NetBox behind proxy - login page in loop

[cingy]

Hi,
I have configured a proxy in front of the NetBox.
To access the Netbox I'm using URL like this: https://<PROXY_FQDN>/netbox/
When I open the URL I see in the nginx that the request gets to some infinity loop (adding /login/%3Fnext%3D/netbox/):

...
192.168.254.11 - - [23/Jun/2022:11:51:50 +0000] "GET /netbox//login/?next=/netbox/ HTTP/1.1" 302 0 "https://<PROXY_FQDN>/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" "-"
192.168.254.11 - - [23/Jun/2022:11:51:50 +0000] "GET /netbox//login/?next=/netbox//login/%3Fnext%3D/netbox/ HTTP/1.1" 302 0 "https://<PROXY_FQDN>/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" "-"
192.168.254.11 - - [23/Jun/2022:11:51:50 +0000] "GET /netbox//login/?next=/netbox//login/%3Fnext%3D/netbox//login/%253Fnext%253D/netbox/ HTTP/1.1" 302 0 "https://<PROXY_FQDN>/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" "-"
192.168.254.11 - - [23/Jun/2022:11:51:50 +0000] "GET /netbox//login/?next=/netbox//login/%3Fnext%3D/netbox//login/%253Fnext%253D/netbox//login/%25253Fnext%25253D/netbox/ HTTP/1.1" 302 0 "https://<PROXY_FQDN>/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" "-"
...

When I try to access the same without the proxy, just by SSH tunneling, then everything works fine:

...
10.0.20.1 - - [23/Jun/2022:11:53:23 +0000] "GET /netbox/login/?next=/netbox/ HTTP/1.1" 200 8685 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36" "-"
...

My NGINX (running on same node as netbox) configuration (/etc/nginx/conf.d/netbox.conf):

server {
    listen 443 ssl;

    # CHANGE THIS TO YOUR SERVER'S NAME
    server_name utility-01.ec.intinfra.com;

    ssl_certificate /etc/ssl/certs/netbox.crt;
    ssl_certificate_key /etc/ssl/private/netbox.key;

    client_max_body_size 25m;

    location /static/ {
        alias /opt/netbox/netbox/static/;
    }

    location /netbox/static/ {
        alias /opt/netbox/netbox/static/;
    }

    location /netbox/ {
        proxy_pass http://127.0.0.1:8001;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    # Redirect HTTP traffic to HTTPS
    listen [::]:80 ipv6only=off;
    server_name _;
    return 301 https://$host$request_uri;
}

Setting in "/opt/netbox/netbox/netbox/configuration.py" related to this:

...
ALLOWED_HOSTS = ['<PROXY_FQDN>', '10.0.2.10', '127.0.0.1']
...
BASE_PATH = 'netbox/'
...

Configuration of my Proxy:

<Location /netbox>
       ProxyPass        https://10.0.2.10/netbox/
       ProxyPassReverse https://10.0.2.10/netbox/
       AuthType openid-connect
       Require valid-user
       ProxyPreserveHost On
       ProxyAddHeaders Off
</Location>

• I have tried to change the URL after "/" to something else.
• I have tried to skip the NGINX and configured the gunicorn to listen on the node IP not just the loopback and point my proxy directly to it.
  But I got the same behaviour with the looping.

Does anyone have an idea why it is getting to this loop and how it can be fixed?

Thanks,
Martin Cangar

[candlerb]

What happens if you connect directly to the Netbox nginx server, i.e. to https://10.0.2.10/netbox/? Can you get it to work that way? If not, you need to resolve this first (which also takes Apache issues out of the equation).

I don't use nginx, but I wonder if

    location /netbox/ {
        proxy_pass http://127.0.0.1:8001;

should be

    location /netbox/ {
        proxy_pass http://127.0.0.1:8001/netbox/;

Once that's working, then you can move onto the outer Apache proxy. One thing I note is this:

<Location /netbox>
       ProxyPass        https://10.0.2.10/netbox/
       ProxyPassReverse https://10.0.2.10/netbox/

You may need to strip the trailing slashes, to match the Location:

<Location /netbox>
       ProxyPass        https://10.0.2.10/netbox
       ProxyPassReverse https://10.0.2.10/netbox

(I notice double-slashes in your redirects, this should fix that).

The next thing is that you are using https between the two proxies, but with a target URL that almost certainly doesn't present a valid certificate - unless you're using your own local CA and are issuing certificates with an IP SAN (are you?)

This means you may have to tweak various Apache SSL settings like SSLProxyEngine, SSLProxyCheckPeerName/SSLProxyVerify, SSLProxyCACertificateFile...

EDIT: another useful debugging tool is to use tcpdump to look at the plaintext web request/response going to and from gunicorn:

tcpdump -i lo -nn -s0 -A tcp port 8001

Then you can check the exact path of the incoming GET request, and see if it matches what you expect.

[cingy]

Thanks,
the nginx and the proxy setting helped.

[Smiley-k]

netbox

could you share the solution, I can't do it.