How can I get Synchrony to work behind a reverse Proxy?

[Nicolas Rehner]

Hi community,

after reading through "tons" of information I'm still not able to get this work properly. So I decided to ask you all for help.

Here's some additional Information:

• Server
  • Hoster: Strato (DE)
  • OS: Ubuntu 16.04.3 LTS
  • Plesk Onyx 17.5.3
  • Confluence 6.6.2
  • Apache 2.4.18
  • Subdomain certified trough Let's encrypt (Plesk)
• Status quo
  • After a few seconds the editor throws the following message

The editor didn't load this time

The connection timed out. If it happens again, speak to your Confluence admin. You may be using a proxy server that prevents WebSocket connections.

• Reverse-Proxy Configuration

ServerName sub.domain.tld

ProxyRequests Off
ProxyPreserveHost On

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/synchrony
RewriteRule ^/(.*) http://127.0.0.1:8090/$1 [P]

<Proxy *>
 Require all granted
</Proxy>

ProxyPass /synchrony http://127.0.0.1:8091/synchrony

<Location /synchrony>
 Require all granted
 RewriteEngine on
 RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
 RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
 RewriteRule .* ws://127.0.0.1:8091%{REQUEST_URI} [P]
</Location>

ProxyPass / http://127.0.0.1:8090
ProxyPassReverse / http://127.0.0.1:8090

<Location />
 Require all granted
</Location>

Any help would be appreciated!

Regards Nicolas

[AnnWorley · Accepted solution]

Hi Nicholas,

The error you are reporting is usually related to a lack of WebSocket support as described in Confluence throws The editor didn't load this time error when trying to edit a page. Please see that doc for diagnostic and resolution steps.

I checked your proxy configuration against the one for Confluence 6.x on Proxying Atlassian server applications with Apache HTTP Server (mod_proxy_http) and wanted to ask about these lines on yours that are either not in the document or are under the /synchrony location:

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/synchrony
RewriteRule ^/(.*) http://127.0.0.1:8090/$1 [P]

• Please check whether editing will work if those lines are removed.
• To help construct proper redirect URLs, please make sure the <confluence_install>/conf/server.xml file has the proxyName proxyPort and scheme in the connector directive. (Proxy Support) 

For each application, find the normal (non-SSL) Connector directive in the Tomcat server.xml file, and add the scheme,  proxyName, and proxyPort attributes inside the Connector directive, as below. Use the default values for the other attributes, including for  port , unless you have a particular reason to change them, and use your own domain name for the proxyName value:

Connector port=<default>
 maxThreads=<default>
 minSpareThreads=<default>
 connectionTimeout=<default>
 enableLookups=<default>
 maxHttpHeaderSize=<default>
 protocol=<default>
 useBodyEncodingForURI=<default>
 redirectPort=<default>
 acceptCount=<default>
 disableUploadTimeout=<default>
 proxyName="<subdomain>.<domain>.com"
 proxyPort="80"
 scheme="http"/>

Thanks,

Ann

[Nicolas Rehner]

Hi Ann,

thanks for your encouragement tough i know you don't officially support this setup!

Sorry that i left out some important informations when creating my question.
I had problems to get confluence working behind a Proxy from the beginning (have to admit that i'm not an expert when it comes to administer an web server). So i read a lot of how-to's and of course your documentation and asked the atlassian community for help. I finally got it working - but ran into the problems with synchrony. 

In answer to your suggestions i can tell you:

• After removing the lines you recommended an error occurs when trying to access confluence

Proxy Error

The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /login.action.

Reason: DNS lookup failure for: 127.0.0.1:8090login.action

Additionally, a 502 Bad Gateway error was encountered while trying to use an ErrorDocument to handle the request.

• Those lines should make the proxy forward everything without /synchrony context to http://sub.domain.tld:8090
• The recommended changes to 'server.xml' i had already made - sorry for letting this out in the original question

Are there any other hints you can give me?

Regards Nic

[AnnWorley]

I understand from your other post (How can I use Confluence on a subdomain) that you got a 403 forbidden error when you tried the echo test from Confluence throws The editor didn't load this time error when trying to edit a page.

Test WebSocket connections by using http://websocket.org/echo.html to perform a quick HTML5 WebSocket test against an echo server.
Click Connect and the log will reply: CONNECTED if successful.

Is this still the case? Synchrony will not work as long as a WebSocket connection cannot be established. Since you read through a lot of docs, I was wondering if you checked to make sure your browser allows WebSocket connections.

[Nicolas Rehner]

It wasn't exactly like this - first i tested my browsers (Safari & Firefox - both latest release) by accessing http://websocket.org/echo.html wich worked fine.

websocket.org provides html code to create your own test-site wich i used and uploaded it to my servers www-root. When i open the html file local everything works as expected, but when i try to access the file on the server (same server where confluence runs on) i get the 403.
Today i researched my server to find any "firewall" rules that could block web socket connections and couldn't find any.

Thats why my first suspicion goes back to the proxy configuration again and i putted it in the focus of my question.

[AnnWorley]

What if you use the exact configuration from the doc, just replacing the serverName and internal_domain with yours?

<VirtualHost *:80>
 ServerName myconfluence.com
 
 ProxyRequests Off
 
 # Auth changes in 2.4 - see http://httpd.apache.org/docs/2.4/upgrading.html#run-time
 <Proxy *>
 Require all granted
 </Proxy>

ProxyPass /synchrony http://<internal_domain>:8091/synchrony

<Location /synchrony>
 Require all granted
 RewriteEngine on
 RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
 RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
 RewriteRule .* ws://<internal_domain>:8091%{REQUEST_URI} [P]
 </Location>

ProxyPass / http://<internal_domain>:8090/
 ProxyPassReverse / http://<internal_domain>:8090/

<Location />
 Require all granted
 </Location>
 
</VirtualHost>

[Nicolas Rehner]

The problem persists after using the exact configuration from the documentation.

I got rid of the 403 Error when accessing the websocket test on my server - it was caused by a stupid mistake of mine. The test works fine now, so I don't think the server causes the problem.

Any other hints where I can look at?

[Nicolas Rehner]

So I'm finally after it:

After reading trough the suggestions you made here I checked my Add-Ons (only Brickit ThemePress installed and activated till now) and voila - after deactivating ThemePress everything works fine!

I opened up a support ticket in their support system and will wait for their response.

I'll keep you updated.

Regards Nic

[AnnWorley]

Please do keep us updated. This is the first I have heard of Theme Press causing editor issues so am very interested in what they turn up with their investigation.

[Nicolas Rehner]

I hope they will investigate - their first reaction was the following:

Hi Nicolas,

Could you check the following Atlassian knowledge base article and see if the resolutions suggested can be applied?

• Confluence throws The editor didn't load this time error when trying to edit a page

Otherwise, we had another similar case which is currently being investigated by Atlassian as it also occurred when Theme Press was disabled. We suggest contacting Atlassian Suppport and request to add our account (atlassian-support@brikit.com) as a watcher to the ticket so that we can intervene directly.

The KNB article i know by heart as you know.
An support ticket is no option for me because i have a starter-license.

So i asked them to investigate and hope they do so. We'll see ...

[AnnWorley]

If they really need a support ticket I can open one on your behalf (just at-mention me and I will respond) and add them as a watcher but I hope they will verify they have thoroughly seen your Community threads first. 

[Nicolas Rehner]

I‘ll give them the links first and ask them to go trough it and see what they respond. If they insist on a Ticket i‘ll Inform you.

[AnnWorley]

Sounds like a plan. :)

[Nicolas Rehner]

Hi Ann,

got an update on this now - brikit was able to reproduce the issue and ist working on a fix.

They generated an bug report (PRESS-2266) for it where all further Information goes.

Thanks again for your great support and useful ideas!

[AnnWorley]

Glad you found my input useful! Have a great weekend.

[Nicolas Rehner]

I‘ll test it tomorrow and give you feedback.
It‘s bedtime over here. ;)

[AnnWorley]

No problem - thanks for the update. :)