Install on OpenLiteSpeed via Docker - curl 127.0.0.1 fails

[hycday]

hi team,

I have have the instructions and followed all the steps.
Remark42 is installed via docker, but I fail to access it.

This is my setup:
Server Ubuntu 20.04 TLS
OpenLiteSpeed
Docker is installed

Here are all the steps I did :

1- I created a file docker-compose.yml with this content, and I saved it under /home/{MYDOMAIN.COM}/public_html/remark42

version: '2'

services:
    remark:
        build: .
        image: umputun/remark42:latest
        container_name: "remark42"
        hostname: "remark42"
        restart: always
        
        logging:
          driver: json-file
          options:
              max-size: "10m"
              max-file: "5"
 
        # uncomment to expose directly (no proxy)
        ports:
          - "8080:8080"

        environment:
            - REMARK_URL=https://{MYDOMAIN.COM}
            - SECRET=********   # here I put my root password
            - SITE={mydomain}
            - STORE_BOLT_PATH=/srv/var/db
            - BACKUP_PATH=/srv/var/backup
            - DEBUG=true
            - AUTH_ANON=true
            # - ADMIN_PASSWD=password
        volumes:
            - ./var:/srv/var

For now I want to try out the simple config, no facebook/github etc.

Then I do :

$ docker pull umputun/remark42:latest
$ docker-compose pull
$ docker-compose up -d

Now a $ docker stats gives me :

CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS
82f7486d2a00 remark42 0.00% 9.488MiB / 3.746GiB 0.25% 4.74kB / 839B 4.1kB / 26.9MB 9

and

$ docker ps -a gives me :

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
82f7486d2a00 umputun/remark42:latest "/init.sh /srv/remar…" 28 minutes ago Up 28 minutes (healthy) 0.0.0.0:8080->8080/tcp, :::8080->8080/tcp remark42

Now in OpenLiteSpeed, I did $ sudo nano /usr/local/lsws/conf/httpd_config.conf and added :

extprocessor remark42 {
type proxy
address 127.0.0.1:8080
maxConns 100
pcKeepAliveTimeout 60
initTimeout 60
retryTimeout 0
respBuffer 0
}

as described here https://community.cyberpanel.net/t/reverse-proxy-traffic-to-docker-container-on-cyberpanel/30644

This by the way also appears on OpenLiteSpeed frontend as such :

Then, in /home/{MYDOMAIN.COM}/public_html/ I added the following in .htaccess :

RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} =/remark42/*
REWRITERULE ^(.*)$ http://remark42:8080/$1 [P]

I tried with the following as well btw but it breaks all the frontend, so I stick with the above :

#RewriteCond %{HTTPS} !=on
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
#RewriteRule ^(.*)$ http://remark42/$1 [P]

After I rebooted OpenLiteSpeed, my website works, but when doing $ curl 127.0.0.1:8080 I get

curl: (56) Recv failure: Connection reset by peer

If i do
$ docker exec -it remark42 /bin/sh, then inside /srv # I run curl -v 127.0.0.1:8080
I get:

Trying 127.0.0.1:8080...
Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
GET / HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: curl/7.80.0
Accept: /

.....

then 404 page not fount at the end`

If i do iptables -L | grep -i docker I get some results with DOCKER, but the DOCKER-INGRESS bock is missing in the iptables output.

So I have no idea what to do now...
Any help would be gladly welcome :)
Note that I am really a noob...

Thanks in advance !

[hycday]

update:

I just realised that if I go to my browser to http://{MYDOMAIN.COM}:8080/web/ (note the HTTP not HTTPS) I can see the following :

and in the console I see :
Access to script at 'https://{MYDOMAIN.COM}/remark42/web/embed.mjs' from origin 'http://{MYDOMAIN.COM}:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
embed.mjs:1 Failed to load resource: net::ERR_FAILED
{MYDOMAIN.COM}/:1 Access to script at 'https://{MYDOMAIN.COM}/remark42/web/counter.mjs' from origin 'http://{MYDOMAIN.COM}:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
counter.mjs:1 Failed to load resource: net::ERR_FAILED
Refused to frame 'http://{MYDOMAIN.COM}:8080/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors {MYDOMAIN.COM}".

so I guess that even if the curl to 127.0.0.1 in ssh doesnt work, if I manage to solve this SSL topic then my install would be good, no ?
so, how to solve it :D ? haha

[umputun]

pls don't use issues to ask for help in your setup. we have discussions for this. moved

[paskal]

Based on your setup, I would say that curl -I http://127.0.0.1:8080/web/ should work and return 200 from remark42 itself. curl -I https://{MYDOMAIN.COM}/remark42/web/ should produce the same result with different headers as the request is proxied to the remark42 by your webserver.

As for CORS, I think the problem comes from the fact you're trying to access remark42 on port 8080 and not 443: I think as soon as you change the setup to make it work on port 443 the error would be gone. However, I don't know what is precisely wrong with your setup on port 443, here is how it should look like in Nginx:

server {
        listen 80;
        server_name remark42.example.org;

        location / {
                client_max_body_size 2M;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_pass       http://remark42:8080/;
        }
}

I don't know how .htaccess should look like, but the fragment before which you posted doesn't do proxying but just does the redirect, doesn't seem right to me. You should proxy the requests so that the requestor would see the right address and wouldn't be redirected to the port 8888.

RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} =/remark42/*
REWRITERULE ^(.*)$ http://remark42:8080/$1 [P]

[hycday]

thanks for your answer @paskal

curl -I http://127.0.0.1:8080/web/ and curl -I http://127.0.0.1:8080/remark42/web/
both return curl: (56) Recv failure: Connection reset by peer

curl -I https://{MYDOMAIN.COM}/remark42/web/
returns

HTTP/1.1 404 Not Found
App-Name: remark42
App-Version: v1.10.1-6936268-20220606T10:17:02
Author: umputun
Content-Security-Policy: frame-ancestors {MYDOMAIN.COM};
Content-Type: text/plain; charset=utf-8
Vary: Origin
X-Content-Type-Options: nosniff
Date: Sun, 12 Jun 2022 04:41:01 GMT
Content-Length: 19

while curl -I http://{MYDOMAIN.COM}:8080/web/
returns

HTTP/1.1 405 Method Not Allowed
App-Name: remark42
App-Version: v1.10.1-6936268-20220606T10:17:02
Author: umputun
Content-Security-Policy: frame-ancestors {MYDOMAIN.COM};
Vary: Origin
Date: Sun, 12 Jun 2022 04:40:47 GMT

on my browser, opening http://{MYDOMAIN.COM}:8080/web/ gives me why I stated here #1389 (comment)

As for port 443, I basically need to do the same as what I did with 8080 but replace with 443 for https to work ? if so, I don't understand (real question) why it is not the default config steps as https should be "the norm" no ?

Finally, regarding the htaccess, I don't see the difference between what I have :

RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} =/remark42/*
REWRITERULE ^(.*)$ http://remark42:8080/$1 [P]

and what you posted :

RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} =/remark42/*
REWRITERULE ^(.*)$ http://remark42:8080/$1 [P]

[hycday]

btw I get exact same result with following in htaccess and removing the "extprocessor remark42" from /usr/local/lsws/conf/httpd_config.conf

RewriteRule /web/(.*) http://127.0.0.1/remark42/$1 [P]

as well as with this version as well:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} /remark42/(.)
RewriteRule /remark42/(.) http://remark42/$1 [P]

[paskal]

The . htaccess I posted is yours, I posted it to clarify what I'm discussing in the text.

If curl -I https://{MYDOMAIN.COM}/remark42/web/ works (e.g. returns something from remark42 itself judging by the headers), I think it should work from browser or with curl GET instead of default OPTION call with -I: curl -I -X GET https://{MYDOMAIN.COM}/remark42/web/.

If https://{MYDOMAIN.COM}/remark42/web/ returns 200 from curl command I posted the last, opening it in the browser should work. What do you see when you open it? If there is an error, what happens on Network tab in the development tools of the browser?

[hycday]

curl -I https://{MYDOMAIN.COM}/remark42/web/ doesn't work : I get 301 error (and 302 error if I replace with HTTP, not HTTPS) and no reference to remark42 from header. (same with -X GET)

curl -I http://{MYDOMAIN.COM}:8080/web/ gives me error 405 and App-Name: remark42

curl -I -X GET http://{MYDOMAIN.COM}:8080/web/ gives me 200 and App-Name: remark42
for that one, if I check in Network in brower, I see error 301 (CORS error) for https://{MYDOMAIN.COM}/remark42/web/embed.mjs and https://{MYDOMAIN.COM}/remark42/web/counter.mjs with Referrer Policy: strict-origin-when-cross-origin

[paskal]

Also, we discussed https://{MYDOMAIN.COM}/remark42/web/ without WWW subdomain, can you please check it? Is the result the same as with www?

[hycday]

These lines do precisely the redirect we saw above, from non-www subdomains to www with HTTP and not HTTPS.
my bad... not sure how come, this is auto generated by CyberPanel and looked to be working...anyway I removed

Also, we discussed https://{MYDOMAIN.COM}/remark42/web/ without WWW subdomain, can you please check it? Is the result the same as with www?

When I mention {MYDOMAIN.COM} it is without the www (I edited my above message as I did a typo and for my last sentence it is without the WWW) and everywhere else where I mention MYDOMAIN.COM it is without www

[paskal]

Something is still off about your web server configuration, it might be not fixable just by altering the .htaccess file. Is there any particular reason you're using OpenLiteSpeed and not Nginx? I think it might be a good idea to ask the same question (and link the discussion here) in the OpenLiteSpeed discussion forum if you want to stick to it, as this thread is the first time I've heard of it and it's hard for me to help you because of that.

And also, were you doing curl http://127.0.0.1:8080/web/ on the same host you are running remark42 in Docker? As it's bizarre that it would work through that web server on some particular port but not directly. I have no explanation for that behaviour.

[hycday]

I'm using OLS as I saw loads of comparison showing that OLS is faster than Nginx, with less setup complexity. As I also have low budget, I have a low vCPU/RAM server, therefore it suits my needs to deliver fast pages with low ressources.

when doing my curl, I did them via SSH on my server. I only have one server.
I agree with you that it's weird.
Will try to reach out OLS forum. But if you think of anything in the meantime, let me know please :)

[paskal]

The type of speed which OLS could potentially provide over Nginx is something which would never meaningfully affect your customers, trust me on that. Here is a post I wrote on one optimisation case. I learned that lesson the hard way.
It's way better to stick to something popular for which you know you can get help with and is easy to set up.