Self Host SSL Issues

Troubleshooting Self hosted Taiga
1

Hi all, I have launched a taiga instance on a VPS using docker. I have setup SSL for the host machine using certbot and nginx (this is a seperate layer from the docker containers).

For context here is the /etc/nginx/sites-available/taiga and .env that I am using.

sites-available/taiga

upstream taiga {
server 127.0.0.1:9000; # Replace this with the actual address
}

server {

listen 80;
server_name taiga.domain.com;
# Redirect all HTTP requests to HTTPS
return 301 https://$host$request_uri;

}

server {
listen 443 ssl;
server_name taiga. domain .com; #added space to be able to post on forum
ssl_certificate /etc/letsencrypt/live/taiga.domain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/taiga.domain.com/privkey.pem; # managed by Certbot

location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect off;
proxy_pass http:// taiga; #added a space to be able to post on forum
}

  # Events
  location /events {
    proxy_pass http:// taiga/events; # added space to be able to post to forum
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;

    proxy_connect_timeout 7d;
    proxy_send_timeout 7d;
    proxy_read_timeout 7d;
  }

  # TLS: Configure your TLS following the best practices inside your company
  # Logs and other configurations

}

.env

Taiga’s URLs - Variables to define where Taiga should be served

TAIGA_SCHEME=https # serve Taiga using “http” or “https” (secured) connection
TAIGA_DOMAIN=taiga .domain .com:9000 # Taiga’s base URL # Added space to be able to post to forum
SUBPATH=“” # it’ll be appended to the TAIGA_DOMAIN (use either “” or a “/subpath”)
WEBSOCKETS_SCHEME=wss # events connection protocol (use either “ws” or “wss”)

Taiga’s Secret Key - Variable to provide cryptographic signing

SECRET_KEY=“ThisIsAVeryUnpredictableStringThatNoOneWillEverGuessRight” # Please, change it to an unpredictable value!!

Taiga’s Database settings - Variables to create the Taiga database and connect to it

POSTGRES_USER=ConnectedTaigaUser # user to connect to PostgreSQL
POSTGRES_PASSWORD=ConnectedTaigaUserSoftware # database user’s password

Taiga’s SMTP settings - Variables to send Taiga’s emails to the users

EMAIL_BACKEND=console # use an SMTP server or display the emails in the console (either “smtp” or “console”)
EMAIL_HOST=smtp. domain. com # SMTP server address # Added space to be able to post to forum
EMAIL_PORT=465 # default SMTP port
EMAIL_HOST_USER=taiga@domain .com # user to connect the SMTP server # Added space to be able to post to forum
EMAIL_HOST_PASSWORD=somemagixpassword# SMTP user’s password
EMAIL_DEFAULT_FROM=taiga@domain .com # default email address for the automated emails # Added space to be able to post to forum

EMAIL_USE_TLS/EMAIL_USE_SSL are mutually exclusive (only set one of those to True)

EMAIL_USE_TLS=False# use TLS (secure) connection with the SMTP server
EMAIL_USE_SSL=True # use implicit TLS (secure) connection with the SMTP server

Taiga’s RabbitMQ settings - Variables to leave messages for the realtime and asynchronous events

RABBITMQ_USER=ConnectedTaigaUser # user to connect to RabbitMQ
RABBITMQ_PASS=ConnectedTaigaUserPassword # RabbitMQ user’s password
RABBITMQ_VHOST=taigaRabbitMQ # RabbitMQ container name
RABBITMQ_ERLANG_COOKIE=secret-erlang-cookie # unique value shared by any connected instance of RabbitMQ

Taiga’s Attachments - Variable to define how long the attachments will be accesible

ATTACHMENTS_MAX_AGE=360 # token expiration date (in seconds)

Taiga’s Telemetry - Variable to enable or disable the anonymous telemetry

ENABLE_TELEMETRY=True

Running on brave this is the page that goes live, and the dev tools that goes with it.

image
image1912×933 154 KB

I did not make any changes to the docker-compose.yml

3

Hi @KR34T1V

Use TAIGA_DOMAIN=taiga.domain.com in the .env file instead of TAIGA_DOMAIN=taiga.domain.com:9000. Then restart Taiga and try again.

Your browser has to connect to port 443 where your nginx listens, which is what performs the proxypass to port 9000.

I hope this can help.

Best regards

1 Like
4

Thanks that seems to have been it.
Do I need to reboot the containers after the .env change or rebuild it completely?

6

Just rebot the containers

7

Thanks,
I ran, docker-compose down, and then docker-compose up -d.
However I still have some issue with the WebSockets

image
image1914×928 62.4 KB

8

To setup websockets over wss you only have to add this block in your local nginx

      # Events
      location /events {
          proxy_pass http://localhost:9000/events;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_connect_timeout 7d;
          proxy_send_timeout 7d;
          proxy_read_timeout 7d;
      }

And use wss in .env file:

WEBSOCKETS_SCHEME=wss

I understand that this is what you have done so check the logs of ‘taiga-evets’ to confirm if there is any error.