Fresh install returning 502 Bad Gateway

Installation
23

Oh its still behind a reverse proxy, i just found a template and a few different ways to handle discourse. While still using the official installation method.

I will make a guide shortly. Just incase anyone else needs to use it or i might need to use it again LOL.

There is only a small issue since my install is not using the letsencrypt ssl. The email activation link that got sent out had http instead of https. There is a redirect for all http to https but i would like to force https from the backend so all links have https not http.

EDIT: found it

#FORCE SSL
DISCOURSE_FORCE_HTTPS: true

24

Eh… you have reverse proxy in use so why would you send https to backend?

25

Setting force https tells discourse to make all references to itself https.

26

Yes, but that doesn’t answer question why.

27

Its to keep the connection encrypted.

WAN → Reverse Proxy = HTTPS
Reverse Proxy → Backend = HTTPS

This way, if for some reason anyone that has access to my server room. Cannot just plug in an ethernet cable and see the traffic clearly. The connection would still have HTTPS and would make life a little harder for the intruder. I like to have my chain complete HTTPS. Not WAN HTTPS → Reverse Proxy HTTP → backend.

Otherwise that would simply be eggshell security.

Zero Trust, regardless if i know you for 10 years+.

28

Fair, if you have zero trust to that point where you move in private network, or you can’t build secure network after reverse proxy keeping it a gatekeeper.

29

Everything Is as secure as you can get it.

Haven’t you noticed most leaks always come from the inside. This way i know my server security is air tight and the only vulnerability would be humans and my employees understand that 100%.

I have a few high profile cloud users and if there data comes out for some miraculous reason knowing that my server security is air tight. I can then check cameras and know exactly who would be the cause of the data leak.

I think AWS does it in a similar manner, from what i’ve seen. Human vulnerability should always be a priority. No matter how secure your server is. One USB stick and its done for.

30

Because if you don’t then it’ll, for example, send out email links that link to http rather than https, or link to images with http rather than https. It’s on by default if discourse can tell that it’s https; I’m not quite sure why it’s not the default at this point, since Discourse mostly doesn’t work if there are any http links.

It’s not about the connection between the reverse proxy and Discourse but the links discourse makes to itself.

2 Likes
31

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.