should be fine to remove it all together as long as you're accessing everything only through that proxy.

Remove the VIKUNJA_API_URL in the docker-compose?

[kolaente]

If I change that to https I get the error:

Did you try in a private tab after restarting the container?

The error seems to indicate it is still using the http URL.

Remove the VIKUNJA_API_URL in the docker-compose?

Yeah exactly.

[TWART016]

I removed the line from the docker-compose. Now I can login and there is no error with the public domain.

If I open the interal IP:Port I cannot login because the sign in account is Sign in to your Vikunja account on 192.168.178.15:10002 and not Sign in to your Vikunja account on 192.168.178.15:3456.

it is not possible to use a local login in parallel?

[kolaente]

it is not possible to use a local login in parallel?

It should be possible but you will probably need to manually change the ip address in Vikunja's frontend.

[TWART016]

Ok thanks. For the end user this is not ideal but it works.

[TheBig-O]

So, I had the same issue and sorted out a viable solution for using NGINX Proxy Manager with a Docker install of Vikunja. I've tried to detail the method here: https://github.com/TheBig-O/Vikunja-NGINX-Proxy-Manager

[kolaente]

@TheBig-O That looks great! Do you want to submit a PR to add this to the docs?