NGINX SSL Proxy add-on fails to work but no logs to debug

[bucklevision]

Describe the issue you are experiencing

Add-on shows as started, then 20 seconds late it stops itself.
At no point does 443: get opened on the machine that i can see via netstat.
Browser reports connection refused.

What type of installation are you running?

Home Assistant OS

Which operating system are you running on?

Home Assistant Operating System

Which add-on are you reporting an issue with?

NGINX Home Assistant SSL proxy

What is the version of the add-on?

3.5.0

Steps to reproduce the issue

DuckDNS installed and working, certs checked and fine on domain.
Install NGINX SSL Proxy add-on and configure with FQDN used by duckdns (https://X.duckdns.org) and operating on port 443
Forward port on router 443 to the HAOS machine 443.
Enable NGINX proxy - no response at X.duckdns.org:443

System Health information

No repairs, system healthy. No button/pop-up.

Anything in the Supervisor logs that might be useful for us?

Nothing visible.

Anything in the add-on logs that might be useful for us?

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service nginx: starting
s6-rc: info: service nginx successfully started
s6-rc: info: service crond: starting
s6-rc: info: service crond successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
sed: bad option in substitution expression
[17:20:58] INFO: Service nginx exited with code 1 (by signal 0)
s6-rc: info: service legacy-services: stopping
s6-rc: info: service legacy-services successfully stopped
s6-rc: info: service crond: stopping
[17:20:58] INFO: Service crond exited with code 256 (by signal 15)
s6-rc: info: service crond successfully stopped
s6-rc: info: service nginx: stopping
s6-rc: info: service nginx successfully stopped
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped

Additional information

I had this exact process working fine on an RPi OS, but I cannot replicate it here on HAOS. It seems that if anything additional is needed in the config isn't explicitly listed in the documentation.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[elegant-emma]

Short info of my Setup:
HomeAssistant running on RPI 400 with version 2023.11.3
NGINX SSL Proxy add-on v3.5.0

1: Access logs
You can either enable via custom config in /share/nginx_proxy_default*.conf:

error_log /dev/stdout;
access_log /dev/stdout;

or a "tail -f" from the core-ssh addon to /config/home-assistant.log is doing what needed.

2: The problem itself
Getting from the system the following line again and again:

2023-12-03 22:42:37.653 ERROR (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from 172.30.33.0, but your HTTP integration is not set-up for reverse proxies

No difference when using curl and switching explicitly to http2 or http1.1
Everytime returning "400: Bad Request".

Suspicous to me is the part of the error log address: 172.30.33.0 is normaly a net address and not used actively.

That's all I got now, it's late and this has been a hour or so debugging this whole thing.
Until then.

[quoing]

Did you follow the configuration page?

And you need to add the trusted_proxies section (requests from reverse proxies will be blocked if these options are not set).

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24

Requires restart of hass.

[tkurki]

The add-on doc should clearly say "if you see 400 Bad request you need to add this section...".

To a newcomer like me the NGINX SSL Proxy documentation is very unclear: there is no distinction between which parts of the configuration instructions concern the Add-on and which parts refer to global HA configuration.yaml. A newcomer will have to discover this difference and figure out how to edit the global file, installing some additional add-ons to do so.

Even before the must-have trusted_proxies segment the doc has the segment some options in the http: section are no longer necessary, that are not present in a newbie's system. That should be demoted lower.

[elegant-emma]

the fun thing is, I added the trusted_proxies section, no difference.

I will try to replicate with a standalone nginx and trace down the content send between nginx and ha...

[elegant-emma]

ok, got it running. Changed the following Settings meanwhile:

1. Added HA URL in Settings. From the Dashboard goto Setting > System > Network
   (Not sure if this is necessary or not.)

2. Edited the configuration.yaml with the File Editor.
   Downloaded File Editor Addon and edited homeasstitant.yaml. The Path written in the link below is outdated. You now have a /homeassistant folder with any config yaml for the system/core things.

As described by @tkurki the trusted_proxies section got added to the homassitant.yaml. Quick reload of all services and it worked.
Initially the word trusted_proxies connected me to the nginx yaml files.... this should be done better

https://www.home-assistant.io/getting-started/configuration/

[tkurki]

@elegant-emma did u notice the PR that I linked above? Can you check if the doc updates there make sense to you?

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[ismdcf]

Hi I'm still facing issue with getting this working, it's been hours debugging. Tried and verified.

1. Added the trusted_proxies
2. Checked if the SSL cert and key are present on /ssl directory
3. install duck DNS and check the default HTTP config provided by duck DNS and URL was accessible from outside without any issu
4. after enabling the nginx addon out side URL stopped working and only internal URL started working.

Please let me know if there are any logs required
@tkurki and @elegant-emma please provide your insights on this

[ismdcf]

It all of sudden started working, For those stumble on to this make sure to do full reboot and wait for some time for the addon to start before accessing the web UI