STIG Manager with Nginx & TLS docker setup

[bug5y]

Hello,

I've recently been trying to setup STIG Manager with the api, authentication, and MySQL containers behind a Nginx docker container within a test environment on a RHEL VM but have not had success yet. The goal is to use username/password authentication and to support TLS on port 443.
I have attempted to use the setup provided in https://github.com/NUWCDIVNPT/stigman-orchestration but it has not worked as intended as I continue to receive errors for the STIG Manager web app being unable to communicate with the authentication provider despite all containers being able to communicate with each other using the hostnames provided in the docker-compose file. I have changed the values of STIGMAN_CLIENT_OIDC_PROVIDER, KC_HOSTNAME_URL, and KC_HOSTNAME_ADMIN_URL to reflect the external URL of the server that it is being hosted on. Additionally redirects from the main stig manager web app to the OIDC provider appear to be dropping https for http. I have done my best to follow the documentation provided stig-manager.readthedocs.io and previous discussion posts.

Are there any examples of this setup or similar using an external IP that are working? All examples that I have found that were mentioned in previous discussion posts have had the same issues.

Thank you for your time!

[jace5869]

an you provide your docker-compose.yml or docker commands and your nginx config?
I've gone through setting this up with email/pass using an LDAP sync until I got CAC auth working.

[bug5y]

The setup below is the closest that I've had to working with redirecting the http requests to the https listener. But with doing this I've been receiving "Failed to fetch" errors after authenticating.
I'm using a .env file within the same directory as the docker-compose file.
Starting the services I'm running docker compose -f docker-compose.yml up -d

docker-compose.yml

version: '3.7'

networks:
  stigman_network:
    driver: bridge
    
services:
  nginx:
    image: nginx:1.29.0
    networks:
      - stigman_network 
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./certs/stigman.crt:/etc/nginx/cert.crt
      - ./certs/stigman.key:/etc/nginx/privkey.key
    ports:
      - "443:443"
      - "80:80"
    restart: always

  auth:
    image: nuwcdivnpt/stig-manager-auth:26.0.6
    networks:
      - stigman_network 
    environment:
      - KEYCLOAK_ADMIN=${KC_ADMIN}
      - KEYCLOAK_ADMIN_PASSWORD=${KC_ADMIN_PW}
      - KC_PROXY=edge
      - KC_HOSTNAME_URL=https://${EXTERNAL_IP}/
      - KC_HOSTNAME_ADMIN_URL=https://${EXTERNAL_IP}/
    init: true
    restart: always

  db:
    image: mysql:8.0
    networks:
      - stigman_network 
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PW}
      - MYSQL_USER=${DB_USER}
      - MYSQL_DATABASE=stigman
      - MYSQL_PASSWORD=${STIGMAN_DB_PW}
    cap_add:
      - SYS_NICE  # workaround MySQL logging bug => mbind: Operation not permitted 
    volumes:
      - mysql_data:/var/lib/mysql
    command: --innodb-buffer-pool-size=512M --sort_buffer_size=64M
    restart: always

  api:
    image: nuwcdivnpt/stig-manager:1.5.10
    networks:
      - stigman_network 
    environment:
      - STIGMAN_OIDC_PROVIDER=http://auth:8080/realms/stigman
      - STIGMAN_CLIENT_OIDC_PROVIDER=https://${EXTERNAL_IP}/realms/stigman
      - STIGMAN_CLASSIFICATION=${CLASSIFICATION}
      - STIGMAN_DB_HOST=db
      - STIGMAN_DB_USER=${DB_USER}
      - STIGMAN_DB_PASSWORD=${STIGMAN_DB_PW}
    init: true
    restart: always

volumes:
  mysql_data:

nginx.conf

events {
  worker_connections  4096;  ## Default: 1024
}
pid        /var/cache/nginx/nginx.pid;
http {
    server {
        listen                      80;
        server_name                 Scrubbed-external-ip;
        if ($scheme = http) {
        	return 308 https://$server_name$request_uri;
        }
    }
    
    server {
        listen                      443 ssl;
        server_name                 Scrubbed-external-ip;
        if ($scheme = http) {
        	return 308 https://$server_name$request_uri;
        }
        root                        /usr/share/nginx/html;
        client_max_body_size        100M;

        ssl_certificate             /etc/nginx/cert.crt;
        ssl_certificate_key         /etc/nginx/privkey.key;

        error_log                   /var/log/nginx/error.log notice;

        location /stigman/ {
            proxy_pass              http://api:54000/;
            proxy_set_header        X-Real-IP          $remote_addr;
            proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Host   $host;
            proxy_set_header        X-Forwarded-Server $host;
            proxy_set_header        X-Forwarded-Port   $server_port;
            proxy_set_header        X-Forwarded-Proto  $scheme;
        }

        location / {
            proxy_pass              http://auth:8080/;
            proxy_set_header        Host               $host;
            proxy_set_header        X-Real-IP          $remote_addr;
            proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Host   $host;
            proxy_set_header        X-Forwarded-Server $host;
            proxy_set_header        X-Forwarded-Port   $server_port;
            proxy_set_header        X-Forwarded-Proto  $scheme;
            proxy_set_header        ssl-client-cert    $ssl_client_escaped_cert;
            proxy_buffer_size       128k;
            proxy_buffers           4 256k;
            proxy_busy_buffers_size 256k;
        }
    }
}

[codwow]

It looks like you might be missing a couple of things.
1.STIG Manager needs to NODE_EXTRA_CA_CERTS= which has the same cas and nginx
2.Since keycloak is behind a proxy you should have KC_PROXY-HEADERS=xforwarded #might be different since im using keycloak not sitg-manager-auth
##I would suggest testing this one first##
3. Might also need to add KC_HTTP_ENABLED=true since keycloak should be communicating via http when its behind the reverse proxy like to stig manager