redirect loop with traefik #63
Comments
|
What do the logs of headscale-webui say? Does it at least say you're getting to /? |
That is all. Maybe test with log level debug? |
|
Goofy. /overview and / point to the same function, so if one renders the other should as well: What HTML is rendered? (in the Inspect menu in Firefox, for example) |
|
There is no HTML page that is sent, Firefox gives an error message itself. Sorry for the german language in the browser screenshot ^^
|
|
For some reason I get back a 308 Permanant Redirect with the location header |
|
So when startup checks are ran, the page does redirect based on a few conditions if any checks fail, but it looks like yours passes...
One possibility: Have you entered your API key on the /settings page yet? |
|
Yes, I have entered the API key under settings. KEY is passed directly from portainer. A docker inspect shows: Is now in quotation marks, but the redirect remains. I have additionally executed a curl call without automatic redirect: curl https://vpnadmin.example.com/ -v -u "username:<censored>"
* Trying 1.2.3.4:443...
* Connected to vpnadmin.example.com (1.2.3.4) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=vpnadmin.example.com
* start date: Mar 28 22:22:23 2023 GMT
* expire date: Jun 26 22:22:22 2023 GMT
* subjectAltName: host "vpnadmin.example.com" matched cert's "vpnadmin.example.com"
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Server auth using Basic with user 'alex'
* Using Stream ID: 1 (easy handle 0x55b99b207e90)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/2
> Host: vpnadmin.example.com
> authorization: Basic <censored>
> user-agent: curl/7.81.0
> accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 308
< content-type: text/html; charset=utf-8
< date: Wed, 29 Mar 2023 09:44:15 GMT
< location: https://vpnadmin.example.com/
< server: gunicorn
< content-length: 239
<
* TLSv1.2 (IN), TLS header, Supplemental data (23):
<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="https://vpnadmin.example.com/">https://vpnadmin.example.com/</a>. If not, click the link.
* Connection #0 to host vpnadmin.example.com left intact
|
|
Interesting.. |
|
Can you try the |
|
Unfortunately no change Does gunicorn possibly think that I come in via http and would like to redirect to https for example? |
|
That was my initial thought. It should go user -> https -> traefik -> http -> container -> http -> traefik -> https > user |
|
is the destination port 5000 correct? |
|
I have tested both. Only https and only http same result. very strange |
|
Yep, destination port is 5000. |
|
Cool. I'm able to replicate this :) |
|
ok ^^ |
|
Potential fix. Try the testing build again and omit the |
|
it works woohoo 🎉 |
|
Perfect! Don't pull updates. It will break. I'll be pushing this to main in the next week or so |
|
Closing -- Fixes will be in main in about 1.5 hours (multiarch builds take a while). Please use the main branch after it's available. Thanks! |
|
I have a similar problem with the webui behind a nginx reverse proxy. |
|
@iFargle , omitting Attempting to set |
Same issue as you. Setting it to |
When I try to go to the main page I get an infinite redirect. Until my browser gives up and gives me an "error: redirect error".
I guess I might have a thinking error somewhere or a bug in traefik, I'm not a traefik expert ^^
By the way, if I call directly the subpages like https://vpnadmin.example.com/settings or https://vpnadmin.example.com/overview then it works.
Because of my little experience with traefik, I had rather used an extra subdomain and not the path "/admin". I think it is actually nicer to reach the admin interface at vpn.example.com/admin.
My docker-compose:
Environment variables are set in portainer:
Call with curl:
The text was updated successfully, but these errors were encountered: