Not able to login over reverse proxy

Phoscon App Bug reports
1

I am running deconz in a docker container.

    image: deconzcommunity/deconz:stable
    container_name: deconz
    restart: unless-stopped
    volumes:
      - /datavol/deconz:/opt/deCONZ
    ports:
      - '5901:5900'
      - '8084:80'
      - '444:443'
    devices:
      - /dev/ttyACM0
    environment:
      - DECONZ_WEB_PORT=80
      - DECONZ_VNC_MODE=1
      - DECONZ_VNC_PASSWORD=very_strong_password:)
      - DECONZ_VNC_PORT=5900
      - DECONZ_WS_PORT=443
      - DEBUG_INFO=1
      - DEBUG_APS=0
      - DEBUG_ZCL=0
      - DEBUG_ZDP=0
      - DEBUG_OTAU=0
    labels:
      #	HTTPS traffic
      - "traefik.enable=true"
      - "traefik.http.routers.deconz.rule=Host(`phoscon.${DOMAIN}`)"
      - "traefik.http.routers.deconz.entrypoints=web-secure"
      - "traefik.http.routers.deconz.tls=true"
      - "traefik.http.routers.deconz.tls.certresolver=certificato"
      - "traefik.http.routers.deconz.tls.domains[0].main=*.${DOMAIN}"
      - "traefik.http.routers.deconz.service=deconzService"
      - "traefik.http.services.deconzService.loadBalancer.server.port=80"
      - "traefik.http.routers.deconz.middlewares=chain-oauth@file"

  
networks:
  default:
    name: px-nw
    external: true

I set all my services to be reverse proxied with Traefik. Additionally, I expose some relevant ports on the host interface, in case there is trouble with the reverse proxy.
Things were working as supposed in some versions before the last stable. What I am now experiencing is that I am not able to log in over the reverse reverse proxy.

image

Using the host interface on port 8084 login works.

2

The URL is using login2.html . This does not seem to work with RPs, as there’s apparently some hardcoded port 80 involved. Use login.html instead.

3

Works. Why it defaults to login2.html is an separate question.

4

I still have this issue using NPM as reverse proxy I can’t login but can just fine if accessing by IP address.
I tried to access the /login.html URL but it just keeps redirecting to login2.html, even in an incognito window.

5

Hi,

I just installed deCONZ with Caddy as reverse proxy.
The arguments for deCONZ are
-platform minimal --dev=/dev/conbee --http-port=8080 --https-port=0
The Caddy file is (anonymized domain, http is used for integration in FHEM)


deconz.example.de {
    tls /etc/letsencrypt/live/deconz.example.de/fullchain.pem /etc/letsencrypt/live/deconz.example.de/privkey.pem

    @websockets {
		header Connection *Upgrade*
		header Upgrade websocket
	}
    reverse_proxy @websockets 127.0.0.1:8080
	reverse_proxy 127.0.0.1:8080
}

http://deconz.example.de {
    reverse_proxy 127.0.0.1:8080
}

The login uses the IP-Adress of the deCONZ-instance and fails because of not allowed Cross-Origin-Call to IP.

The cause ist this condition
(host.match(/^(192.168.|10.|172.(1[6-9]|2\d|3[01]))/)||-1===host.indexOf(".de"))

in the file /usr/share/deCONZ/webapp/pwa/js/scanner.js. It prevents usage of deconz.example.de as address of the gateway.
I patched the condition to
(host.match(/^(192\.168\.|10\.|172\.(1[6-9]|2\d|3[01]))/)||true)

the restarted deconz.
Then it take a few seconds then decent.exampe.de appears as address for the gateway and the login works.

Since scanner.js ist part of the Phoscon App that is not open source, I cannot fix it by myself as pull request.

But I think it should be fixed (why is explicitely the top level domain “.de” excluded). I use the instance protected behind a firewall with VPN. This should be possible.

Thanks in advance
Lars