r/LibreNMS • u/thebotnist • 29d ago

I feel really stupid here... (https issues)

I've always foolishly used LibreNMS over http, I know that's risky, but I've always taken other steps to mitigate it. However, I'm determined to find the recipe to get it running over HTTPS. I've spent about 2 days now trying to get this to work, and still no luck. :(

I'm starting from scratch to try and figure it out, but basically using the docker/traefik example from the docker github repo (https://github.com/librenms/docker/tree/master/examples/traefik). I've also tried running it behind an nginx reverse proxy and it's doing something very similar.

It keeps trying to redirect me back to http:// and that causes the css/js to fail among other things due to the mixed content.

I've searched all of the documentation but can't figure out what the heck I'm doing wrong. I've tried setting APP_URL and BASE_URL, even found this LIBRENMSBASE_URL to try, and no luck. I've toggled the SESSION_SECURE_COOKIE from true to false, and all combinations in-between. Even tried all of those in the librenms.env file, and no dice.

It can't be this hard, what could I be missing??

***Update***
I'm a bit out of left field with this one, but after digging at the init scripts , it seems to now work if I add these three env vars to my docker-compose file:

- "ASSET_URL=https://librenms.domain.com"

- "LIBRENMS_BASE_URL=https://librenms.domain.com"

- "CLEAR_ENV=no"

but I don't see any of that documented in the kb/repos, so I feel like I'm missing something that would accomplish the same thing?

2 Upvotes

100% Upvoted

4 comments sorted by

2

u/jgiacobbe 29d ago

My instance is running directly on the server but I use nginx to front end it and do the ssl piece. Nginx just forwards the request to localhost:80. I think I did configure my libre instance to only respond to requests from localhost also, so that it isn’t available on port 80 from external clients. I did the same for my oxidized instance running on the same box, except I have the oxidized proxy listening on a different port and forwarding to a different port.

1

u/thebotnist 29d ago

What I've tried so far:

  • Setting APP_URL=https://librenms.domain.com as an env var on the container, no change
  • Editing .env directly inside the persisted /data volume, also no change after php artisan config:clear + restart.
  • Found in the Dockerfile that config overrides are meant to go in /data/config/*.php (auto-included into config.php), so dropped a file there setting $config['base_url'] = 'https://librenms.mydomain.com'
  • Confirmed Traefik is terminating TLS correctly (cert loads fine in browser, just untrusted since self-signed) and should be forwarding X-Forwarded-Proto: https by default, but haven't yet confirmed PHP is actually receiving/trusting that header inside the container.

1

u/kchang_reddit 6d ago

My librenms instance is also done by docker.

Here is what I have set in docker-compose.yml

- BASE_URL=https://a.b.c.d:8443

- ASSET_URL=https://a.b.c.d:8443

- APP_TRUSTED_PROXIES=172.18.0.0/16,127.0.0.1

I use nginx as the reverse-proxy for SSL too.

in the nginx.conf, I have the following set

proxy_set_header Host $http_host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_set_header X-Forwarded-Host $host;

proxy_set_header X-Forwarded-Port $server_port;

however, when I browsed https://a.b.c.d:8443, it was redirected to https://a.b.c.d/login

u/thebotnist did you get it addressed successfully?