Opening ipynb notebook behind nginx reverse proxy

[mridup]

Hi,
I am trying to run Theia behind a nginx reverse proxy.
It is a docker container along with a few other containers all running together as a group in Azure ACI. I have configured nginx to successfully connect with the theia container running behind the nginx proxy. However I am not able to run Jupyter notebook and encounter the following issue when the webview is launched within theia app.

It seems the webview URL cannot be resolved.
Most of it looks like a nginx configuration issue to me but I am really not sure.

Here is the nginx conf:

user nginx;
worker_processes auto;
events {
  worker_connections 1024;
}
pid        /var/run/nginx.pid;

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    sendfile        on;
    tcp_nopush     on;

    server {
        listen [::]:443 ssl;
        listen 443 ssl;

        server_name _;

        ssl_protocols              TLSv1.2;

        ssl_ciphers                ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
        ssl_prefer_server_ciphers  on;
        ssl_session_cache    shared:SSL:10m; # a 1mb cache can hold about 4000 sessions, so we can hold 40000 sessions
        ssl_session_timeout  24h;

        keepalive_timeout 300; # up from 75 secs default
        add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';

        ssl_certificate      /usr/certs/letsencrypt/archive/mpd-ca-ssl.westeurope.azurecontainer.io/fullchain1.pem;
        ssl_certificate_key  /usr/certs/letsencrypt/archive/mpd-ca-ssl.westeurope.azurecontainer.io/privkey1.pem;

        location /theia/ { 
            rewrite ^/theia(/.*)$ $1 break;
            proxy_pass http://localhost:3000/; 

            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
        }

        location / {
            proxy_pass http://localhost:8080;
            
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
        }
        
        }
}

I tried adding wildcards "*." in server_name but it did not work.
Would be great if anyone has any clue for this.

[vince-fugnitto]

@mridup thank you for the question, the following thread may be of help:

• https://spectrum.chat/theia/theiadevcon/need-help-updating-theia-core-and-deploying-it-to-a-docker-container~65a8f6ac-3f36-4eb8-b68f-9647b34475e8?m=MTU4NTgwOTU4MTExNQ==

[mridup]

Thanks @vince-fugnitto for the link.

From what I understand from the discussion in the link, is that we need to configure the reverse proxy to rewrite the URL: <uuid>.webview.localhost:3000/#/home/project and use location redirection to the URL: <uuid>.webview.localhost:8888/user/dev/#/home/project

[vince-fugnitto]

That is what I understand as well, I haven't tested it out myself or had to implement it, I don't have experience configuring reverse proxies or nginx.

[mridup]

Back working on this issue again.
The request URL for the webview that I can see in the browser network logs is the following:
<http://<uuid>.webview.localhost/webview/index.html?id=<uuid>. This will of course be proxy_pass'ed to localhost:3000.
But clearly this does not match with <uuid>.webview.localhost:3000/#/home/project.

Tried redirecting to <http://<uuid>.webview.localhost:8888/user/dev/webview/index.html?id=<uuid> but it did not work.

[mridup]

Looking at #7484, I think my assumption was wrong as '/user/dev' is a specific uri path for that specific use-case. Since my nginx server is running either at :80 or :443 depending on whether we have ssl enabled or not, I think just redirecting <http://<uuid>.webview.localhost:80/theia/webview/index.html?id=<uuid> to <http://<uuid>.webview.localhost:3000/webview/index.html?id=<uuid> should have worked.
Note '/theia' in the original URL which is a specific location config in nginx for us to redirect theia traffic to port 3000 where the theia docker instance is running.