Reverse proxy config with NGINX Proxy Manager

[ehcloninger]

Hi all! I found reitti from the Proxmox Community Scripts site. I was able to install reitti as an LXC on Debian 13 (Trixie) without any difficulties. I've played with several personal tracker tools the last year and this looks very promising. Great job!

I have my installation on a homelab server running Proxmox VE 9.1. I use NGINX Proxy Manager in another LXC to provide access to the services on the server that I want exposed to the outside world. I have DNS enabled through CloudFlare and they also provide SSL certificates through LetsEncrypt. So, all is working as expected. I can access the management interface using https://reitti.domain.tld.

I didn't see any documentation on setting up the reverse proxy in the docs. I'm not sure if this was deliberate or "left as an exercise for the reader". I've done this a dozen times, so it wasn't difficult. It might be nice to mention the steps needed to do this, since it's going to be difficult to make this work outside of your home location without running Tailscale or a VPN continuously.

The only thing that I figured out that I needed to do was modify /opt/reitti/application.properties to set reitti.server.advertise-uri=https://reitti.domain.tld:8080 and then restart with systemctl restart reitti.service. With those changes in place, I could use curl/Postman/Bruno to hit the server and get a response code. Am I correct that the only value that I need to edit to allow the domain name to work?

I created an API key for one of my devices and logged into the management interface with Firefox on mobile. I used the automatic configuration button to set up OwnTracks (nice feature, BTW). However, OwnTracks could not connect. In the logs, it showed the network location as unreachable, both on wifi and cellular data. I didn't do any other diagnostics.

I uninstalled OwnTracks and installed GPSLogger from f-droid and again used the automatic configure screen. This app worked immediately and was sending data correctly to my instance. I repeated with 2 other Android devices and both worked as expected. All this in about 45 minutes time.

Several points:

• In the Integrations page (/settings/integrations), there is a link to the URL to put into the logger app. If no API key has been created, this URL is ?token= with no other data. Perhaps if this field is blank because no API keys exist, inform the user to create one first.
• Once I have multiple devices, it seems this value is always shown to be the most recent one created. Maybe a feature request is to put a popup that displays all the available API keys by their name.
• As for why OwnTracks isn't working, I'm not sure about it. I notice the docs mention to disable authentication, but that isn't an option in the version I downloaded from Play Store today. There is a place to enter user name and password, but I left those blank. I'm assuming this has the same result. Has the UI for OwnTracks been updated since the docs were written?
• [EDIT] Also, information about configuring photon.service. On my instance, it failed to start. I'm not sure that I need it, but seeing it as red in the output from systemctl makes me wonder if I do. Looking at the journalctl logs, I needed to create /opt/photon/photon_data and then populate it with a database. I'm currently pulling the USA data from https://download1.graphhopper.com. We'll see how that works.

Happy to help test/debug as needed. I'm not a professional web developer, but I dabble. I'm an old C++ dev that plays with Python and networking tools to keep busy. ;-)

[dgraf-gh]

I didn't see any documentation on setting up the reverse proxy in the docs. I'm not sure if this was deliberate or "left as an exercise for the reader". I've done this a dozen times, so it wasn't difficult. It might be nice to mention the steps needed to do this, since it's going to be difficult to make this work outside of your home location without running Tailscale or a VPN continuously.

This is actually deliberate because it should work out of the box as long as the reverse proxy sets the correct header fields. Reitti uses the Host or X-Forwarded-For Header from the proxy. There is no configuration needed in reitti.

The only thing that I figured out that I needed to do was modify /opt/reitti/application.properties to set reitti.server.advertise-uri=https://reitti.domain.tld:8080 and then restart with systemctl restart reitti.service. With those changes in place, I could use curl/Postman/Bruno to hit the server and get a response code. Am I correct that the only value that I need to edit to allow the domain name to work?

No, this property is only used when using the federation sharing between multiple reitti instances. So this does not have anything to do with it.

I created an API key for one of my devices and logged into the management interface with Firefox on mobile. I used the automatic configuration button to set up OwnTracks (nice feature, BTW). However, OwnTracks could not connect. In the logs, it showed the network location as unreachable, both on wifi and cellular data. I didn't do any other diagnostics.

Also for this to be working, the Host header has to reach reitti. Then reitti knows the hostname of itself by getting the same host as your browser uses. I will check if this works for the owntracks button.

I uninstalled OwnTracks and installed GPSLogger from f-droid and again used the automatic configure screen. This app worked immediately and was sending data correctly to my instance. I repeated with 2 other Android devices and both worked as expected. All this in about 45 minutes time.

That sounds good.

Several points:

* In the Integrations page (/settings/integrations), there is a link to the URL to put into the logger app. If no API key has been created, this URL is `?token=` with no other data. Perhaps if this field is blank because no API keys exist, inform the user to create one first.

It should actually display a message that the user should first create a api key.

* Once I have multiple devices, it seems this value is always shown to be the most recent one created. Maybe a feature request is to put a popup that displays all the available API keys by their name.

There should be a dropdown in that section where you can select the api key to use.

* As for why OwnTracks isn't working, I'm not sure about it. I notice the docs mention to disable authentication, but that isn't an option in the version I downloaded from Play Store today. There is a place to enter user name and password, but I left those blank. I'm assuming this has the same result. Has the UI for OwnTracks been updated since the docs were written?

It could be, that it created the settings file with the wrong url. Depends how you opened reitti from your phone.

* [EDIT] Also, information about configuring photon.service. On my instance, it failed to start. I'm not sure that I need it, but seeing it as red in the output from `systemctl` makes me wonder if I do. Looking at the journalctl logs, I needed to create `/opt/photon/photon_data` and then populate it with a database. I'm currently pulling the USA data from https://download1.graphhopper.com. We'll see how that works.

Happy to help test/debug as needed. I'm not a professional web developer, but I dabble. I'm an old C++ dev that plays with Python and networking tools to keep busy. ;-)

Thank you alot for your feedback. I will check the Integrations page for any regression.

[ehcloninger]

Hi @dgraf-gh. Thank you for the quick response.

You are correct that I did not need to alter that configuration file. I have reverted it and reitti works as expected. My apologies for the confusion. Some web services require configuration changes to work behind reverse proxy, so that was the first thing I went looking to do.

I'm not sure if I need to manually update the settings in NGINX Proxy Manager for Host and X-Forwarded-For (I won't say NPM to avoid confusion with node). I can access the site via the web without any changes and use GPSLogger. I'm trying to understand why I can't use OwnTracks. I'm beginning to wonder if this is an IPv6 issue. The error messages in the OwnTracks logs all have IPv6 addresses. I'm not using IPv6 on this server. I haven't had a need for IPv6 up to this point, so I've always kept it off. owntracks/android#2157

• Once I have multiple devices, it seems this value is always shown to be the most recent one created. Maybe a feature request is to put a popup that displays all the available API keys by their name.

There should be a dropdown in that section where you can select the api key to use.

Again, you're correct. On mobile, it's at the top of the screen and I did not spot it as it was off the screen above the button to autoconfig.

• As for why OwnTracks isn't working, I'm not sure about it. I notice the docs mention to disable authentication, but that isn't an optio

In in the version I downloaded from Play Store today. There is a place to enter user name and password, but I left those blank. I'm assuming this has the same result. Has the UI for OwnTracks been updated since the docs were written?

It could be, that it created the settings file with the wrong url. Depends how you opened reitti from your phone.

I used the autoconfig button from Firefox. It fired an intent that brought OwnTracks to the front and offered to import the settings. I've since reinstalled OwnTracks and gone through the config option again and it does work as expected with the correct values. It just doesn't connect to the backend. GPSLogger does work and I can live with using that for now. As I said, I'm happy to help debug if it turns out it's something other than user error.

[ehcloninger]

I'm going to mark this as closed. After reading more, this is not an issue with Reitti.

If anyone comes after with this issue. Cloudflare forces IPv6 on free-tier customers even if their endpoint isn't running IPv6. The workarounds they document (using WAF to insert headers and using pseudo-IPv4) do not solve the issue as there is an AAAA record in DNS. OwnTracks takes the position that if AAAA exists, they will not downgrade to IPv4 or provide an option to do so, so that eliminates using that client for now. 🙄