Reverse Proxy

[s33d1ing]

I was able to reverse proxy Pi.Alert using LinuxServer's SWAG container.
Just wanted to share in case anyone else if looking to do this.

pialert.subfolder.conf

location /pialert {
    return 301 $scheme://$host/pialert/;
}

location ^~ /pialert/ {
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;

    set $upstream_app pialert;
    set $upstream_port 20211;
    set $upstream_proto http;

    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    proxy_set_header Accept-Encoding "";

    proxy_redirect ~^/(.*)$ /pialert/$1;
    rewrite ^/pialert/?(.*)$ /$1 break;

    sub_filter_once off;
    sub_filter_types *;

    sub_filter 'href="/' 'href="/pialert/';

    sub_filter '(?>$host)/css' '/pialert/css';
    sub_filter '(?>$host)/img' '/pialert/img';
    sub_filter '(?>$host)/js'  '/pialert/js';
    sub_filter '(?>$host)/lib' '/pialert/lib';
    sub_filter '(?>$host)/php' '/pialert/php';
}

[jokob-sk]

Thanks, is this something that can live alongside the default nginx config? Feel free to raise a PR if so, otherwise, I'll include it in the docs. :)

[s33d1ing]

It could be added to the bottom of the server block in "default.conf" or as a new file named something like "pialert.subfolder.conf" in the "proxy-confs" folder in the SWAG container.

[jokob-sk]

Hi, thanks!

Looking at the file:

https://github.com/jokob-sk/Pi.Alert/blob/main/install/default

Would this be the correct format to preserve the previous functionality?

server {
    listen 80 default_server;
    root /var/www/html;
    index index.php;
    rewrite /pialert/(.*) / permanent;

  location ~* \.php$ {
    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
    include         fastcgi_params;
    fastcgi_param   SCRIPT_FILENAME    $document_root$fastcgi_script_name;
    fastcgi_param   SCRIPT_NAME        $fastcgi_script_name;
    fastcgi_connect_timeout 75;
          fastcgi_send_timeout 600;
          fastcgi_read_timeout 600;
  }
}

location /pialert {
    return 301 $scheme://$host/pialert/;
}

location ^~ /pialert/ {
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;

    set $upstream_app pialert;
    set $upstream_port 20211;
    set $upstream_proto http;

    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    proxy_set_header Accept-Encoding "";

    proxy_redirect ~^/(.*)$ /pialert/$1;
    rewrite ^/pialert/?(.*)$ /$1 break;

    sub_filter_once off;
    sub_filter_types *;

    sub_filter 'href="/' 'href="/pialert/';

    sub_filter '(?>$host)/css' '/pialert/css';
    sub_filter '(?>$host)/img' '/pialert/img';
    sub_filter '(?>$host)/js'  '/pialert/js';
    sub_filter '(?>$host)/lib' '/pialert/lib';
    sub_filter '(?>$host)/php' '/pialert/php';
}

[s33d1ing]

Oh, I understand the question now. The location blocks would have to go inside the server block. Also /config/nginx/proxy.conf and resolver.conf are part of the SWAG container. But even if those were included, I'm not sure it would work, plus it doesn't really make sense to include them in the app's default nginx config. When used in SWAG (or nginx proxy manager, etc.) it allows Pi.Alert to be accessed with a friendly URL, https://intranet/pialert/ in my case.

[s33d1ing]

For good measure, I tried editing /home/pi/pialert/install/default and browsing to raspberrypi/pialert/ and rapsberrypi:20211/pialert/ but they either didn't load or redirected to raspberrypi:20211/devices.php

[jokob-sk]

Alright, I'm slowly starting to get it.

Can you please write up a step by step guide on how to use the Swag container to setup reverse proxy?

I started something here, but I lack sufficient knowledge:

https://github.com/jokob-sk/Pi.Alert/blob/main/docs/REVERSE_PROXY.md

You can past a comment here and I'll update that doc

[s33d1ing]

Sure, it's quite simple:

Reverse Proxy Configuration

linuxserver/swag

Create /config/nginx/proxy-confs/pialert.subfolder.conf with the following contents:

## Version 2023/02/05
# make sure that your pialert container is named pialert
# pialert does not require a base url setting

# Since Pi.Alert uses a Host network, you may need to use the IP address of the system running Pi.Alert for $upstream_app.

location /pialert {
    return 301 $scheme://$host/pialert/;
}

location ^~ /pialert/ {
    # enable the next two lines for http auth
    #auth_basic "Restricted";
    #auth_basic_user_file /config/nginx/.htpasswd;

    # enable for ldap auth (requires ldap-server.conf in the server block)
    #include /config/nginx/ldap-location.conf;

    # enable for Authelia (requires authelia-server.conf in the server block)
    #include /config/nginx/authelia-location.conf;

    # enable for Authentik (requires authentik-server.conf in the server block)
    #include /config/nginx/authentik-location.conf;

    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;

    set $upstream_app pialert;
    set $upstream_port 20211;
    set $upstream_proto http;

    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    proxy_set_header Accept-Encoding "";

    proxy_redirect ~^/(.*)$ /pialert/$1;
    rewrite ^/pialert/?(.*)$ /$1 break;

    sub_filter_once off;
    sub_filter_types *;

    sub_filter 'href="/' 'href="/pialert/';

    sub_filter '(?>$host)/css' '/pialert/css';
    sub_filter '(?>$host)/js'  '/pialert/js';

    sub_filter '/img' '/pialert/img';
    sub_filter '/lib' '/pialert/lib';
    sub_filter '/php' '/pialert/php';
}

[jokob-sk]

Thanks a lot! Added it here: https://github.com/jokob-sk/Pi.Alert/blob/main/docs/REVERSE_PROXY.md

[jokob-sk]

Closing as released / no activity