Hi @dpoulton ,
Thanks for your reply. It's already set to the https://joplin.myserver.net URL. The issue is that as requests hit the haproxy first on IP 192.168.50.3, then get passed to the nginx reverse proxy, which then passes the request to the Joplin Server, the request has the header changed to 192.168.50.3. This is then rejected by Joplin Server as it doesn't match https://joplin.myserver.net.
To make this a simpler question, ignore the haproxy server. So, I have a docker host running Joplin.
Proxy Server IP: 192.168.50.2
Host of the Ubuntu Server running Joplin Server running as a docker container: 192.168.1.18
The config for the docker container is:
joplin-app:
container_name: joplin-app
image: joplin/server:latest
restart: unless-stopped
depends_on:
- joplin-db
ports:
- "22300:22300"
environment:
- APP_PORT=22300
- APP_BASE_URL=http://192.168.1.18:22300
- DB_CLIENT=pg
- POSTGRES_DATABASE=joplin
- POSTGRES_USER=user
- POSTGRES_PASSWORD=password
- POSTGRES_PORT=5432
- POSTGRES_HOST=joplin-db
The Reverse Proxy server is trying to:
curl http://192.168.1.18:22300/api/ping
The response is:
{"status":"ok","message":"Joplin Server is running"}
Now try:
curl http://192.168.1.18:22300/api/sessions
The reply is:
{"error":"Not allowed: GET api/sessions"}
Checking the log file on Joplin reveals:
16:18:20 0|app | 2024-04-13 16:18:20: [error] App: 400: GET /api/sessions: ::ffff:192.168.50.2: Not allowed: GET api/sessions
16:18:20 0|app | 2024-04-13 16:18:20: App: GET /api/sessions (400) (1ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: GET /api/items/root:/info.json:/content (200) (10ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: POST /api/locks (200) (5ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: GET /api/items/root:/:/delta (200) (5ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: DELETE /api/locks/1_1_f0b4e9f65cc24227bdb2378103adcb0d (200) (3ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: GET /api/share_users (200) (4ms)
16:18:22 0|app | 2024-04-13 16:18:22: App: GET /api/shares (200) (6ms)
So at this point, how can I ensure that ANY server, let along the reverse proxy server, can get ANY content from the Joplin Server?
This is the same error I get from the Joplin app when trying to do a sync from outside my network via the Reverse Proxy Server.
The nginx Reverse Proxy config for this site:
server {
listen 80;
server_name joplin.myserver.net;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name joplin.myserver.net;
client_max_body_size 0;
underscores_in_headers on;
location / {
proxy_headers_hash_max_size 512;
proxy_headers_hash_bucket_size 64;
proxy_set_header Host $host;
proxy_hide_header X-Powered-By;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host joplin.myserver.net;
add_header Front-End-Https on;
proxy_pass https://192.168.1.18:22300;
proxy_read_timeout 90;
}
# access_log /var/log/nginx/access.log combined_ssl;
access_log /var/log/nginx/joplin.myserver.net.access.log;
error_log /var/log/nginx/joplin.myserver.net.error.log;
ssl_stapling on;
ssl_stapling_verify on;
ssl_certificate /etc/letsencrypt/live/joplin.myserver.net-0001/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/joplin.myserver.net-0001/privkey.pem; # managed by Certbot
}
I have many other services set up behind a Reverse proxy Server and I don't experience these issues so I'm confused as to why Joplin is so strict on the base URL. In my mind, this relates to how the website serves pages, not a definition of what can connect to the server.
What am I missing?