Our discourse runs behind a proxy for outbound traffic.
We see that with “external system avatars enabled” selected the avatars are not loaded. Also the check for updates does not work.
We have set http_proxy and https_proxy. In the logging the message “Job exception: invalid address” is repeated.
How can we have outgoing requests working?
Is this the letter avatars that is an issue or the uploaded avatars? Can you describe in detail how stuff is configured?
What’s the format of your http_ proxy variables? It has user and password inside?
We have no user and password, output from set | grep -i proxy
HTTPS_PROXY=http://<server>:<port>/
HTTP_PROXY=http://<server>:<port>/
NO_PROXY='127.0.0.1, localhost, <internal-network>'
http_proxy=http://<server>:<port>/
https_proxy=http://<server>:<port>/
no_proxy='127.0.0.1, localhost, <internal-network>'
A curl from within the container, which uses the proxy-settings:
curl -o /dev/null -v https://avatars.discourse.org/v2/letter/s/5f9b8f/45.png
results in: 200 OK
This is the letter avatars, but also the check for updates doesn’t work. It looks like all outgoing requests are failing.
We have a docker-host based on the standalone.yml. In the env: section we added the proxy-settings. Attaching to the running container shows that the proxy-settings are correct.
Last time I had to work in an environment like this I found that Ruby is the worst language in this aspect, where most http methods don’t respect the proxy variables unless explicitly set, where java, python, node, php all work fine. /rant
You can try to emulate the version check with:
ssh root@your.server.here
cd /var/discourse
./launcher enter app
cd /var/www/discourse
rails c
puts Excon.send( :get, 'https://meta.discourse.org/latest.json', omit_default_port: true).body
## also
puts ENV ## does this prints your proxy info?
It works or fail? What’s the error message?
No errors, all output looks fine.
root@93ca6a8ec7a6-discourse:/var/www/discourse# rails c
[1] pry(main)> puts Excon.send( :get, 'https://meta.discourse.org/latest.json', omit_default_port: true).body
{"users":[{"id":1,"username":"sam","avatar_template":"/user_avatar/meta.discourse.org/sam/{size}/5243_1.png"},
... much more ...
Frequent Poster","user_id":1,"primary_group_id":47}]}]}}
=> nil
[2] pry(main)> ENV
...
"HTTPS_PROXY"=>"http://<server>:8082/",
"HTTP_PROXY"=>"http://<server>:8082/",
...
"NO_PROXY"=>
"127.0.0.1, localhost, <internal>",
...
"http_proxy"=>"http://<server>:8082/",
"https_proxy"=>"http://<server>:8082/",
"no_proxy"=>
"127.0.0.1, localhost, <internal>"}
Hello @Falco,
Any ideas on my output?
Peter
We can emulate the version check and we can disable remote avatars, but are there any more outbound connections known? If not, these workarounds could work for us, but we’re not sure if we introduce some other problems then…
You can simply disable version check in site settings at least.
We are not sure if there are other problems when we disable the version check and remote avatars. Are there any other outbound connections needed? As Dimitri also asked.
@pvdr - did you get this fully resolved? We too are running a discourse behind a firewall which means youtube/github oneboxes don’t work as expected. I’m told by our IS that we may be able to allow outbound access to youtube via our internal corp proxy, and searching for help turned up this thread.
We have problems also with the mail, so we haven’t migrated yet. The problems we had are not solved either.
Discourse의 최신 버전에서 변경된 점이 있나요?
나가는 프록시(outgoing proxy)를 설정하는 쉬운 방법이 생겼나요?
Cloudflare 보호가 올바르게 작동하려면 공격자에게 원본 IP를 숨기는 것이 중요합니다.
관련 주제:
필요하다면 코드에 기여할 수 있습니다. 프록시 설정을 사용하도록 리팩토링해야 할 코드가 어떤 부분인지 몇 가지 팁만 주시면 됩니다.
현재 이 사용 사례를 지원하지 않습니다.
직감을 따르면, 이는 시스템 레벨에서 처리하는 것이 가장 좋을 것 같습니다. 나가는 연결(또는: Cloudflare IP로 가지 않는 모든 트래픽)을 가로채서 로컬 프록시로 전달하는 방식입니다.
실망스럽네요. 모든 종류의 앱에 프록시 설정이 있습니다. 특히 기업 내부의 폐쇄형 환경에서는 매우 흔합니다.
네, 그걸 시작하는 방법에 대한 팁이 있을까요? iptables를 사용해야 하나요?
예제가 있다면 정말 감사하겠습니다 
이 경우, 여기서 시작하는 것을 제안합니다: Install discourse with internet access only via proxy
과거에 제가 일했던 대부분의 폐쇄형 환경에서는 트래픽이 일반적으로 가로채기(intercepting) 프록시를 통해 투명하게 전달됩니다.
설치에는 문제가 없으며, 다른 웹사이트 크롤링과 같은 исходя 연결에 대한 사용자 지정 프록시가 부족하다는 점에만 문제가 있습니다.
제가 틀렸다면 알려 주세요. 프록시 설정에서 설치 과정과 실행 중인 레일즈는 별개입니다.
이 문제를 해결하셨나요?