Mattermost, omnibus, Nginx reverse proxy (+ ssl offloading)

I try to install mattermost on my gitlab instance. My gitlab is installed in a LXC container, so http request pass throught in a NGINX proxy (on the host), which also make SSL offloading:

httpS://mygitlab.mydomain.fr --> NGINX (on host) -- http (no more S) --> NGINX (omnibus)

Gitlab is installed with omnibus, in version 8.1.4.

When I try to create a team with the gitlab server, Mattermost redirect me on the Gitlab page :

Authorize required
Authorize GitLab Mattermost to use your account?
This application will be able to:
    Access your API

When I click on Authorize I got the following error :

GitLab Mattermost needs your help: Token request failed

My NGINX proxy configuration :

server {
   listen 443;
   server_name mygitlab.mydomain.fr mymattermost.mydomain.fr;
   ssl_certificate /etc/ssl/certs/mydomain.crt;
   ssl_certificate_key /etc/ssl/private/mydomain.key;
   access_log off;
   large_client_header_buffers 4 16k;
   location / {
       proxy_pass http://192.168.201.227:80/;
       proxy_cache off;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

(my certificate is a wildcard)

My gitlab.rb

external_url 'http://mygitlab.mydomain.fr'
gitlab_rails['gravatar_ssl_url'] = 'https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon'
mattermost_external_url 'http://mymattermost.mydomain.fr'

Thanks a lot

This seems similar to #3575 (closed). You may want to try adding Host and X-Forwarded-Ssl headers to your nginx config.

Thanks for your answer, I tried this configuration but unfortunately I've got the same error.

I think mattermost_external_url should be HTTPS.

May be this will also help. I'm using similar setup but don't use bundled nginx for mattermost - my reverse proxy talks directly to it.

gitlab.rb

mattermost_external_url 'https://mattermost.domain.local'
mattermost_nginx['enable'] = false

nginx.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen                    443 ssl;
    ssl_certificate           domain.crt;
    ssl_certificate_key       domain.key;
    ssl_dhparam               dhparams.pem;
    ssl_verify_client         off;
    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    server_name               mattermost.domain.local;
    server_tokens             off;
    client_max_body_size      250m;

    access_log  /var/log/gitlab/nginx/gitlab_mattermost_access.log;
    error_log   /var/log/gitlab/nginx/gitlab_mattermost_error.log;

    location / {
        proxy_read_timeout      300;
        proxy_connect_timeout   300;
        proxy_redirect          off;

        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header   Host              $http_host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-Ssl   on;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Frame-Options   SAMEORIGIN;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_pass http://127.0.0.1:8065;
    }
}

Thanks for the answer, in the same time we chose to use Rocket chat instead of Mattermost, sorry for the time. Yoann

Status changed to closed

Same setup here, and this still doesn't work.

It fails because the internal nginx gets configured with proxy_set_header X-Forwarded-Proto http; which is later used by mattermost to construct the redirect_url for OAuth (which isn't the URL registered as OAuth application).

The real fix would be to configure proxy_set_header X-Forwarded-Proto internally to the scheme of the external URL. Note that gitlab-http.conf is also configured w/ the wrong X-Forwarded-Proto but doesn't seem to use that when constructing service URLs.

A workaround atm is to change mattermost's external URL to http, relying on http -> https redirects of the external nginx, and to change the allowed OAuth callback URLs to http as well. So the callbacks for the mattermost application under (https://gitlab.example.com/admin/applications) should read like this.

http://mattermost.example.com/login/gitlab/complete
http://mattermost.example.com/signup/gitlab/complete

It's a lot easier to let mattermost listen on 0.0.0.0 (i.e. to anything outside of the lxc container) and proxy the outer nginx directly to container_ip:8065.

mentioned in issue #13734 (closed)

mentioned in merge request !14785