Hocuspokus error in OpenProject 17.0.3 [onAuthenticate] fetch failed

[waschlmihael]

We have been successfully running OpenProject on OpenShift for several months. Recently, on our test environment, we installed the latest Helm chart version 13.2.3 and application version 17.0.3. Everything works as expected except for hocuspokus, which shows an error in the browser.

Inside the pod, apart from the error shown below, we do not see any additional details or logs related to this issue.

Environment:

OpenProject version: 17.0.3

Helm chart version: 13.2.3

Platform: OpenShift

https://community.openproject.org/wp/71873

[akabiru]

Hi @waschlmihael , thanks for the report! We'll have a look and get back to you soon as we can. 👍🏾

[akabiru]

@waschlmihael The log [onAuthenticate] suggest that the browser web client is able to reach the hocuspocus server but the "fetch failed" implies, hocuspocus is then not able to reach the OpenProject web server to complete the authentication. Admittedly, the logs can be improved (and will soon be). Are there any network/openshift settings that could be blocking the hocuspocus -> openproject connection?

[akabiru]

More info from OP team: Likely a network policy blocking the request from hocuspocus to the openproject server. Please test the connection to OpenProject from within the hocuspocus pod via curl. If that fails, then it's probably a the network policy issue.

The configuration can be controlled via values in the helm chart

[waschlmihael]

@akabiru I do not have any netowork policy enabled in current namespace and if I try to curl the service for web pod I got the response back Invalid host_name configuration.

[waschlmihael]

I replaced openproject.host value with the name of the service:
openproject:
host: openproject.----.svc.cluster.local
In that case I got the response back from the web pod but the application in the browser stoped working and I am getting this error in browser: Invalid host_name configuration.
I tried to curl the IP address as well and got the same response. I used the configuration from env:

Is there any configuration to change this options?

[machisuji]

Hello @waschlmihael - by default the hocuspocus pod should try to connect to OpenProject via it's public URL (openproject.host or ingress.host). Could you please confirm what the value for either of those two options is in your installation?

The hocuspocus pod needs to be able to resolve the DNS so that it then connects to the OpenProject pod(s).

Could you also try using the latest hocuspocus image (openproject/hocuspocus:17.1.0 - this should still be compatible with OpenProject 17.0.3 if you don't want to update that yet)? This would improve the logs of the hocuspocus container a little bit, showing where it tries to connect.

If this doesn't work for some reason we need to add options to the helm chart to connect directly instead.
The hocuspocus image supports the variables OPENPROJECT_URL and OPENPROJECT_HTTPS. Setting those to

OPENPROJECT_URL=http://openproject:8080
OPENPROJECT_HTTPS=true # if `openproject.https` is true

and setting the following in the env of the OpenProject pod

OPENPROJECT_ADDITIONAL__HOST__NAMES=openproject

would make this work.

Please let me know if you cannot connect using the public URL. If that is the case I can add options to the helm chart to configure the options described above.

[waschlmihael]

@machisuji openproject.host has the default values which is the same as ingress.host. Hocuspocus automatcally get the values which I sent before. This is IP address of Openproject service. Hocuspocus pod is able to reslove the public URL. After upgrade now I am getting error with some additional information:

[onAuthenticate] fetch failed
[onAuthenticate] Unauthorized: Token origin does not match request origin.

I tried to set the variables that you provided but without success. I have also set OPENPROJECT_URL to the pubilc address but this did not work as well.

After I change the configuration I got back the classic error: [onAuthenticate] fetch failed

After I added the varibles I tried to curl the url but I do not get response:

If I curl the public url I get a long respone whitch looks like OK.

I have also tried to override the values from previous meesage with the public url without success. Is there a chance to enable debug mode on hocuspocus?

[machisuji]

@waschlmihael Could you try using the openproject/hocuspocus:dev-latest image for hocuspocus (via hocuspocus.image.tag)? While there is sadly no debug mode, this dev state at least prints some more useful information such as which URL is being called, and what was expected.

Just to confirm. Let's say you are using https://myopenproject.com for ingress.host. So what the user sees and uses in the browser.
In the default scenario, this would then be used by hocuspocus by default (if openproject.realtime_collaboration.host is not set, which it isn't by default).

So that means hocuspocus will make requests against https://myopenproject.com/api/v3/....
And that should just work out of the box.

Clearly it doesn't in your case. Hopefully testing this again with the latest-dev image above will give us some more hints.

[waschlmihael]

@machisuji I deployed application with dev-latest container and I got some additional messages as you mentioned.

"Just to confirm. Let's say you are using https://myopenproject.com for ingress.host. So what the user sees and uses in the browser." Yes that is correct. The message I got from Hocuspocus it looks like that it trying to call correct hostname (hostname is the same as ingress.host value) but I am still getting error fetch failed:

[2026-02-13T08:41:12.111Z] GET https://openproject-test.***/api/v3/documents/5
[onAuthenticate] fetch failed

If I do curl inside container I get:

curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt  https://openproject-test.***/api/v3/documents/5
{"_type":"Error","errorIdentifier":"urn:openproject-org:api:v3:errors:NotFound","message":"The requested resource could not be found."}$ 

[waschlmihael]

@machisuji @benmi3 Any update on this issue?

[benmi3]

@waschlmihael
I can still not deploy the hocuspokus server due to the chart errors that should be fixed in #287 .
So unfortunately not from me.

[waschlmihael]

I’ve identified the root cause of the issue.

The problem is that the ConfigMap containing our ingress self-signed certificate is not mounted in the hocuspocus pod.

I am using the latest Helm chart version 13.4.2.

This is the configuration I am already using in the Helm chart, but it currently only applies to the openproject pod, not to hocuspocus. The relevant configuration (extraVolumeMounts, extraVolumes, extraEnvVars, and environment) is shown in the attached screenshot.

After manually patching the hocuspocus deployment and:

1. adding the ConfigMap mount with the custom CA

2. adding the environment variable:

   NODE_EXTRA_CA_CERTS=/etc/ssl/certs/custom-ca.pem
   

hocuspocus started working correctly.

Additionally, it would be helpful to improve the logging in hocuspocus so that certificate-related issues are more clearly indicated, making it easier to quickly identify this type of problem.

Is there currently a way to configure these settings (extraVolumes, extraVolumeMounts, extraEnvVars, environment) for the hocuspocus component directly via the Helm chart?