External nginx proxy manager

[q16marvin]

Infos:

• Used Zammad version: 6.2.0
• Used Zammad installation type: package
• Operating system: ubuntu
• Browser + version: firefox newest

Hi,

does anyone got running zammad behind a external nginx proxy manager?

simple like that it is working:

but i have 2 issues:

1. in logs (/var/log/zammad/production.log) i see only the proxy ip (192.168.200.85) and not the correct client ip:

, [2024-04-26T14:25:54.112621#387480-144300]  INFO -- : Started GET "/api/v1/online_notifications/?full=true&_=1714141059410" for 192.168.200.85 at 2024-04-26 14:25:54 +0000

2. sometimes a user in zammad works as a “other” user, i think it depends that all users “using” same ip from proxy?

i hope someone has i idea
thank you very much!

[q16marvin]

okay i got:

1. ZAMMAD_BIND_IP default is 127.0.0.1, we need to change it to 0.0.0.0 with command:

zammad config:set ZAMMAD_BIND_IP=0.0.0.0
service zammad restart

https://zammad-documentation-dvuckovic.readthedocs.io/en/latest/appendix/configure-env-vars.html

2. in nginx proxy manager under Advanced:

location /ws {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header CLIENT_IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
        proxy_pass http://192.168.62.44:6042;
    }

    # action cable
    location /cable {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header CLIENT_IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
        proxy_pass http://192.168.62.44:3000;
    }

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header CLIENT_IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Change this line in an SSO setup
        proxy_set_header X-Forwarded-User "";

        proxy_read_timeout 300;
        proxy_pass http://192.168.62.44:3000;

        gzip on;
        gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
        gzip_proxied any;
    }

and tadaaaaa its working… now i see “original ip’s” for example here:

[MrGeneration]

Please note that this is a potentially unsafe operation of a ruby application.
Make sure only your proxy server can communicate to Zammads applications ports directly.

[q16marvin]

oh okay yes i understand… mhhhh so my way is not a good idea do you have a better idea?

[MrGeneration]

@q16marvin

mhhhh so my way is not a good idea

Make sure only your proxy server can communicate to Zammads applications ports directly.

Firewalling might be a solution.

[q16marvin]

yes of course, mhhh i will think about it… but im the only one who tries to use zammad behind a proxy (not on the same server)?