Does reverse-proxy support ws and/or wss?

[istvanmate]

Trying to forward websocket (preferably wss) connection to a local ws server, without success. Is it supported? If so, any help is appreciated.

[rejetto]

Websoclets are supposed to work

[istvanmate]

I tried forwarding /openlp/ws to ws://192.168.0.2:4317, but it does not work.

[rejetto]

try providing more info, as i don't know what to do with "does not work" 😉
a good thing to verify that the problem is really on the hfs part, is to use a different proxy (like nginx) and see it working.

[istvanmate]

So...

It works with nginx, relevant config below:

    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      path-to-cer;
        ssl_certificate_key  path-to-key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
        location /openlp/ws {
            proxy_pass http://192.168.0.2:4317/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_read_timeout 86400;
        }
    }

With hfs, tried with both /openlp/ws -> http://192.168.0.2:4317 and /openlp/ws -> ws://192.168.0.2:4317 with accessing the domain name and internal IP address (v4 and v6).

reverse-proxy entry:

hfs logs:

[rejetto]

plugin's configuration wants http:// so don't waste your time with ws:// .
what do you do to verify that it is working with nginx?

[istvanmate]

I have an app, that serves remote interface (and other http goodies) via http on port 4316, and realtime communication between remote interface and app goes via ws on port 4317. My issues is, that if I open the http interface to the internet, then suddenly every browser will deny me http connection and wants https, so proxy could help, but then https will not allow ws... only wss. Now, the app does not support any tls, because "it is too complicated for the users"... So I am stuck with either http or I have to proxy wss to ws.

Now that I tested nginx, and it works, issue is not that important any more, I might stick with nginx.

[istvanmate]

plugin's configuration wants http:// so don't waste your time with ws:// . what do you do to verify that it is working with nginx?

This does not work either:

Client's (MS Edge) console with hfs:

With nginx:

So I'd say, hfs with reverse-proxy does not support websocket proxying...

[rejetto]

i'm glad you solved!
i'm still interested in understanding what's missing in hfs to make it work for your case.
the plugin supports websocket, as i saw it working with another webapp, but it's probably missing something that is preventing openlp from working correctly.
i now reproduced the problem by proxying to https://stephanvs.ddns.net/openlp/
when i tried with https://www.trinitydebrecen.hu/openlp/ i could not see any websocket attempt, so it was not good for testing.
i will see what i can do, as soon as i have some time.
do you think this stephanvs will stay online in the next week?

[istvanmate]

I keep https://stephanvs.ddns.net/ up all time, I can put back hfs for you to test, but even better, do proxy to the app directly, I have ports 4316 and 4317 forwarded. You will need the following forwards:

• /openlp (or anything) to http://stephanvs.ddns.net:4316/stage/worship
• /openlp/index.html to http://stephanvs.ddns.net:4316/openlp/stage.html <- this I am not sure if it is still needed, app has stage.html as default index file... nginx does not need this.
• /api/v2/controller to http://stephanvs.ddns.net:4316/api/v2/controller
• /api/v2/plugins to http://stephanvs.ddns.net:4316/api/v2/plugins
• /api/v2/service to http://stephanvs.ddns.net:4316/api/v2/service

[istvanmate]

Oh, and the most important part: wss proxy from /openlp/ws to http://stephanvs.ddns.net:4317

stage.js contains the websocket connection details, it should work for you as well, it takes the used url

ws = new WebSocket(`wss://${host}/openlp/ws`)

Basically I want http://stephanvs.ddns.net:4316/stage/worship to be accessible from outside via https.

[istvanmate]

when i tried with https://www.trinitydebrecen.hu/openlp/ i could not see any websocket attempt, so it was not good for testing

Yeah, https://www.trinitydebrecen.hu/openlp/ is our chruch's "static" version hosted on wordpress. Web server is not within our control, so no websocket there.

[rejetto]

with these rules:

      - path: /openlp/ws
        url: https://stephanvs.ddns.net/openlp/ws
      - path: /openlp
        url: http://stephanvs.ddns.net:4316/stage/worship
      - path: /api/v2
        url: http://stephanvs.ddns.net:4316/api/v2

i'm getting this

i had to use https because this line ws = new WebSocket(wss://${host}/openlp/ws)

it seems to work also by poiting the first rule to http://stephanvs.ddns.net:4317

[rejetto]

since order of rules is important, i published an update to allow it on the form

[istvanmate]

I tested the new plugin, and I got it working on http... not sure, why https does not work, not even the root... may be unrelated, might investigate later. (update: for concurrent operation, I set hfs ports to 8080 and 8443, not https works, might have been port conflict on 443. Updated the ws url in javascript to include the current port)

Anyway, found one worth mentioning issue:

• ws connection will time out and reconnect will have to kick in, which will defeat it's purpose... nginx has proxy_read_timeout config option, which is set to 86400

[rejetto]

it's strange, because if you see at the rule i used for the ws, it was https, and it worked fine for me