Reverse proxy requires Host to be set in headers

[grisu48]

Hey people.

Since some time my https://photo.feldspaten.org instance is broken, probably due to the v5 upgrade.

I run lychee as a podman container with docker.io/lycheeorg/lychee:latest. I have the APP_URL configured and pointing to https://photo.feldspaten.org, both as environment variable for podman and present in the /conf/.env file within the container.

However, if I check the resource URLs on https://photo.feldspaten.org then they all point to the container ip 10.88.0.12 and I don't know what I'm doing wrong here.

I check the env variables within the container, and APP_URL is set properly:

# podman exec -ti lychee /bin/env
container=podman
USER=lychee
PHP_TZ=Europe/Amsterdam
PUID=1000
PGID=1000
APP_URL=https://photo.feldspaten.org
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=photo.feldspaten.org
TERM=xterm
HOME=/root

The release notes state explicitly that starting from v5 the APP_URL needs to be set, which I did, so I fail to see why this is still broken. Anyone has an idea?

[ildyria]

You are mistaking .env and your environment variables.
There should be a .env file at the root of Lychee with those. That is also where you set up your database connection.

Because you are using LycheeOrg/Lychee, you should have a lychee/conf folder in which you will find your .env that is where you want to apply your changes.

[grisu48]

Thanks for the answer. I did apply APP_URL both, as environmental variable and in .env as you can see here:

# podman exec -ti lychee /bin/bash
root@photo:/var/www/html/Lychee# grep 'APP_URL' .env
APP_URL=https://photo.feldspaten.org
root@photo:/var/www/html/Lychee# 

For completeness, I start the container as systemd service as follows:

ExecStart=/usr/bin/podman container run --cidfile=%t/%n.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon --replace \
        --name lychee \
        --hostname photo.feldspaten.org \
        --env PHP_TZ=Europe/Amsterdam \
        --env APP_URL=https://photo.feldspaten.org \
        --volume /mnt/RAID/lychee/conf:/conf:Z \
        --volume /mnt/RAID/lychee/uploads:/uploads:Z \
        --volume /mnt/RAID/lychee/sym:/sym:Z \
        --ip 10.88.0.12 \
        --label io.containers.autoupdate=image \
        --detach=True \
        --memory 2g \
        docker.io/lycheeorg/lychee:latest

I have a .env file in /mnt/RAID/lychee/conf, which ends up in /conf/.env in the container.
And in the container there is a symlink /var/www/html/Lychee/.env -> /conf/.env. The contents of the symlink file match the contents of the .env file in my /conf directory.

From what I can see the APP_URL is in the .env file (it always was) but still it won't work - what could I have done wrong here?

[ildyria]

Reverse proxy messing up maybe ? I find that one very surprising.

[grisu48]

Yes, that was it! I needed to set the Host header in my nginx configuration:

location / {
    proxy_pass http://10.88.0.12/;   # Container IP
    proxy_set_header Host            $host;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    client_max_body_size 128M;
}

The important setting is the Host setting, the X-Forwarded-For is not strictly required to work. So in addition to the APP_URL also the Host HTTP header needs to be set correctly. This was not an issue in v4.

I also needed to set APP_FORCE_HTTPS=true in the .env settings but that's a different issue and might depend on your configuration.

EDIT: I added proxy_set_header X-Forwarded-Proto https; following #2156 (reply in thread)

[grisu48]

@ildyria I changed the title and marked the answer accordingly. Feel free to edit and/or comment to further tidy this correspondence.

And thanks for your work! 🎈

[ildyria]

Can you try to also add

        proxy_set_header X-Forwarded-Proto https;

and remove APP_FORCE_HTTPS=true that should be equivalent and cleaner. :)

[grisu48]

Yep, that appears also to work. Nice!

[grisu48]

The only thing is that it doesn't work well with paths. I have another instance, e.g. https://hostname.local/lychee and that forwards to https://hostname.local/gallery instead of https://hostname.local/lychee/gallery. I'm looking on how to fix that ones as well now.