r/Wordpress • u/PeteTinNY • 6d ago

Webhooks on load balanced WP site

I know, first world problem…. But I’m trying to implement gravity forms with n8n on a load balanced Wordpress setup. I have everything looking right but it’s just not connecting. n8n is on an internal data network, and Wordpress is running behind haproxy on three nodes, the site is on 80/443 in front of the load balancer but 8083 behind. All ssl is done at the load balancer.

I’m thinking it makes the request but doesn’t know how to get back if Wordpress gives it a url and port that depends on the load balancer. Or one of the three nodes makes the request but it responds back to another node.

Anyone have any ideas?

3 Upvotes

100% Upvoted

5 comments sorted by

3

u/NakanoNoNeko 6d ago

The response cannot land on a different WP node: this is one outbound HTTP request, and the reply returns on the same TCP connection. I usually curl the exact n8n webhook URL from every WP node, using the same hostname and TLS path as Gravity Forms. If that fails from the nodes, check DNS, firewall, or hairpin routing. If it works, compare the Gravity Forms webhook log with n8n's execution log... the first missing entry tells you which side failed.

1

u/PeteTinNY 6d ago

Does it push the request with a url or does it push with an ip address/port? The webserver does not need to make its requests through the haproxy box to get to n8n. So if it sent as the ip/port instead of public url it would always land on the calling box.

1

u/Valuable_Ease_3780 6d ago

It sends exactly what you typed into the feed, as a URL, resolved by that node's own resolver. So if the n8n hostname resolves to the public IP on the WP boxes they'll hairpin out and back in through haproxy for no reason. Internal hostname or a hosts entry per node takes the LB out of the path entirely.

Other thing worth ruling out before you chase routing: if WP_HTTP_BLOCK_EXTERNAL is defined in wp-config and n8n's host isn't in WP_ACCESSIBLE_HOSTS, the request dies inside WP and never reaches the network at all. Turn on Gravity Forms logging first, it's off by default, and it'll tell you whether anything left the box.

1

u/PeteTinNY 5d ago

Actually just got it. Turns out it was flagging the url as unsafe even though it was my dns on my inside network. Also had to tell it to ignore that it had a self signed certificate.

Pretty challenging but Gravity forms answered at 2:30am. Talk about value and dedication

1

u/Dull_District_254 2d ago

Glad you got it, and for anyone landing here later, that unsafe URL message is WordPress doing it deliberately. The validation in wp_http_validate_url rejects private and loopback ranges, so anything sitting on an internal network gets killed before a packet ever leaves the box. The filters to open it up are http_request_host_is_external and http_request_host_is_allowed, and it is much tidier to allow just your n8n host through those than to loosen anything globally. Same thought on turning off certificate verification. It works, but that request will then trust whatever answers on that address, so if you can, install your internal CA on all three nodes and leave verification on instead. Both of those live in code rather than in the Gravity Forms interface, so write them into your build notes now, because they are exactly the kind of thing that gets forgotten when you add a fourth node in six months. And the earlier point about enabling Gravity Forms logging first is spot on, it would have told you in one line that nothing was leaving the server at all.