Ubuntu 24 install and Nginx Reverse proxy

Installation Issues
1

Hi everyone,

I’m trying to set up a passbolt server behind our Nginx proxy server.
I’m not using docker. This is a standard install using the Ubuntu 24 tutorial provided. From the local network, everything is working fine. I can access the install page.
image
However from outside the lan, not so much.
Using Edge, I’m getting this:
image

Here are the technical details:
Passbolt server: Ubuntu server 64b 24.04
The reverse proxy is handling the SSL encryption, therefore the passbolt server is running on TCP 80.
Nginx conf:

server {

  listen 80;
  listen [::]:80;

  server_name bolt.newton.com;

  client_body_buffer_size     100K;
  client_header_buffer_size   1K;
  client_max_body_size        5M;

  client_body_timeout   10;
  client_header_timeout 10;
  keepalive_timeout     5 5;
  send_timeout          10;

  root /usr/share/php/passbolt/webroot;
  index index.php;
  error_log /var/log/nginx/passbolt-error.log info;
  access_log /var/log/nginx/passbolt-access.log;

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ \.php$ {
    try_files                $uri =404;
    include                  fastcgi_params;
    fastcgi_pass             unix:/run/php/php8.3-fpm.sock;
    fastcgi_index            index.php;
    fastcgi_intercept_errors on;
    fastcgi_split_path_info  ^(.+\.php)(.+)$;
    fastcgi_param            SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param            SERVER_NAME $http_host;
    fastcgi_param PHP_VALUE  "upload_max_filesize=5M \n post_max_size=5M";
  }

}

Passbolt server /etc/hosts

127.0.0.1 localhost
127.0.1.1 bolt.newton.com

/var/log/nginx/passbolt-access.log
192.168.1.1 is the reverse proxy address.

192.168.1.1 - - [06/Jun/2024:14:19:13 +0000] "GET /install HTTP/1.0" 200 3973 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0"
192.168.1.1 - - [06/Jun/2024:14:19:13 +0000] "GET /install HTTP/1.0" 200 3973 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0"

Nothing in /var/log/nginx/passbolt-error.log

Nginx Reverse Proxy Conf:

proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection $proxy_connection;
proxy_set_header X-Forwarded-Host $http_host/editors;

server{
        listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/bolt.newton.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/bolt.newton.com/privkey.pem;
        access_log /var/log/nginx/reverse-access-bolt.log;
        error_log /var/log/nginx/reverse-error-bolt.log;

        server_name bolt.newton.com;
 
        location / {
                proxy_pass http://bolt.newton.com:80;
        }
}

Reverse proxy /etc/hosts

127.0.0.1 localhost
192.168.1.7 bolt.newton.com

Reverse proxy /var/log/nginx/reverse-access-bolt.log
109.209.xx.xx- - [06/Jun/2024:16:21:14 +0200] "GET /install HTTP/1.1" 200 1658 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0"

I assume the problem is related to the reverse proxy configuration, but I could not figure out why.

2

Hello @nicolas !

What I noticed is that outside your LAN, passbolt still respond somehow.
However, it misses some stuff like CSS and image files maybe.

Could you check your browser logs from outside the lan (right click on the page > inspect > console (and also network) ?
I suspect like your browser is refusing to download the elements because you might have a page served on HTTPS while the other assets could be downloaded in HTTP. It could be blocked by the browser actually.

3

Hello @Steph,

You nailed it :
image

It is requesting these elements over http !
No idea why it does that, but it’s an interesting clue. I’ll keep searching.
Thanks !

4

Ok, I managed it the easy way.
I reset the passbolt server config and configured nginx with a dummy certificate. The idea is to make sure that all urls are written the same way with https://*. (from reverse proxy to passbolt server)
Thanks again.