Consider adding an nginx reverse proxy configuration for SWAG

[n00b12345]

A lot of users use SWAG as their reverse proxy. I do too.

It would really help if a working reverse proxy configuration could be submitted to their repository here - https://github.com/linuxserver/reverse-proxy-confs

[nothing2obvi]

Hey @n00b12345 did you ever figure this out? I also use SWAG.

[n00b12345]

I did not. I'm waiting for someone more knowledgeable on the issue to come up with a solution. If enough people have this problem, hopefully someone will solve it.

[nothing2obvi]

Thanks for your reply. Hope so, too.

[Peariforme]

Hello guys,

I am actually trying to find the correct swag configuration to expose my AdventureLog selfhosted instance. Did you by any chance have some references for me ?

[Peariforme]

I've managed to get a configuration where:

• The admin dashboard works
• Login/logout/registration authentication works
• API calls to the backend to create adventures and mark regions as visited don't work; I have a problem with a missing CSRF cookie.

Here's my current configuration:

services:
  adventurelog-web:
    #build: ./frontend/
    image: ghcr.io/seanmorley15/adventurelog-frontend:latest
    container_name: adventurelog-frontend
    restart: unless-stopped
    environment:
      - PUBLIC_SERVER_URL=http://adventurelog-server:8000 # Should be the service name of the backend with port 8000, even if you change the port in the backend service
      - ORIGIN=https://adventurelog.mydomain
      - BODY_SIZE_LIMIT=Infinity
    ports:
      - "8015:3000"
    depends_on:
      - adventurelog-server

  adventurelog-db:
    image: ghcr.io/baosystems/postgis:15
    container_name: adventurelog-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: database
      POSTGRES_USER: adventure
      POSTGRES_PASSWORD: MyPass
    volumes:
      - postgres_data:/var/lib/postgresql/data/

  adventurelog-server:
    #build: ./backend/
    image: ghcr.io/seanmorley15/adventurelog-backend:latest
    container_name: adventurelog-backend
    restart: unless-stopped
    environment:
      - DISABLE_REGISTRATION=True
      - DISABLE_REGISTRATION_MESSAGE='Registration is disabled for this instance of AdventureLog.'
      - PGHOST=adventurelog-db
      - PGDATABASE=database
      - PGUSER=adventure
      - PGPASSWORD=MyPass
      - SECRET_KEY=MySecret
      - DJANGO_ADMIN_USERNAME=admin
      - DJANGO_ADMIN_PASSWORD=mypass
      - DJANGO_ADMIN_EMAIL=mymail
      - PUBLIC_URL=https://adventurelog.mydomain
      - CSRF_TRUSTED_ORIGINS=https://adventurelog.mydomain,http://adventurelog.mydomain,http://192.168.1.37:8016,http://192.168.1.37:8015,http://adventurelog-server:8016,http://adventurelog-web:8015
      - DEBUG=False
      - FRONTEND_URL=https://adventurelog.mydomain
    ports:
      - "8016:80"
    depends_on:
      - adventurelog-db
    volumes:
      - adventurelog_media:/code/media/

volumes:
  postgres_data:
  adventurelog_media:

SWAG subdomain proxy configuration :

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name adventurelog.mydomain;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;
    
    proxy_cookie_domain adventurelog-server adventurelog.mydomain;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
    
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app adventurelog-frontend;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;


    }


     location ~ /media {
     
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app adventurelog-backend;
         set $upstream_port 80;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    
         add_header X-Content-Type-Options nosniff;
         add_header X-XSS-Protection "1; mode=block";
     }
     
     location ~ /api {
     
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app adventurelog-backend;
         set $upstream_port 80;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
            
     
     }
          
     location ~ /admin {
     
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app adventurelog-backend;
         set $upstream_port 80;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
              
     }
     
     location ~ /static {
     
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app adventurelog-backend;
         set $upstream_port 80;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
     }
     
     location ~ /ws {
       
         include /config/nginx/proxy.conf;
         include /config/nginx/resolver.conf;
         set $upstream_app adventurelog-backend;
         set $upstream_port 80;
         set $upstream_proto http;
         proxy_pass $upstream_proto://$upstream_app:$upstream_port;
         
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
       
     }
      
}

Some locations may be useless (/ws, /static, /media for example).
I think I'm close to having something functional, but everything I've tested for the CSRF cookie doesn't work. Any ideas?