New Taiga, reverse proxying with HTTPS using Caddy

Troubleshooting Self hosted Taiga
1

Hello all,

Another proxy help request. Seems we need a tag for these. I’ve read the others, but it still looks like the Matrix to me.

giphy

I have Taiga Docker installed, and I’m intending to access as https://projects.example.com, with Caddy terminating SSL.

I’m having troubles understanding the websocket - proxy details. I’m fairly new to proxies in general, aside from cut-paste following of guides. My domain is proxied with Caddy. I add blocks for each service:

        import tls_cloudflare

        reverse_proxy http://taiga.home.arpa:9000 {
                transport http {
                        versions h1
                }

                header_up Host {host}
                header_up Upgrade {upgrade}
                header_up Connection {connection}
        }
}

No matter what I do with Caddy, I constantly get 426 unexpected server response and 400 connection refused when testing. I’m testing with:

wscat -c wss://projects.example.com/events

and

curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" -H "Host: projects.example.com" https://projects.example.com/events

My .env is:

TAIGA_DOMAIN=projects.example.com  # Taiga's base URL
SUBPATH="" # it'll be appended to the TAIGA_DOMAIN (use either "" or a "/subpath")
WEBSOCKETS_SCHEME=wss  # events connection protocol (use either "ws" or "wss")
...

Here is the docker-compose.yml (I attached an external postgres server):

If someone knows how to syntax highlight in this Discourse, please lmk

``` version: "3.5"

x-environment:
&default-back-environment

These environment variables will be used by taiga-back and taiga-async.

Database settings

POSTGRES_DB: “taiga”
POSTGRES_USER: “${POSTGRES_USER}”
POSTGRES_PASSWORD: “${POSTGRES_PASSWORD}”
POSTGRES_HOST: “${POSTGRES_HOST}”

Taiga settings

TAIGA_SECRET_KEY: “${SECRET_KEY}”
TAIGA_SITES_SCHEME: “${TAIGA_SCHEME}”
TAIGA_SITES_DOMAIN: “${TAIGA_DOMAIN}”
TAIGA_SUBPATH: “${SUBPATH}”

Email settings.

EMAIL_BACKEND: “django.core.mail.backends.${EMAIL_BACKEND}.EmailBackend”
DEFAULT_FROM_EMAIL: “${EMAIL_DEFAULT_FROM}”
EMAIL_USE_TLS: “${EMAIL_USE_TLS}”
EMAIL_USE_SSL: “${EMAIL_USE_SSL}”
EMAIL_HOST: “${EMAIL_HOST}”
EMAIL_PORT: “${EMAIL_PORT}”
EMAIL_HOST_USER: “${EMAIL_HOST_USER}”
EMAIL_HOST_PASSWORD: “${EMAIL_HOST_PASSWORD}”

Rabbitmq settings

RABBITMQ_USER: “${RABBITMQ_USER}”
RABBITMQ_PASS: “${RABBITMQ_PASS}”

Telemetry settings

ENABLE_TELEMETRY: “${ENABLE_TELEMETRY}”

…your customizations go here

x-volumes:
&default-back-volumes

These volumens will be used by taiga-back and taiga-async.

  • taiga-static-data:/taiga-back/static
  • taiga-media-data:/taiga-back/media

- ./config.py:/taiga-back/settings/config.py

services:

taiga-db:

image: postgres:12.3

environment:

POSTGRES_DB: “taiga”

POSTGRES_USER: “${POSTGRES_USER}”

POSTGRES_PASSWORD: “${POSTGRES_PASSWORD}”

healthcheck:

test: [“CMD-SHELL”, “pg_isready -U ${POSTGRES_USER}”]

interval: 2s

timeout: 15s

retries: 5

start_period: 3s

volumes:

- taiga-db-data:/var/lib/postgresql/data

networks:

- taiga

taiga-back:
image: taigaio/taiga-back:latest
environment: *default-back-environment
volumes: *default-back-volumes
networks:
- taiga
depends_on:

taiga-db:

condition: service_healthy

  taiga-events-rabbitmq:
    condition: service_started
  taiga-async-rabbitmq:
    condition: service_started

taiga-async:
image: taigaio/taiga-back:latest
entrypoint: [“/taiga-back/docker/async_entrypoint.sh”]
environment: *default-back-environment
volumes: *default-back-volumes
networks:
- taiga
depends_on:

taiga-db:

condition: service_healthy

  taiga-events-rabbitmq:
    condition: service_started
  taiga-async-rabbitmq:
    condition: service_started

taiga-async-rabbitmq:
image: rabbitmq:3.8-management-alpine
environment:
RABBITMQ_ERLANG_COOKIE: “${RABBITMQ_ERLANG_COOKIE}”
RABBITMQ_DEFAULT_USER: “${RABBITMQ_USER}”
RABBITMQ_DEFAULT_PASS: “${RABBITMQ_PASS}”
RABBITMQ_DEFAULT_VHOST: “${RABBITMQ_VHOST}”
hostname: “taiga-async-rabbitmq”
volumes:
- taiga-async-rabbitmq-data:/var/lib/rabbitmq
networks:
- taiga

taiga-front:
image: taigaio/taiga-front:latest
environment:
TAIGA_URL: “${TAIGA_SCHEME}://${TAIGA_DOMAIN}”
TAIGA_WEBSOCKETS_URL: “${WEBSOCKETS_SCHEME}://${TAIGA_DOMAIN}”
TAIGA_SUBPATH: “${SUBPATH}”
# …your customizations go here
networks:
- taiga
# volumes:
# - ./conf.json:/usr/share/nginx/html/conf.json

taiga-events:
image: taigaio/taiga-events:latest
environment:
RABBITMQ_USER: “${RABBITMQ_USER}”
RABBITMQ_PASS: “${RABBITMQ_PASS}”
TAIGA_SECRET_KEY: “${SECRET_KEY}”
networks:
- taiga
depends_on:
taiga-events-rabbitmq:
condition: service_started
ports:
- “8888:8888” # Expose websocket port on Taiga VM

taiga-events-rabbitmq:
image: rabbitmq:3.8-management-alpine
environment:
RABBITMQ_ERLANG_COOKIE: “${RABBITMQ_ERLANG_COOKIE}”
RABBITMQ_DEFAULT_USER: “${RABBITMQ_USER}”
RABBITMQ_DEFAULT_PASS: “${RABBITMQ_PASS}”
RABBITMQ_DEFAULT_VHOST: “${RABBITMQ_VHOST}”
hostname: “taiga-events-rabbitmq”
volumes:
- taiga-events-rabbitmq-data:/var/lib/rabbitmq
networks:
- taiga

taiga-protected:
image: taigaio/taiga-protected:latest
environment:
MAX_AGE: “${ATTACHMENTS_MAX_AGE}”
SECRET_KEY: “${SECRET_KEY}”
networks:
- taiga

taiga-gateway:
image: nginx:1.19-alpine
ports:
- “9000:80”
volumes:
- ./taiga-gateway/taiga.conf:/etc/nginx/conf.d/default.conf
- taiga-static-data:/taiga/static
- taiga-media-data:/taiga/media
networks:
- taiga
depends_on:
- taiga-front
- taiga-back
- taiga-events

volumes:
taiga-static-data:
taiga-media-data:

taiga-db-data:

taiga-async-rabbitmq-data:
taiga-events-rabbitmq-data:

networks:
taiga:

</details>