Possible to use Traefik (reverse proxy) with Pi.Alert?

[Isegrimm]

The current reverse proxy support seems to be limited to SWAG, Apache and nginx, as discussed and documented here: https://github.com/jokob-sk/Pi.Alert/discussions/275

Traefik can strip the prefix of a url path (www.domain.com/pialert > www.domain.com) and stores the stripped prefix in a X-Forwarded-Prefix header. This works on the condition that the backend application reads this header to reconstruct the proper url.

With the current version, stripping the prefix results in Pi.Alert attempting to open www.domain.com/devices.php, which doesn't work because Traefik is configured to react on www.domain.com/pialert.
A correct url would be www.domain.com/pialert/devices.php, which can be constructed by using the content of the X-Forwarded-Prefix header.

Any plans to make Pi.Alert work with this method? Or is there another way to make Pi.Alert work with Traefik that I don't know?

[jokob-sk]

Hi there,

I'm b really not sure as I'm not using traefik myself.

@cvc90 do you know by any chance?

Thanks,
J

[jokob-sk]

thank you @cvc90 🙏

[Isegrimm]

Hi @cvc90

The rule-label you specify is for a url like pialert.domain.com:
traefik.frontend.rule=Host:pi.alert.your_domain.com

This will indeed work, but I want it to be reachable at a url like this: www.domain.com/pialert.
When using labels that would look like this:
traefik.frontend.rule=Host:www.your_domain.com && PathPrefix(/pialert)

But to make that work, Pi.Alert has to return the proper urls to the browser (for example www.domain.com/pialert/devices.php instead of www.domain.com/devices.php), and so Pi.Alert has to be aware that it's called on a path instead of the root of a domain, which requires either manually specifying the base path (/pialert) in the configuration of Pi.Alert or make Pi.Alert use the X-Forwarded-Prefix header (which is defined by Traefik by using the stripprefix directive and contains '/pialert').

For reference, this is what I have configured for Pi.Alert:
(I'm using a TOML file for the Traefik configuration instead of labels, but I don't think it matters for the configuration)

[http.routers]
  [http.routers.pialert-router]
    entryPoints = ["websecure"]
    rule = "Host(`www.domain.com`) && PathPrefix(`/pialert`)"
    service = "pialert-service"
    middlewares = "auth,pialert-stripprefix"
    [http.routers.pialert-router.tls]
       certResolver = "<snip>"
       [[http.routers.pialert-router.tls.domains]]
         main = "www.domain.com"

[http.services]
  [http.services.pialert-service]
    [[http.services.pialert-service.loadBalancer.servers]]
      url = "http://internal-ip-address:20211/"

[http.middlewares]
  [http.middlewares.auth.forwardAuth]
    address = "<snip>"
    trustForwardHeader = true
    authResponseHeaders = ["Remote-User", "Remote-Groups", "Remote-Name", "Remote-Email"]
  [http.middlewares.pialert-stripprefix.stripprefix]
    prefixes = "/pialert"
    forceSlash = false

[jokob-sk]

I'm out of my depth here so if someone wants to submit a PR to enable this setup, feel free to do so.

[cvc90]

Hi!

I think a possible solution to this problem could be solved as follows.

In the file /etc/nginx/sites-available/default of Docker Pi.Alert would add the directive that you mention that Traefik could read them.

add_header X-Forwarded-Prefix "/pialert" always;
proxy_set_header X-Forwarded-Prefix "/pialert";

server {
    listen 80 default_server;
    root /var/www/html;
    index index.php;
    #rewrite /pialert/(.*) / permanent;
    add_header X-Forwarded-Prefix "/pialert" always;
    proxy_set_header X-Forwarded-Prefix "/pialert";

  location ~* \.php$ {
    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
    include         fastcgi_params;
    fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
    fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
    fastcgi_connect_timeout 75;
          fastcgi_send_timeout 600;
          fastcgi_read_timeout 600;
  }
}

Check what I said, so you can send the PR with the solution.

[cvc90]

@Isegrimm can you give it a try? Please report back if it works

[Isegrimm]

Hi @cvc90 , apologies for not reacting sooner. I somehow missed the notification.
I will test this later this week and let you know the outcome.

[Isegrimm]

Hi @cvc90 , I have made the changes and it works now. Thanks for your help! 😄
One remark, www.domain.com/pialert/ works but www.domain.com/pialert not, so the trailing / is needed.

[jokob-sk]

@Isegrimm can you write up a short guide on how to do it with the correct configuration example so I update the guide?

[jokob-sk]

There is also this discussion, not sure if relevant: https://github.com/jokob-sk/Pi.Alert/discussions/456#discussioncomment-7106751