Running code-server with reverse proxy through ssh-tunnel results in websocket problem

[intragart]

Hi everyone,

I'm running code-server inside docker with exposed port 8443. The docker host is tunneling the local port 127.0.0.1:8443 to the remote port 127.0.0.1:8443 on an external server. The external server runs Apache2 with an SSL certificate from let's encrypt and I'm trying to reverse proxy a subdomain through the ssh-tunnel to the code-server container. This is partially working. I'm able to login but after that a popup comes up essentially saying "Error: WebSocket close with status code 1006". The browsers console doesn't look any better:

I tried multiple configurations for Apache2, including #2104 (comment), #1544 (comment) and guide.md. The Screenshot was made with the following Apache2 configuration:

<VirtualHost *:80>
    ServerName my.fqdn
    ServerAdmin webmaster@localhost
    Redirect permanent / https://my.fqdn/
</VirtualHost>

<VirtualHost *:443>
    ServerName my.fqdn
    ServerAdmin webmaster@localhost
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/my.fqdn/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/my.fqdn/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://127.0.0.1:8443/$1 [P,L]
    RewriteCond %{HTTP:Upgrade} !=websocket [NC]
    RewriteRule /(.*) http://127.0.0.1:8443/$1 [P,L]
    ProxyRequests off
    ProxyPass / http://127.0.0.1:8443/ nocanon
    ProxyPassReverse / http://127.0.0.1:8443/

</VirtualHost>

When I connect to the docker container using HTTP within the local network everything is working fine.

Does anyone have any ideas how to fix this problem?
Thanks in advance :)

[jsjoeio]

I am hoping this is the same issue as this: #4693

Which should be fixed in this PR: #4840

[intragart]

Thanks for helping me anyway :)

I think the problem is within the reverse proxy configuration in Apache. The same construct with the tunnels is already working with Home Assistant. The only difference is that Home Assistant is running in network_mode: host while code-server has only port 8443 exposed. To make sure I’m not missing something I traced local HTTP traffic using Wireshark between my PC and code-server to verify that no ports other than 8443 are being used. I saw that the WebSocket connection was indeed only using port 8443.

While configuring the reverse proxy for Home Assistant I also had problems with the WebSocket connection. The now working configuration is the same as for code-server but has some additional lines as shown below:

<VirtualHost *:443>
    [...]

    <Proxy *>
        Allow from localhost
    </Proxy>
    
    [...]

    Header add Connection "Upgrade"
    RequestHeader set Connection "Upgrade"

    [...]
    
    ProxyPreserveHost On
    ProxyPass /api/websocket ws://127.0.0.1:8123/api/websocket
    ProxyPassReverse /api/websocket ws://127.0.0.1:8123/api/websocket
</VirtualHost>

If I remember correctly the last two lines for this entry did the trick and the WebSocket connection started working. Do you know if I have to configure a path like this specifically for the WebSocket from code-server?

[jsjoeio]

If I remember correctly the last two lines for this entry did the trick and the WebSocket connection started working

Oh great! Sounds like we're close. I haven't used Apache in the past. I've only ever used Caddy and the most basic setup looks like this:

http://localhost:8082/vscode/* {
  uri strip_prefix /vscode
  reverse_proxy 127.0.0.1:8080
}

Do you know if I have to configure a path like this specifically for the WebSocket from code-server?

I don't know but maybe @code-asher does?

[intragart]

In the last few days, I tried to deploy an apache2 reverse proxy within my home network to make sure there is no problem with my ssh tunnel. I used the same configuration as stated earlier with updated IP addresses and it worked right away. So, I think it’s the combination of apache2-reverse-proxy and ssh-tunneling with port forwarding which is not working.

I’ve now rebuilt my setup at the external server using docker and nginx as reverse proxy instead of apache2 on the host directly. I additionally added an openssh-server to my stack which is used as tunnel-endpoint for my local network and as reverse-proxy target for nginx. This time code-server is working as expected. Also, Home Assistant doesn’t require the extra ProxyPass for /api/websocket anymore.

Thanks for your efforts 😊

[code-asher]

For some reason Apache does not work! #4723

I have not been able to look into it though other than reproducing.

[jsjoeio]

Ah! Well I'm happy you found a workaround. Apologies I didn't know Apache wasn't working (thanks @code-asher) otherwise I would have mentioned it sooner. Cheers! 🎉