[Proxy] Reverse Proxy
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• amish_guy
	Feb 25 2015, 3:15 PM

Description

Hi everybody and thanks in advance to look at this task:

Situation:

To access to phabricator from an external node, I'm using a reverse proxy as the layout bellow:

external_user --> extphab.domain.com --> phab.local_domain.com

The problem is:

Phrabricator answer some request with its uri 'phab.local_domain.com' which is not trust by the client.
So I have an Error: ERR_INSECURE_RESPONSE from the client browser.

My question is:

Can we indicate to Phabricator to answer with the good uri ?
Or I have to review my proxy configuration, if this is not a Phabricator problem ?

Thanks.
Best regards.

Event Timeline

• amish_guy created this task.Feb 25 2015, 3:15 PM

• amish_guy raised the priority of this task from to Normal.

• amish_guy updated the task description. (Show Details)

• amish_guy added a project: Setup.

• amish_guy updated the task description. (Show Details)

• amish_guy added a subscriber: • amish_guy.

Set phabricator.base-uri to https://extphab.domain.com.

If you also want https://phab.local-domain.com to work for users (for example, one URL when VPN'd and a different URL when not VPN'd), add it to phabricator.allowed-uris. We don't recommend this kind of setup because there are a lot of places where we can't generate a valid link if the install has different locations. For example, in email, we have to pick one of the domains when generating a link to a revision, and we can't know whether the user will be VPN'd or not when they read their mail.

Thanks Epriestley for this answer,

but if I do that:

my local client will request the external node and I do not want that ;).

Okay, I don't quite understand your network setup then.

Do you have a mixture of internal and external users, and you want the internal users to use phab.internal.com and the external users to use phab.external.com?

This isn't really supported. You can make it almost work (add phab.external.com to phabricator.allowed-uris) but email will generate wrong for external users.

Yes, you understand good,

I have external users (external to my company) which access to phab.external.com
And my internal users which access to phab.internal.com

I'l bad to know this is not supported ;(.

Thanks again !

epriestley closed this task as Resolved.Feb 26 2015, 2:55 PM

epriestley claimed this task.