Unable to use behind proxy.

[therealeldaria]

I'm using the Docker-compose but modified so that the ports are not exposed, I did not want to expose the ports on the network unencrypted, so I set up a nginx proxy with letsencrypt.
On the proxy I send traffic from port 443 to http://dockername:4326
I can get to the admin page with no issues but it does not seem to want to connect to the socket.
I have a suspicion that the actual webbrowser attempts to connect instead of internal in the docker container. Is there a way to configure it to connect internally or do I need to expose the port outside the continer?

[itzg]

When you add a new server in "Server Management" can you make sure in "Server Host" you are giving the docker-compose service name of the minecraft-server container? With my example compose file, the hostname minecraft is coming from here.

[therealeldaria]

Problem is that I can't get to the Server Management Page, it just keeps loading, showing three dots, pulsating. I can see the menu by clicking the 3 lines at the left, and I see the sub-menus, Dashboard, Server Management, Widgets, etc. But none of them loads, except those that link here, and to paypal.

[itzg]

Gotcha. I’ll try recreating that proxy setup too and see if I can debug it.

[therealeldaria]

Docker-compose.yml:

  rcon:
     container_name: rcon
     image: itzg/rcon
     volumes:
       - "rcon:/opt/rcon-web-admin/db"
   nginx_proxy:
     container_name: nginx_proxy
     image: nginx
     ports:
       - "80:80"
       - "443:443"
     volumes:
       - "/home/user/mc/docker-nginx/html:/usr/share/nginx/html"
       - "/etc/letsencrypt:/etc/letsencrypt:ro"
       - "/home/user/mc/docker-nginx/default.conf:/etc/nginx/conf.d/default.conf"
 
 
 volumes:
   rcon

nginx configuration (default.conf)

server {
    listen 80;
    return 301 https://$host$request_uri;
}

upstream rcon {
    server rcon:4326;
    keepalive 32;
}

server {
    listen 443 ssl http2 default_server;
    server_name  minecraft.myserver.net;

    root /usr/share/www;
    index  index.html index.htm;

    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/minecraft.myserver.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/minecraft.myserver.net/privkey.pem;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
    ssl_prefer_server_ciphers on;

    location / {
      proxy_pass http://rcon/;
      proxy_http_version 1.1;
      proxy_set_header Connection "upgrade";
      proxy_set_header Upgrade $http_upgrade;
    }
}

[emmett421]

Did you ever figure this out? I'm having the same exact issue except I'm using traefik as my proxy.

[itzg]

I think I accidentally ran into the same kind of issue when I forgot to expose the websocket port. That led me to find this issue and solution description in the upstream:

https://github.com/brainfoolong/rcon-web-admin/issues/9

[zeigerpuppy]

did anyone solve this for the use of nginx?

[quodos]

Unfortunately the link to the solution is down as the maintainer of the original rcon-web-admin repo changed.

I figure you have to set the RWA_WEBSOCKET_URL or RWA_WEBSOCKET_URL_SSL variable to a path and then proxy it to the port via nginx. Unfortunately setting RWA_WEBSOCKET_URL_SSL as environment variable seems to have no effect as the tool still tries to access the websocket via ws://...:4327.

[itzg]

Thanks for pointing that out @quodos . Apparently I missed a couple of links that need to point at the new location.

[itzg]

@quodos , I got the links fixed. As for the core issue you will need to contact the maintainers over there, but they are quite responsive now.

[fraserkyle]

I have resolve this by creating separate nginx configs. 1 for the WebUI and the other for WebSockets.

In my docker compose:
RWA_WEBSOCKET_URL_SSL: "wss://ws.{my rcon url}" RWA_WEBSOCKET_URL: "ws://ws.{my rcon url}"

/etc/nginx/conf.d/{my rcon url}.conf
`
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}

server {
server_name {my rcon url};

location / {
  proxy_set_header        Host $host;
  proxy_set_header        X-Real-IP $remote_addr;
  proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header        X-Forwarded-Proto $scheme;

  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;
  proxy_set_header Host $host; 

  proxy_read_timeout  90;

  proxy_pass http://{my INTERNAL rcon url}:4326;
}

}
`

/etc/nginx/conf.d/ws.{my rcon url}.conf
`
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}

server {
server_name ws.{my rcon url};

location / {
  proxy_set_header        Host $host;
  proxy_set_header        X-Real-IP $remote_addr;
  proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header        X-Forwarded-Proto $scheme;

  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;
  proxy_set_header Host $host; 

  proxy_read_timeout  90;

  proxy_pass http://{my INTERNAL rcon url}:4327;
}

}
`

you can then use certbot to generate your sll certificates

[jippi]

I ended up with this nginx configuration to make it work

map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

server {
    listen              443 ssl http2;
    listen              [::]:443 ssl http2;

    server_name        __YOUR_HOSTNAME__;

    ssl_certificate     /etc/letsencrypt/live/__YOUR_HOSTNAME__/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/__YOUR_HOSTNAME__/privkey.pem;
    ssl_session_timeout 5m;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:MEDIUM:!SSLv2:!PSK:!SRP:!ADH:!AECDH;
    ssl_prefer_server_ciphers on;

    location /ws/ {
        proxy_pass http://127.0.0.1:4327/;
        gzip on;
        
        # Websocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_redirect     off;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_set_header X-Forwarded-Ssl on;
    }

    location / {
        proxy_pass http://127.0.0.1:4326;
        gzip on;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        proxy_set_header X-Frame-Options SAMEORIGIN;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

and my docker-compose (mostly from the tutorials)

services:
  minecraft:
    image: itzg/minecraft-server
    ports:
      - "25565:25565"
      - "28016:28016"
    volumes:
      - "/data/minecraft/data:/data"
    environment:
      EULA: "TRUE"
      ENABLE_RCON: "true"
      RCON_PASSWORD: "__REPLACE_THIS__"
      RCON_PORT: 28016
      # enable env variable replacement
      REPLACE_ENV_VARIABLES: "TRUE"
      # define an optional prefix for your env variables you want to replace
      ENV_VARIABLE_PREFIX: "CFG_"
      # and here are the actual variables
      CFG_DB_HOST: "http://localhost:3306"
      CFG_DB_NAME: "minecraft"
      CFG_DB_PASSWORD_FILE: "/run/secrets/db_password"
      WHITELIST: __REPLACE_THIS__
      OPS: __REPLACE_THIS__
      ANNOUNCE_PLAYER_ACHIEVEMENTS: "true"
    restart: always

  rcon:
    image: itzg/rcon
    environment:
      RWA_ENV: "true"
      RWA_USERNAME: "__REPLACE_THIS__"
      RWA_PASSWORD: "__REPLACE_THIS__"
      RWA_ADMIN: "true"
      RWA_RCON_HOST: "minecraft"
      RWA_RCON_PORT: "28016"
      RWA_WEB_RCON: "true"
      RWA_WEBSOCKET_URL_SSL: "wss://__YOUR_HOSTNAME__/ws"
      RWA_WEBSCOCKET_URL: "wss://__YOUR_HOSTNAME__/ws"
    links:
      - minecraft
    ports:
      - "4326:4326"
      - "4327:4327"
    volumes:
      - "/data/minecraft/rcon:/opt/rcon-web-admin/db"

secrets:
  db_password:
    file: ./db_password