Kanban reloads in a loop at "{host}/boards" after updating to latest version(a21945f84305eb46812db220d6fac7641b90f45f)

Hello, @simenschi

Do you running your kanban installation behind some proxy? If so, please try to pass the Host header to kanban in you proxy configuration, this is now required.

Yes, nginx proxy. I'm already passing the host header. This is my nginx configuration

                proxy_pass http://127.0.0.1:81;
                proxy_set_header        Host $host;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;

Same problem here using Apache 2.4 and and SSL enabled endpoint that proxies to kanban. The first page loads, I can authenticate to Gitlab, then the boards page loads but I can't get it out of a redirect loop once it gets there.

Besides the actual rewrite and proxy pass rules I have ProxyPreserveHost On set as well as RequestHeader set X-Forwarded-Proto "https" which are the usual ingredients needed to make this sort of thing work. What are we missing and where is this documented?

(1.4.1 binary release)

@simenschi please try to use this nginx config for kanban, we are shipping it as a part of docker installation, but it could help. Please provide us feedback - I will add it to docs entry if it will work for you.

@alerque Could you please post your apache config for kanban, or send it via email to support@leanlabs.io, please ensure to remove all sensitive information from config before sending it. We will try to reproduce issue and fix.

Here is my Apache config @v.tyubek. There is a catch-all HTTP vhost on port 80 that catches any stray traffic and permanently redirects it to HTTPS.

<VirtualHost *:443>
		ServerName kanban.alerque.com
		DocumentRoot /etc/webapps/kanban/
		SSLEngine on
		SSLCertificateFile    /etc/httpd/ssl.crt/alerque.com.crt
		SSLCertificateKeyFile /etc/httpd/ssl.key/alerque.com.key
		ProxyPreserveHost On
		RewriteEngine On
		RewriteRule .* http://127.0.0.1:8383%{REQUEST_URI} [P,QSA,L]
		RequestHeader set X-Forwarded-Proto "https"
		<Location />
				Require all granted
				ProxyPassReverse http://127.0.0.1:8383/
				ProxyPassReverseCookieDomain 127.0.0.1 kanban.alerque.com
		</Location>
		LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
		ErrorLog  /var/log/httpd/kanban.alerque.com_error.log
		CustomLog /var/log/httpd/kanban.alerque.com_forwarded.log common_forwarded
		CustomLog /var/log/httpd/kanban.alerque.com_access.log combined env=!dontlog
		CustomLog /var/log/httpd/kanban.alerque.com.log combined
</VirtualHost>

@alerque

The short answer is - there is websocket, which should be proxied to, on /ws/ location, I'm not apache pro, so there is config file that worked for me (except 443 to 80 redirection):

<VirtualHost *:80>
    ProxyPreserveHost On
    RewriteEngine On

    <Location />
            Require all granted
            ProxyPass http://127.0.0.1:9000/
            ProxyPassReverse http://127.0.0.1:9000/
    </Location>

    <Location /ws/>
        ProxyPass ws://127.0.0.1:9000/ws/
        ProxyPassReverse ws://127.0.0.1:9000/ws/
    </Location>
    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b" common_forwarded
</VirtualHost>

where kanban listens on 127.0.0.1:9000

Thanks @v.tyubek that worked in nginx too. Here's my current working config(kanban listens on 127.0.0.1:81):

server {
	server_name myhostname.com;

	location / {
		proxy_pass http://127.0.0.1:81;
	}

    	location /ws {
        	proxy_http_version 1.1;
        	proxy_set_header Host $host;
        	proxy_set_header Upgrade $http_upgrade;
        	proxy_set_header Connection "upgrade";
        	proxy_pass http://127.0.0.1:81/ws;
    	}	

}

I still have one problem though. It seems like some project works fine, while others logouts the user and prints the following in the console whenever I click the project link in at kanbanurl.com/boards:

[Error] Failed to load resource: the server responded with a status of 401 (Unauthorized) (board, line 0)
http://mykanbanurl.com/api/board?project_id=user%2Fproject

Could this problem be related? Did not have that issue on the previous version.

I tried to reauthorize the application through gitlab.com with the same result.

@simenschi Great! We will document it, to make life easier for new users, thanks for your patience!

Yes, we got this one issue today to. This is an old one, we forgot to port hacks from old php backend, note the project names that are not working - does they have dots? If so, we will fix it in near release - these weekend, the problem is in dots encoding - gitlab api requires to encode dots as "%2E", and we forgot to add encoding.

Yes, thats it, those with dots in the project name is not working. Good, thanks!

@v.tyubek Thanks for the pointer. I hadn't realized there was WebSocket action going on here. Adding that config (or a variant using Rewrites) fixes that problem. I can now login and get the project list just fine.

However I'm not out of the woods yet. And this may be a case for another issue because I don't see any HTTP related errors here, but I can't actually load any of my projects. The first time I click on any of them I get logged out (or at least taken to the login screen again). Logging in takes me back to the project list again. Any other project will do the same thing, but if I try the same one I just tried, this time it will "open" a board page. Except that all it has is the header across the top, there is no board or tools at all. Are either of these behaviors related to this issue or should I report or ask about this elsewhere?

@alerque Please add NE flag to RewriteRule for gitlab vhost:

RewriteRule .* http://127.0.0.1:8383%{REQUEST_URI} [P,QSA,L,NE]

Also add NE flag to kanban vhost rewrite rule.

@v.tyubek Adding the NE flag to all the RewriteRule entries for Gitlab & Kanban fixed another long standing issue I've had with Gitlab (links to branches that have / in the branch name) but it didn't fix this issue. Any other ideas?

Dear @alerque, can you post your apache config, or send it to supermar@gmx.de? I have apache https reverse proxy with rewrite too, but could not yet get the sockets to work. Thanks!

@alerque could you please post kanban server logs here or to support@leanlabs.io also your apache config for kanban again, we will appreciate your help if we would be able to produce working apache config and post it into docs.

I use the docker installation method with a apache proxy. The following apache config worked for me.

Make sure the proxy_wstunnel is enabled. (a2enmod proxy_wstunnel)

<VirtualHost 1.2.3.4:80>
  ServerName kanban.example.com

  <Location />
    ProxyPass http://127.0.0.1:1080/
    ProxyPassReverse http://127.0.0.1:1080/
  </Location>

  <Location /ws/>
    ProxyPass ws://127.0.0.1:1080/ws/
    ProxyPassReverse ws://127.0.0.1:1080/ws/
    ProxyPreserveHost On
  </Location>

</VirtualHost>

Im also getting the same problem.

here is my nginx log file lines 2015/11/23 17:00:53 [error] 1746#0: *1262909 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.0.201, server: kanban.invizoserver.com, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8082/", host: "kanban.invizoserver.com"

Hi there, I build up an ubuntu 14.04 machine with the gitlab packages installed from their ubuntu repositories. I modified the gitlab.rb to run the bundled nginx with ssl certificates. I installed leanlabs kanban from docker on the same machine. Because there is allready a nginx instance running on the machine (the gitlab bundled one), I modified the docker-compse.yml to the following:

#proxy:
#  image: leanlabs/nginx:1.0.1
#  volumes:
#    - "./build/conf.d:/etc/nginx/conf.d"
#    - "./build/certs:/etc/nginx/certs"
#    - "./build/sites-enabled:/etc/nginx/sites-enabled"
#  links:
#    - kanban:kanban
#  ports:
#    - "81:80"

kanban:
  image: leanlabs/kanban:1.4.7
  environment:
    # URL on which Leanlabs Kanban will be reachable
    - KANBAN_SERVER_HOSTNAME=https://my.kanban.domain
    # This string is used to generate user auth tokens
    - KANBAN_SECURITY_SECRET=qwert
    # Your GitLab host URL
    - KANBAN_GITLAB_URL=https://my.gitlab.domain
    # Your GitLab OAuth client ID
    - KANBAN_GITLAB_CLIENT=qwert
    # Your GitLab OAuth client secret key
    - KANBAN_GITLAB_SECRET=qwert
    # Wheter to enable sign up with user API token
    - KANBAN_ENABLE_SIGNUP=false
    # Redis server address - IP:PORT
    - KANBAN_REDIS_ADDR=redis:6379
  links:
    - redis:redis
  ports:
    - "127.0.0.1:81:80"
  command: ./kanban server

redis:
  image: leanlabs/redis:1.0.0
  volumes:
    - "/data:/data"

I dropped the nginx proxy from the docker-compose file and made the kanban server listen directly on port 81 of 127.0.0.1

using nginx['custom_nginx_config'] = "include /etc/nginx/kanban.conf;" inside gitlab.rb I have set up a new proxy.

server {
    listen *:80;

    server_name my.kanban.domain;

    location / {
        return 301 https://$host$request_uri;
    }

    location ^~ /.well-known {
        alias /var/www/letsencrypt/.well-known;
    }
}

server {
    listen *:443 ssl;

    server_name my.kanban.domain;

    ssl_certificate /etc/letsencrypt/live/my.kanban.domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/my.kanban.domain/privkey.pem;

    access_log  /var/log/gitlab/nginx/kanban_access.log;
    error_log   /var/log/gitlab/nginx/kanban_error.log;


    location / {
        proxy_pass http://127.0.0.1:81;
    }

    location /ws {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Origin "";
        proxy_pass http://127.0.0.1:81;
    }
}

The kanban board gets loaded and authentication with my gitlab account is working quite well, so my config can't be that wrong.

But I still have the same problem with the reloading of the page.

The docker logs is telling me the following important information:

[Macaron] Started GET /ws/ for 172.17.0.1
[sockets] [Warning] [172.17.0.1:50446] Handshake failed: websocket: could not find connection header with token 'upgrade'
[Macaron] Completed /ws/ 400 Bad Request in 110.405µs

What am I doing wrong? How to run kanban behind SSL from the same machine as the gitlab installation?

I found my error: All I had to do was stopping and starting the gitlab service to have nginx restartet.

gitlab-ctl stop
gitlab-ctl start

Dear All,

I wrote about some small custom scripts and apache virtual host configuration, which avoids the reloading problem, based on the comments so far. On the link below you can see a small wiki-like article I wrote:

https://github.com/ndandanov/ll-kanban-docs/wiki/Deploying-LeanLabs-Kanban-on-a-Debian-server-with-Gitlab

Hope this helps.

Best regards, Nikolay

I have this install config

Docker: -> GitLab on port 5080 and reversed proxy at git.domain.com -> leanlab_kanban on port 5180 and reverse proxy at kanban.domain.com

I have started the docker container with:

sudo docker run -d
--link kanban_redis:kanban_redis
-p 5180:80
-e KANBAN_SERVER_HOSTNAME="http://kanban.domain.com"
-e KANBAN_SECURITY_SECRET="someRandomNumber"
-e KANBAN_GITLAB_URL="http://git.domain.com"
-e KANBAN_GITLAB_CLIENT="the client"
-e KANBAN_GITLAB_SECRET="the secret"
-e KANBAN_REDIS_ADDR="kanban_redis:6379"
leanlabs/kanban:1.4.0
./kanban server

It loads, I can OAuth to gitlab, but then, it enters the loop !!!

I get this on the logs

[sockets] [Warning] [172.17.0.1:60863] Origin kanban.domain.com is not allowed [Macaron] Completed /ws/ 403 Forbidden in 459.685µs

I nginx as written here http://kanban.leanlabs.io/docs/configuration/webserver/

Help !

Hello @xqua

Please use latest kanban version 1.6.2.

Show your reverse proxy configuration.

Hi I've just had a fresh install from binary, using latest GitLab 9.4.2 and Kanban 1.7.1 and I'm still facing this issue. I'm behind nginx to provide SSL. Looks like the page reloads right after the websocket receive any response.

Kanban reloads in a loop at "{host}/boards" after updating to latest version(a21945f84305eb46812db220d6fac7641b90f45f)

Designs

Child items 0

Activity

Admin message

Admin message

Kanban reloads in a loop at "{host}/boards" after updating to latest version(a21945f84305eb46812db220d6fac7641b90f45f)

Activity