# Mixed content and WSS error after add taiga in my nginx reverse proxy

**URL:** <https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478>\
**Category:** Troubleshooting\
**Created:** [January 18, 2024, 10:39am UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478 "2024-01-18T10:39:21Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [January 18, 2024, 10:39am UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/1 "2024-01-18T10:39:21Z")

</div>

Hi,  
I have a taiga service which worked normally but which was not secure in https. I added an nginx configuration to reverse-proxy this service:

```auto
server {
    listen 80;
    server_name my_alias_taiga.domain.local;
    rewrite ^(.*) https://my_alias_taiga.domain.local$1 permanent;
}

server {
        listen 443 ssl;
        server_name my_alias_taiga.domain.local;

        ssl_certificate /etc/letsencrypt/live/my_alias_taiga.domain.local/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/my_alias_taiga.domain.local/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        location / {
                proxy_pass http://mytaiga.domain.local:80;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header Host $host;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_buffering off;
                proxy_set_header X-Forwarded-Proto https;
                proxy_connect_timeout 90;
                proxy_send_timeout 90;
                proxy_read_timeout 90;

        }

        error_log /var/log/nginx/mytaiga.domain.local-error.log warn;
        access_log /var/log/nginx/mytaiga.domain.local-access.log main;
}

```

After restarting nginx with `systemctl restart nginx`, then going to the web page https://my\_alias\_taiga.domain.local, the page displayed a blank page and when I opened the developer tool web page, there are these errors that came up:

```auto
Mixed Content: The page at 'https://my_alias_taiga.domain.local/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://my_alias_taiga.domain.local/events'. This request has been blocked; this endpoint must be available over WSS.
e.setupConnection @ app.js:3319

```

and

```auto
Uncaught (in promise) DOMException: Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS.
    at e.setupConnection (https://my_alias_taiga.domain.local/v-1631701833072/js/app.js:1:59357)
    at e.t [as setupConnection] (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:116927)
    at e (https://my_alias_taiga.domain.local/v-1631701833072/js/app.js:1:16548)
    at Object.invoke (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:232645)
    at https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:231497
    at mt (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:208051)
    at Ve (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:231475)
    at i (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:216401)
    at Object.st [as bootstrap] (https://my_alias_taiga.domain.local/v-1631701833072/js/libs.js:1:216709)
    at https://my_alias_taiga.domain.local/v-1631701833072/js/app-loader.js:1:2348

```

I then first added these lines in the nginx configuration of my taiga service:

```auto
 location /ws/ {
            proxy_pass http://mytaiga.domain.local:80;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto https;

            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

```

nothing changed, I then modified a line present in taiga’s docker-compose.yml. Before it was like this:

```auto
TAIGA_WEBSOCKETS_URL: "ws://my_alias_taiga.domain.local"

```

I changed it to this :

```auto
TAIGA_WEBSOCKETS_URL: "wss://my_alias_taiga.domain.local"

```

Nothing changed

I don’t know what to do now, so i hope someone can help me to resolve this. Thank you for your attention.

---

<div class="post-metadata">

**Author:** ![david.barragan](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/david.barragan/32/293_2.png) [@david.barragan](https://community.taiga.io/u/david.barragan)\
**Post date:** [January 19, 2024, 7:18pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/2 "2024-01-19T19:18:40Z")

</div>

Hi @tartrib

There is an example at the end of the [Taiga 30min setup](https://community.taiga.io/t/taiga-30min-setup/170) guide

First of all, you have to apply some changes in your `.env` file to use https and wss instead of http and ws:

```auto
TAIGA_SCHEME=https
TAIGA_DOMAIN=my_alias_taiga.domain.local
SUBPATH=""
WEBSOCKETS_SCHEME=wss

```

If you have directly modified the `docker-compose.yml` file you have to apply the necessary changes so that the different pieces use the secured external url (`https://my_alias_taiga.domain.local` and `wss://my_alias_taiga.domain.local`) for `TAIGA_SITES_SCHEME` and `TAIGA_SITE_DOMAIN` in `x-environments` and for `TAIGA_URL` and `TAIGA_WEBSOCKETS_URL` in the `taiga-front` service.

And now you have to configure your nginx with something like this.

```auto
server {
      listen 80;
      server_name my_alias_taiga.domain.local;
      rewrite ^(.*) https://my_alias_taiga.domain.local$1 permanent;
}

server {
      listen 443 ssl;
      server_name my_alias_taiga.domain.local;
      
      location / {
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Scheme $scheme;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_redirect off;
          proxy_pass http://localhost:9000/;
      }
      
      # Events
      location /events {
          proxy_pass http://localhost:9000/events;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_connect_timeout 7d;
          proxy_send_timeout 7d;
          proxy_read_timeout 7d;
      }
  
      # TLS: Configure your TLS following the best practices inside your company
      ssl_certificate /etc/letsencrypt/live/my_alias_taiga.domain.local/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/my_alias_taiga.domain.local/privkey.pem;
      include /etc/letsencrypt/options-ssl-nginx.conf;
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
      
      # Logs and other configurations
      error_log /var/log/nginx/mytaiga.domain.local-error.log warn;
      access_log /var/log/nginx/mytaiga.domain.local-access.log main;
  }

```

I use `http://localhost:9000/` because is the port using by the default setup. Use the port 80 for the taiga service (docker) and for the local nginx does not seem a good idea.

I hope this can help.

Best regards

---

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [February 6, 2024, 3:42pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/3 "2024-02-06T15:42:30Z")

</div>

Hi !

Thank you for your answer and sorry to react so late. I’ve change the docker-compose.yml with parameters like this :

```auto
taiga-front:
    image: taigaio/taiga-front:latest
    environment:
      TAIGA_URL: "https://my_alias_taiga.domain.local"
      TAIGA_WEBSOCKETS_URL: "wss://my_alias_taiga.domain.local"
      TAIGA_SUBPATH: "" # "" or "/subpath"
      PUBLIC_REGISTER_ENABLED: "true"

```

and also in the x-environment parameters :

```auto
TAIGA_SITES_SCHEME: "https"
TAIGA_SITES_DOMAIN: "my_alias_taiga.domain.local"

```

and nothing changed, when i look the devtools debug page, I have the same error as the first time. I wonder if this doesn’t come from the source code? because the error clearly tells me that it is a websocket problem and show me the app.js code.

---

<div class="post-metadata">

**Author:** ![david.barragan](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/david.barragan/32/293_2.png) [@david.barragan](https://community.taiga.io/u/david.barragan)\
**Post date:** [February 6, 2024, 7:51pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/4 "2024-02-06T19:51:28Z")

</div>

Hi @tartrib

Have you changed your nginx configuration as I mentioned? Proxy passing to port 80 doesn’t seem to make much sense (by default, the taiga-gateway service use the port 9000). Follow the settings from the guide as much as possible.

Taiga could work perfectly without websockets. taiga-events and taiga-front, which use websockets, are only used to keep taksboards and kanban updated in real time (when you are looking at it and someone else modifies something). This functionality could be incorrectly configured and Taiga would continue to work without problems.

Regards

---

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [February 7, 2024, 12:37pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/5 "2024-02-07T12:37:59Z")

</div>

Hi @david.barragan

It’s true, I didn’t completely follow the recommendations. I’m still using port 80 because I told myself that it’s simply a port issue. I’m going to test by changing the port and then I’ll let you know the result.

---

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [February 8, 2024, 3:26pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/6 "2024-02-08T15:26:27Z")

</div>

Hi @david.barragan,

I changed the docker-compose.yml like this :

```auto
taiga-gateway:
    image: nginx:1.19-alpine
    ports:
      - "9000:80"
      #- "80:80"

```

It was what you suggested ? Because even after that, the error is persistent.

---

<div class="post-metadata">

**Author:** ![david.barragan](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/david.barragan/32/293_2.png) [@david.barragan](https://community.taiga.io/u/david.barragan)\
**Post date:** [February 8, 2024, 4:56pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/7 "2024-02-08T16:56:48Z")

</div>

And have you change your nginx too? the proxy pass should be to localhost:9000

```auto
server {
      listen 443 ssl;
      server_name my_alias_taiga.domain.local;
      
      location / {
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Scheme $scheme;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_redirect off;
          proxy_pass http://localhost:9000/; # <- HERE
      }
      
      # Events
      location /events {
          proxy_pass http://localhost:9000/events; # <- HERE
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_connect_timeout 7d;
          proxy_send_timeout 7d;
          proxy_read_timeout 7d;
      }
  
      # TLS: Configure your TLS following the best practices inside your company
      ssl_certificate /etc/letsencrypt/live/my_alias_taiga.domain.local/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/my_alias_taiga.domain.local/privkey.pem;
      include /etc/letsencrypt/options-ssl-nginx.conf;
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
      
      # Logs and other configurations
      # ...
  }

```

---

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [February 9, 2024, 9:56am UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/8 "2024-02-09T09:56:41Z")

</div>

Hi @david.barragan

Sorry but, if I change the proxy pass to localhost:9000, how the reverse proxy can redirect to the taiga server ?  
you have probably been confused by all this information which lacks clarity so I will give you the context more clearly:

there is a server that runs taiga, this server is called

taiga-server.domain.local

to which I assigned an alias which is currently used in production

mytaiga.domain.local

I have another alias that I use to do my tests so as not to disrupt production

my\_alias\_taiga.domain.local but it’s not really an alias because in reality it’s an A record which points to the reverse proxy FQDN

I think that you thought the nginx server and the taiga server whas the same, but it’s two different server with different name and different IP. I hope I was able to provide more clarity.

So now i changed the nginx configuration with

```auto
location / {
                proxy_pass http://mytaiga.domain.local:9000;

```

but after restart the nginx server, i got a 502 bad gateway error.

---

<div class="post-metadata">

**Author:** ![david.barragan](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/david.barragan/32/293_2.png) [@david.barragan](https://community.taiga.io/u/david.barragan)\
**Post date:** [February 9, 2024, 1:58pm UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/9 "2024-02-09T13:58:08Z")

</div>

Sorry but the two location blocks have to be exactly as I have indicated. You don’t have to change the word `localhost` with your domain. Nginx receives the request on port 443 (or 80) and redirects using the proxypass to localhost:9000, which is where taiga is listening.

So try again with

```auto
     location / {
          proxy_set_header Host $http_host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Scheme $scheme;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_redirect off;
          proxy_pass http://localhost:9000/;
      }
      
      # Events
      location /events {
          proxy_pass http://localhost:9000/events;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_connect_timeout 7d;
          proxy_send_timeout 7d;
          proxy_read_timeout 7d;
      }

```

---

<div class="post-metadata">

**Author:** ![tartrib](https://avatars.discourse-cdn.com/v4/letter/t/dbc845/32.png) [@tartrib](https://community.taiga.io/u/tartrib)\
**Post date:** [February 12, 2024, 10:04am UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/10 "2024-02-12T10:04:06Z")

</div>

Hi @david.barragan,

Thank you for your explanation, I followed your instructions but it gave me a 502 Bad Gateway error.

---

<div class="post-metadata">

**Author:** ![david.barragan](https://dub1.discourse-cdn.com/flex017/user_avatar/community.taiga.io/david.barragan/32/293_2.png) [@david.barragan](https://community.taiga.io/u/david.barragan)\
**Post date:** [February 12, 2024, 10:45am UTC](https://community.taiga.io/t/mixed-content-and-wss-error-after-add-taiga-in-my-nginx-reverse-proxy/2478/11 "2024-02-12T10:45:15Z")

</div>

Have you restarted/reloaded nginx for the changes to take effect?

If taiga is already running on `localhost:9000`, this should work. If it doesn’t work, there must be some error in the settings that we are not seeing.

1. Check the settings.
2. Make sure that `http://localhost:9000` displays taiga perfectly.
3. Start nginx and check if `https://my_alias_taiga.domain.local` works now.