CSFR Error while login behind HA Proxy

[crospa91 (Matt)]

Hi guys, I hope this is the right section to ask for help about this.
I recently changed the reverse proxy I have in front of the discourse server.
I have a server with several discourse installed and a reverse proxy on front that point domains to the right web server.

I’ve used HA Proxy on both setup but the difference it’s the platform, before it was installed in PFSense, and now on OPNSense.

The reverse proxy works perfectly but if I try to login I get the CSFR error and can’t really do anything.

nothing have changed in the discourse setup and the HA Proxy configuration is copied over so should be fine.
I’ve turned on XforwardFor and SSL but still discourse don’t seems to keep the same IP from the client but sees only the one from the proxy.

This the reddit post where I’ve asked support as well: https://www.reddit.com/r/OPNsenseFirewall/comments/l4ltxb/migration_from_pfsense_to_opnsense_ha_proxy/?utm_source=share&utm_medium=web2x&context=3

[pfaffman (Jay Pfaffman)]

I don’t know if it’ll fix the csfr problem (which I think has to do with https certificate problems, but don’t really know), but the forwarded for boot your did by telling the nginx inside the container what addresses to trust. You can search here for X-forwarded-for and find examples of how to fix that.

[crospa91 (Matt)]

Thanks for your reply.
I had a look on the forum for that but can’t really find any updated information.

there is a bunch of old topics with the reference of Real_ip to put in nginx inside the container, but I have no clue on how to do that.

do you suggest any specific guide?

[pfaffman (Jay Pfaffman)]

I don’t see a specific guide, but I’ll try to create one soon. Here’s this Inconsistent / missing registration & last IP - #13 by pfaffman that I think should give you what you need for the real-ip bit.

[RGJ (Richard - Communiteq)]

@crospa91

XforwardFor and SSL

You need to send an X-Forwarded-Proto header as well.

[crospa91 (Matt)]

THANKS! Really I was 3 days I was running around in circles and this solved it!

I’ve added the Proto Header as well and it worked!

[neounix (Dark Matter)]

@crospa91

THANKS! Really I was 3 days I was running around in circles and this solved it!

FWIW, there are many example configurations for reverse proxy servers in front of the Discourse app, including this one, almost all address “X-Forwarded-Proto”:

I want to install using a reverse proxy for Apache

Dear @Teraterayuki … Here is an example set of working Apache2 virtual hosts for a reverse proxy to a unix domain socket in a Discourse container: Port 80 <VirtualHost *:80> ServerName mysite.mydomain.com ServerAdmin webmaster@localhost ProxyPreserveHost On #ProxyPass / http://127.0.0.1:8888/ #ProxyPassReverse / http://127.0.0.1:8888/ # Available loglevels: trace8, ..., trace1, debug, info, notice, warn, # error, crit, alert, emerg.…