Knowledge Base (Posts about proxy)

owntracks with reverse proxy

bgstack15 — Mon, 29 Dec 2025 14:07:00 GMT

I recently improved my owntracks deployment to put the frontends behind a reverse proxy! It took me some time to research, because I got distracted with websockets and CORS rabbit trails.

What ended up working was the following process.

Add these values to the config.js.

window.owntracks.config = {
    api: {
        baseUrl: "https://storage3.ipa.example.com/owntracks-map/",
    },
    router: {
        basePath: "/owntracks-map",
    },
};

Add to the Apache httpd reverse proxy virtual host(s) these configs. I bet some of this is redundant.

ProxyPreserveHost On
ProxyPass        /owntracks-map  http://server4.ipa.example.com:8085 upgrade=websocket
ProxyPassReverse /owntracks-map  http://server4.ipa.example.com:8085/ upgrade=websocket
ProxyPass        /owntracks-internal  http://server4.ipa.example.com:8083 upgrade=websocket
ProxyPassReverse /owntracks-internal  http://server4.ipa.example.com:8083/ upgrade=websocket
<Location "/owntracks-internal/ws">
   RequestHeader append X-Forwarded-Prefix "/owntracks"
   RequestHeader append X-Script-Name "/owntracks"
</Location>
<Location "/owntracks-internal">
   RequestHeader append X-Forwarded-Prefix "/owntracks"
   RequestHeader append X-Script-Name "/owntracks"
</Location>
<Location "/owntracks-internal/view/">
   RequestHeader append X-Forwarded-Prefix "/owntracks"
   RequestHeader append X-Script-Name "/owntracks"
</Location>
<Location "/owntracks-internal/static/">
   RequestHeader append X-Forwarded-Prefix "/owntracks"
   RequestHeader append X-Script-Name "/owntracks"
</Location>
<Location "/owntracks-map/ws">
   ProxyPass        http://server4.ipa.example.com:8085/ retry=3 connectiontimeout=5 timeout=8 upgrade=websocket
   ProxyPassReverse http://server4.ipa.example.com:8085/
   RequestHeader append X-Forwarded-Prefix "/owntracks-map/ws"
   RequestHeader append X-Script-Name "/owntracks-map/ws"
</Location> 
<Location "/owntracks-map/">
   ProxyPass        http://server4.ipa.example.com:8085/ retry=3 connectiontimeout=5 timeout=8 upgrade=websocket
   ProxyPassReverse http://server4.ipa.example.com:8085/
   RequestHeader append X-Forwarded-Prefix "/owntracks-map"
   RequestHeader append X-Script-Name "/owntracks-map"
</Location>

Please note that this /owntracks-internal is not the path used by the owntracks android clients. It is for the web view of the app with different authentication, and not the per-device auth used by owntracks.

And then the directory listing for these frontend paths is as follows.

<li><a href="/owntracks-map/">/owntracks-map/</a> Location tracking (<a href="/owntracks-internal/">bare app</a>)</li>

References

Sticking the frontend behind a virtual path frontend/docs/config.md at main · owntracks/frontend
Second part of reverse proxy frontend/docs/config.md at main · owntracks/frontend

Novel project: Luanti Web Services Proxy

bgstack15 — Sat, 20 Sep 2025 12:36:00 GMT

I wrote in 10 hours a small project that makes it easy to use multiple instances of ContentDB and Serverlist in Luanti. Because the official ContentDB is very picky about what mods are allowed (under the laws where they are hosted, among other reasons), there might be other places to get packages, i.e., games, mods, and texture packs. I'm not aware of any other public ContentDB instances, but my internal network has a private ContentDB instance and I want to use it as well as the public ContentDB.

This new project is named lwsp and runs in docker or else with python3/flask.

Use LWSP for ContentDB and Serverlist when you want your Luanti client to easily access multiple ContentDB instances, or multiple Serverlist instances, or both.

Because of the way a ContentDB instance enforces mod dependencies to be resolvable within that instance, any dependencies for a package will be resolvable from that one instance only.

This is not designed for a general-purpose website to manage multiple ContentDB instances' packages; it is only a shim for Luanti clients to use.

Using LWSP

Running the proxy server locally

Set up a python3 virtual environment and install any dependencies.

python3 -m venv ~/venv-cdbp
source ~/venv-cdbp
pip3 install -r requirements.txt

Adjust config.cfg from config.cfg.example. In this file, you can set the default backend servers, for when the client uses "default." You can even force the usage of only these backends (ignoring any that the client might send) in the configuration. You can also configure packages to ignore by tag, author name, or regular expression matching the name or title.

Start the development server.

./start.sh

Running proxy server in docker or docker-compose

See the example docker-compose.yml.

Configuring Luanti client to use the proxy server

Any mods installed before configuring a client to use the proxy can be upgraded, but at the time of upgrade, the mod's mod.conf field author will be updated with the hostname+protocol as part of the author name. This change will make it harder to disable the usage of the LWSP for contentdb_url, and will require manual updates to each mod.conf before then being able to update them when pointing directly to the canonical ContentDB.

Using multiplexer for ContentDB

Set contentdb_url in minetest.conf to a string similar to the following. The top of the virtual path is a url-encoded representation of space-delimited connection strings (protocol, hostname, and optionally port).

http://localhost:5124/https%3A%2F%2Fcontent.luanti.org%2F+http%3A%2F%2Fvm4%3A5123%2F

For example, to list https://content.luanti.org/ and http://vm4:5123/ you would place this into a url encoder utility.

https://content.luanti.org/ http://vm4:5123/

Optionally, you can set the list to "default" to use the backends configured by the proxy server, or even just omit the "default" virtual path.

http://localhost:5124/default/

http://localhost:5124/

Using multiplexer for Serverlist

Set serverlist_url in minetest.conf to a line formatted in the same way, but with serverlist urls.

http://localhost:5124/https%3A%2F%2Fservers.luanti.org+http%3A%2F%2Fvm4%3Aserverlist

Like contentdb config, you can omit the top virtual directory of the path, and use the default configured in the server.

http://localhost:5124/

Screenshot of browsing available packages in Luanti

Author

bgstack15

Alternatives

None. This is novel on the www.

Use Apache httpd as a reverse proxy for Minetest Mapserver

bgstack15 — Sun, 11 May 2025 12:42:00 GMT

I use the Luanti Mapserver project for my various worlds, one instance per world. And because I'm old-school, I'm still rocking Apache httpd and still call it httpd like the old Enterprise Linux days and not "apache2" like the Devuanites. And I use httpd as a reverse proxy (for TLS termination, for one thing) for the mapserver.

The webpage works without the websocket upgrade, but the mapserver throws a stack trace complaining about the lack of the upgrade token in the Connection header.

level=error msg=ws-upgrade err="websocket: the client is not using the websocket protocol: 'upgrade' token not found in 'Connection' header"

After enough Internet research I found the answer! So here is my snippet for mapserver in my httpd config (inside the virtual host) that makes the magic happen.

RewriteEngine on
ProxyPreserveHost On
# mapserver
RewriteRule ^/games/luanti/world3/map$ /games/luanti/world3/map/ [R,L]
<Location "/games/luanti/world3/map/">
   ProxyPreserveHost On
   ProxyPass        http://server4:30011/ retry=20 connectiontimeout=300 timeout=300 upgrade=websocket
   ProxyPassReverse http://server4:30011/
   RequestHeader    set X-Script-Name /games/luanti/world3/map
   RewriteEngine on
   RewriteCond %{HTTP:Connection} Upgrade [NC]
   RewriteCond %{HTTP:Upgrade} websocket [NC]
   RewriteRule /(.*) ws://server4:30011/$1 [P,L]
</Location>

Because not the whole world uses that new-fangled nginx.

References

The secret sauce came from apache - Apache2 can't set headers "Connection" and "Upgrade" - Stack Overflow

Firefox proxy notes

bgstack15 — Tue, 05 Dec 2023 13:35:32 GMT

Run SOCKS proxy

I normally use Firefox with a SOCKS proxy, which I run with:

ssh -D 8880 ${USER}@proxyserver -n -f -N

Configure firefox proxy

Visit about:preferences, search proxy (tab General -> heading Network Settings -> button Settings...), and choose Manual proxy configuration.

SOCKS host: localhost, port 8880

My No proxy for box includes:

192.168.1.0/24, 10.35.0.0/16, server1, server4, server1, server2, server3, server3, *.ipa.example.com

Firefox extension to make it easier

If I want to use an extension that adds the setting to the toolbar, I use Simple Proxy Toggle – Get this Extension for Firefox (en-US) by Strega. It doesn't manage its own settings; it merely lets you switch easily between the high-level Firefox settings.

I had to temporarily modify my chrome/userChrome.css file to the following:

#unified-extensions-button, #unified-extensions-button > .toolbarbutton-icon{
width: 60px !important;
padding: 5px !important;
}

So that that annoying puzzle piece button would appear, so I could then right-click the extension icon and make it apepar on the toolbar.

References

Weblinks

Simple Proxy Toggle – Get this Extension for Firefox (en-US)

My blog

Internal

file:///mnt/public/Support/Programs/Browsers/firefox-proxy-notes.md

Newspipe support for reverse proxy

bgstack15 — Tue, 05 Sep 2023 02:30:40 GMT

I submitted this patch upstream.

I added a new option in the config, named prefix. If you set this, all the internal urls will add it. We use a ReverseProxy trick to add the prefix. This solves the generated urls, but for the hardcoded urls built throughout the jinja2 templates, I had to just manually update those. We use a neat trick to add a custom function to the template-parsing context which we can use to get the prefix (which safely returns the empty string if we had not set it, because we initialize the variable as empty).

Most of the lines of this patch are just adjusting all the templates to add the function call to {{ prefix() }}

diff --git a/instance/config.py b/instance/config.py
index 42e624c..af7617a 100644
--- a/instance/config.py
+++ b/instance/config.py
@@ -10,6 +10,9 @@ PORT = 5000
 DEBUG = True
 API_ROOT = "/api/v2.0"

+# Optional, and useful if you are using a reverse proxy with this virtual path prefix
+#PREFIX = "/newspipe"
+
 CSRF_ENABLED = True
 SECRET_KEY = "LCx3BchmHRxFzkEv4BqQJyeXRLXenf"
 SECURITY_PASSWORD_SALT = "L8gTsyrpRQEF8jNWQPyvRfv7U5kJkD"
diff --git a/instance/sqlite.py b/instance/sqlite.py
index 1f8d620..c6eaa46 100644
--- a/instance/sqlite.py
+++ b/instance/sqlite.py
@@ -10,6 +10,9 @@ PORT = 5000
 DEBUG = True
 API_ROOT = "/api/v2.0"

+# Optional, and useful if you are using a reverse proxy with this virtual path prefix
+#PREFIX = "/newspipe"
+
 CSRF_ENABLED = True
 SECRET_KEY = "LCx3BchmHRxFzkEv4BqQJyeXRLXenf"
 SECURITY_PASSWORD_SALT = "L8gTsyrpRQEF8jNWQPyvRfv7U5kJkD"
diff --git a/newspipe/bootstrap.py b/newspipe/bootstrap.py
index 1204491..1c5c967 100644
--- a/newspipe/bootstrap.py
+++ b/newspipe/bootstrap.py
@@ -44,6 +44,14 @@ def set_logging(
             handler.setLevel(log_level)
         logger.setLevel(log_level)

+class ReverseProxied(object):
+    def __init__(self, app, script_name):
+        self.app = app
+        self.script_name = script_name
+
+    def __call__(self, environ, start_response):
+        environ['SCRIPT_NAME'] = self.script_name
+        return self.app(environ, start_response)

 # Create Flask application
 application = Flask(__name__, instance_relative_config=True)
@@ -63,6 +71,11 @@ else:

 set_logging(application.config["LOG_PATH"])

+_prefix = ""
+if "PREFIX" in application.config:
+    application.wsgi_app = ReverseProxied(application.wsgi_app, script_name=application.config["PREFIX"])
+    _prefix = application.config["PREFIX"]
+
 db = SQLAlchemy(application)

 migrate = Migrate(application, db)
@@ -100,3 +113,9 @@ application.jinja_env.filters["datetime"] = format_datetime
 application.jinja_env.filters["datetimeformat"] = datetimeformat
 # inject application in Jinja env
 application.jinja_env.globals["application"] = application
+
+@application.context_processor
+def utility_processor():
+    def prefix():
+        return _prefix.rstrip("/")
+    return dict(prefix=prefix)
diff --git a/newspipe/controllers/user.py b/newspipe/controllers/user.py
index 00ffb96..d2c5bc0 100644
--- a/newspipe/controllers/user.py
+++ b/newspipe/controllers/user.py
@@ -138,7 +138,7 @@ class LdapuserController:
         namelist = []
         try:
             query = dns.resolver.query(f"_ldap._tcp.{domain}", "SRV")
-        except dns.resolver.NXDOMAIN:
+        except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
             # no records exist that match the request, so we were probably
             # given a specific hostname, and an empty query will trigger
             # the logic below that will add the original domain to the list.
diff --git a/newspipe/static/js/articles.js b/newspipe/static/js/articles.js
index f1cee6e..29ebac2 100644
--- a/newspipe/static/js/articles.js
+++ b/newspipe/static/js/articles.js
@@ -86,7 +86,7 @@ Array.prototype.map.call(nodes, function(node) {
       }

       // sends the updates to the server
-      fetch(API_ROOT + "article/" + article_id, {
+      fetch(prefix + API_ROOT + "article/" + article_id, {
         method: "PUT",
         headers: {
           'Content-Type': 'application/json',
@@ -157,7 +157,7 @@ Array.prototype.map.call(nodes, function(node) {
       }

       // sends the updates to the server
-      fetch(API_ROOT + "article/" + article_id, {
+      fetch(prefix + API_ROOT + "article/" + article_id, {
         method: "PUT",
         headers: {
           'Content-Type': 'application/json',
@@ -189,7 +189,7 @@ Array.prototype.map.call(nodes, function(node) {
         data = JSON.stringify(data);

         // sends the updates to the server
-        fetch(API_ROOT + "articles", {
+        fetch(prefix + API_ROOT + "articles", {
           method: "DELETE",
           headers: {
             'Content-Type': 'application/json',
diff --git a/newspipe/static/js/config.js b/newspipe/static/js/config.js
new file mode 100644
index 0000000..7fad438
--- /dev/null
+++ b/newspipe/static/js/config.js
@@ -0,0 +1,7 @@
+/*
+ * Set variables here for the javascript used by newspipe.
+ */
+var prefix = "/newspipe";
+
+/* Set exactly one trailing slash on prefix. */
+prefix = prefix.replace(/\/+$/,"/");
diff --git a/newspipe/templates/article.html b/newspipe/templates/article.html
index c62e3f0..d9cf9a6 100644
--- a/newspipe/templates/article.html
+++ b/newspipe/templates/article.html
@@ -4,7 +4,7 @@
     <div class="row" data-article="{{ article.id }}" id="filters" data-filter="{{ filter_ }}">
         <div class="col">
             <h2><a href="{{ article.link  }}" target="_blank">{{ article.title|safe }}</a></h2>
-            <h3>{{ _('from') }} <a href="/feed/{{ article.source.id }}">{{ article.source.title }}</a></h3>
+            <h3>{{ _('from') }} <a href="{{ prefix() }}/feed/{{ article.source.id }}">{{ article.source.title }}</a></h3>
             <a href="{{ url_for("article.delete", article_id=article.id) }}"><i class="fa fa-times delete" aria-hidden="true" title="{{ _('Delete this article') }}"></i></a>
             {% if article.like %}
                 <a href="#"><i class="fa fa-star like" aria-hidden="true" title="{{ _('One of your favorites') }}"></i></a>
diff --git a/newspipe/templates/duplicates.html b/newspipe/templates/duplicates.html
index 38dc52b..d138226 100644
--- a/newspipe/templates/duplicates.html
+++ b/newspipe/templates/duplicates.html
@@ -1,7 +1,7 @@
 {% extends "layout.html" %}
 {% block content %}
 <div class="container">
-    <p><h1>{{ _('Duplicates in the feed') }} <a href="/feed/{{ feed.id }}">{{ feed.title }}</a>.</h1><p>
+    <p><h1>{{ _('Duplicates in the feed') }} <a href="{{ prefix() }}/feed/{{ feed.id }}">{{ feed.title }}</a>.</h1><p>
     <div class="table-responsive">
         <table class="table table-striped">
             <thead>
@@ -19,8 +19,8 @@
             {% for pair in duplicates %}
                 <tr>
                     <td>{{ loop.index }}</td>
-                    <td id="{{ pair[0].id }}"><a href="{{ url_for("article.delete", article_id=pair[0].id) }}"><i class="fa fa-times" aria-hidden="true" title="{{ _('Delete this article') }}"></i></a>&nbsp;<a href="/article/{{ pair[0].id }}">{{ pair[0].title }}</a> ({{ pair[0].retrieved_date }})</td>
-                    <td id="{{ pair[1].id }}"><a href="{{ url_for("article.delete", article_id=pair[1].id) }}"><i class="fa fa-times" aria-hidden="true" title="{{ _('Delete this article') }}"></i></a>&nbsp;<a href="/article/{{ pair[1].id }}">{{ pair[1].title }}</a> ({{ pair[1].retrieved_date }})</td>
+                    <td id="{{ pair[0].id }}"><a href="{{ url_for("article.delete", article_id=pair[0].id) }}"><i class="fa fa-times" aria-hidden="true" title="{{ _('Delete this article') }}"></i></a>&nbsp;<a href="{{ prefix() }}/article/{{ pair[0].id }}">{{ pair[0].title }}</a> ({{ pair[0].retrieved_date }})</td>
+                    <td id="{{ pair[1].id }}"><a href="{{ url_for("article.delete", article_id=pair[1].id) }}"><i class="fa fa-times" aria-hidden="true" title="{{ _('Delete this article') }}"></i></a>&nbsp;<a href="{{ prefix() }}/article/{{ pair[1].id }}">{{ pair[1].title }}</a> ({{ pair[1].retrieved_date }})</td>
                 </tr>
             {% endfor %}
             </tbody>
diff --git a/newspipe/templates/history.html b/newspipe/templates/history.html
index 153c2f1..00e22ef 100644
--- a/newspipe/templates/history.html
+++ b/newspipe/templates/history.html
@@ -43,7 +43,7 @@
       <ul class="list-group">
         {% for date in articles_counter | sort(reverse = True) %}
         {% for article in articles %}
-        <li class="list-group-item">{{ article.date | datetime }} - <a href="/article/{{ article.id }}">{{ article.title | safe }}</a></li>
+        <li class="list-group-item">{{ article.date | datetime }} - <a href="{{ prefix() }}/article/{{ article.id }}">{{ article.title | safe }}</a></li>
         {% endfor %}
         {% endfor %}
       </ul>
diff --git a/newspipe/templates/home.html b/newspipe/templates/home.html
index 631b769..5feb18d 100644
--- a/newspipe/templates/home.html
+++ b/newspipe/templates/home.html
@@ -42,7 +42,7 @@
                             {% if feed_id == feed.id %}</b>{% endif %}
                         </a></li>
                         <li class="nav-item feed-commands {% if in_error.get(fid, 0) > 0 %}d-none{% endif %}" data-bs-feed="{{ feed.id }}"><span class="nav-link">
-                            <a href="/feed/{{ feed.id }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
+                            <a href="{{ prefix() }}/feed/{{ feed.id }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
                             <a href="{{ url_for('feed.form', feed_id=feed.id) }}"><i class="fa fa-pencil-square-o" aria-hidden="true" title="{{ _('Edit this feed') }}"></i></a>
                             <a href="{{ url_for('article.mark_as', new_value='unread', feed_id=feed.id) }}"><i class="fa fa-square-o" aria-hidden="true" title="{{ _('Mark this feed as unread') }}"></i></a>
                             <a href="{{ url_for('article.mark_as', new_value='read', feed_id=feed.id) }}"><i class="fa fa-check-square-o" aria-hidden="true" title="{{ _('Mark this feed as read') }}"></i></a>
@@ -73,7 +73,7 @@
                 {% if feed_id == fid %}</b>{% endif %}
             </a></li>
             <li class="nav-item feed-commands {% if in_error.get(fid, 0) > 0 %}d-none{% endif %}" data-bs-feed="{{ fid }}"><span class="nav-link">
-                <a href="/feed/{{ fid }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
+                <a href="{{ prefix() }}/feed/{{ fid }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
                 <a href="{{ url_for('feed.form', feed_id=fid) }}"><i class="fa fa-pencil-square-o" aria-hidden="true" title="{{ _('Edit this feed') }}"></i></a>
                 <a href="{{ url_for('article.mark_as', new_value='unread', feed_id=fid) }}"><i class="fa fa-square-o" aria-hidden="true" title="{{ _('Mark this feed as unread') }}"></i></a>
                 <a href="{{ url_for('article.mark_as', new_value='read', feed_id=fid) }}"><i class="fa fa-check-square-o" aria-hidden="true" title="{{ _('Mark this feed as read') }}"></i></a>
@@ -102,7 +102,7 @@
                 {% if feed_id == fid %}</b>{% endif %}
             </a></li>
             <li class="nav-item feed-commands {% if in_error.get(fid, 0) > 0 %}d-none{% endif %}" data-bs-feed="{{ fid }}"><span class="nav-link">
-                <a href="/feed/{{ fid }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
+                <a href="{{ prefix() }}/feed/{{ fid }}"><i class="fa fa-info" aria-hidden="true" title="{{ _('Details') }}"></i></a>
                 <a href="{{ url_for('feed.form', feed_id=fid) }}"><i class="fa fa-pencil-square-o" aria-hidden="true" title="{{ _('Edit this feed') }}"></i></a>
                 <a href="{{ url_for('article.mark_as', new_value='unread', feed_id=fid) }}"><i class="fa fa-square-o" aria-hidden="true" title="{{ _('Mark this feed as unread') }}"></i></a>
                 <a href="{{ url_for('article.mark_as', new_value='read', feed_id=fid) }}"><i class="fa fa-check-square-o" aria-hidden="true" title="{{ _('Mark this feed as read') }}"></i></a>
@@ -174,11 +174,11 @@
                             {% if not feed_id %}
                                 <td class="d-none d-md-block">
                                     <img src="{{ url_for('icon.icon', url=feeds[article.source.id].icon_url) }}" width="16px">
-                                    <a href="/article/redirect/{{ article.id}}" target="_blank">{{ article.source.title | safe }}</a>
+                                    <a href="{{ prefix() }}/article/redirect/{{ article.id}}" target="_blank">{{ article.source.title | safe }}</a>
                                 </td>
                             {% endif %}
                             <td {%if filter_ == 'all' and article.readed == False %}style='font-weight:bold'{% endif %}>
-                                <a href="/article/{{ article.id }}" title="{{ article.title }}">{{ article.title | truncate(100, False, '...') }}</a>
+                                <a href="{{ prefix() }}/article/{{ article.id }}" title="{{ article.title }}">{{ article.title | truncate(100, False, '...') }}</a>
                             </td>
                             <td class="date d-none d-lg-block">{{ article.date | datetime(format='short') }}</td>
                         </tr>
diff --git a/newspipe/templates/layout.html b/newspipe/templates/layout.html
index 2464040..466ff4e 100644
--- a/newspipe/templates/layout.html
+++ b/newspipe/templates/layout.html
@@ -21,7 +21,7 @@
     {% block menu %}
     <nav class="navbar navbar-expand-lg navbar-dark bg-newspipe-blue">
        <div class="container-fluid">
-        <a class="navbar-brand" href="/">Newspipe</a>
+        <a class="navbar-brand" href="{{ prefix() }}/">Newspipe</a>
         <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
             <span class="navbar-toggler-icon"></span>
         </button>
@@ -150,6 +150,7 @@
     {% block content %}{% endblock %}

     <!-- Placed at the end of the document so the pages load faster -->
+    <script type="text/javascript" src="{{ url_for('static', filename = 'js/config.js') }}"></script>
     <script type="text/javascript" src="{{ url_for('static', filename = 'js/articles.js') }}"></script>
     <script type="text/javascript" src="{{ url_for('static', filename = 'js/feed.js') }}"></script>
   </body>
diff --git a/newspipe/templates/login.html b/newspipe/templates/login.html
index b995230..78af3c4 100644
--- a/newspipe/templates/login.html
+++ b/newspipe/templates/login.html
@@ -19,7 +19,7 @@
                     <div class="alert alert-warning" role="alert">{{ message }}</div>
                 {% endfor %}
                 {{ form.submit(class_="btn btn-primary") }}
-                {% if self_registration %}<a href="/signup" class="btn btn-info">{{ _('Sign up') }}</a>{% endif %}
+                {% if self_registration %}<a href="{{ prefix() }}/signup" class="btn btn-info">{{ _('Sign up') }}</a>{% endif %}
             </form>
         </div>
     </div>
diff --git a/newspipe/templates/management.html b/newspipe/templates/management.html
index 4e977f8..19dbded 100644
--- a/newspipe/templates/management.html
+++ b/newspipe/templates/management.html
@@ -6,7 +6,7 @@
             <div class="row">
                 <div class="col">
                     <h2>{{ _('Your subscriptions') }}</h2>
-                    <p>{{ _('You are subscribed to') }} {{ nb_feeds }} <a href="/feeds">{{ _('feeds') }}</a>. <a href="{{ url_for("feed.form") }}">{{ _('Add') }}</a> {{ _('a feed') }}.</p>
+                    <p>{{ _('You are subscribed to') }} {{ nb_feeds }} <a href="{{ prefix() }}/feeds">{{ _('feeds') }}</a>. <a href="{{ url_for("feed.form") }}">{{ _('Add') }}</a> {{ _('a feed') }}.</p>
                     <p>{{ nb_articles }} {{ _('articles are stored in the database with') }} {{ nb_unread_articles }} {{ _('unread articles') }}.</p>
                     <p>{{ _('You have') }} {{ nb_categories }} <a href="{{ url_for("categories.list_")}}">{{ _('categories') }}</a>.</p>
                     <a href="{{ url_for("articles.expire", weeks=10) }}" class="btn btn-primary" onclick="return confirm('{{ _('You are going to delete old articles.') }}');">{{ _('Delete articles older than 10 weeks') }}</a>

Coming soon to newspipe: reverse proxy support

bgstack15 — Thu, 31 Aug 2023 12:47:51 GMT

I have taken it upon myself to add reverse-proxy with prefix support to my docker image for newspipe.

So far I have written some basic parts such as a config option for specifying the expected prefix. See the commits in both the newspipe and newspipe-docker repos.

What I haven't done yet is update the url_for function to also add the prefix to the generated urls for most links in the app. Once I do that, I'll send a pull request to upstream.

References

Weblinks

My previous related work

disabling webrtc temporarily

bgstack15 — Fri, 17 Mar 2023 12:43:42 GMT

To facilitate a proxy setting to prevent IP address leakage, disable WebRTC with about:config setting:

media.peerconnection.enabled = false

You can check with https://whoer.net

Improving radicale kerberos auth

bgstack15 — Mon, 13 Mar 2023 13:12:45 GMT

My current setup for Radicale and Infcloud for my web interface to my calendars depends on ldap authentication at the reverse-proxy level.

I hacked the frontend in my branch of infcloud to use the browser localStorage javascript/devtools feature so I don't have to enter my username and password every time. Yes, it's insecure, and yes, I don't care.

Using my web calendar works very well. However, when I go to download an event (usually to email it to someone to invite them), I get prompted with the browser basic auth prompt. So I got tired of having to do that, at least the first time in every session, and I wanted to find a better way. I use kerberos (gssapi) authentication in other places on my web server, and I wanted to bring that here.

So I spent a bunch of time experimenting, and I learned that I didn't need to change the infcloud or radicale apps at all! Configuration of the apache httpd reverse proxy, and also my radicale rights file was all I needed.

Changes to apache httpd config

I only needed to change one line in my main config file: which auth.cnf file to include:

RewriteEngine On
RewriteRule ^/radicale$ /radicale/ [R,L]
<Location "/radicale/">
   ProxyPreserveHost On
   Include conf.d/auth-gssapi.cnf
   Require valid-user
   AuthName "GSSAPI protected"
   ProxyPass        http://localhost:5232/ retry=20 connectiontimeout=300 timeout=300
   ProxyPassReverse http://localhost:5232/
   RequestHeader    set X-Script-Name /radicale
</Location>

Changes to auth-gssapi.cnf

I added entries to auth-gssapi.cnf, which was mostly complete.

AuthType GSSAPI
GssapiUseSessions On
Session On
SessionCookieName s1_session path=/;
GssapiCredStore keytab:/etc/httpd/keytab
GssapiCredStore ccache:/etc/httpd/krb5.cache
SessionHeader S1SESSION
GssapiSessionKey file:/etc/httpd/gssapisession.key
GssapiImpersonate On
GssapiDelegCcacheDir /run/httpd/ccache
GssapiDelegCcachePerms mode:0660 gid:apache
GssapiUseS4U2Proxy On
GssapiAllowedMech krb5
GssapiBasicAuth On
GssapiBasicAuthMech krb5
GssapiLocalName On
GssapiNameAttributes json
AuthBasicProvider ldap
AuthLDAPGroupAttribute member
AuthLDAPSubGroupClass group
AuthLDAPGroupAttributeIsDN On
AuthLDAPURL "ldaps://dns1.ipa.internal.com:636 dns2.ipa.internal.com:636/cn=users,cn=accounts,dc=ipa,dc=internal,dc=com?uid,memberof,gecos?sub?(objectClass=person)"
#GSS_NAME returns username@IPA.EXAMPLE.COM which merely needs additional rules in /etc/radicale/rights
RequestHeader set X_REMOTE_USER "%{GSS_NAME}e"
# Does not work
#RequestHeader set X_GROUPS "%{AUTHENTICATE_memberOf}e"
# mostly useless values
#RequestHeader set X_REMOTE_GSS "%{GSS_NAME_ATTRS_JSON}e"

Changes to radicale rights file

My radicale setup uses /etc/radicale/rights to define the ACLS. The examples in the file are very useful. I merely needed to repeat entries and add the domain name.

# default, which was already here
[principal]
user: .+
collection: {user}
permissions: RW
# new entry
[principal-domain]
user: (.+)@IPA.INTERNAL.COM
collection: {0}
permissions: RW

# default
[calendars]
user: .+
collection: {user}/[^/]+
permissions: rw
# new entry
[calendars-domain]
user: (.+)@IPA.INTERNAL.COM
collection: {0}/[^/]+
permissions: rw

# Specific calendars
[user8-read-bgstack15-1]
user: user8
collection: bgstack15
permissions: R
[user8-read-bgstack15-2]
user: user8
collection: bgstack15/c86bcd9f-7526-8083-ca5c-c68bc664ae03
permissions: rwi
# new entries
[user8-read-bgstack15-1-domain]
user: user8@IPA.INTERNAL.COM
collection: bgstack15
permissionsS: R
[user8-read-bgstack15-2-domain]
user: user8@IPA.INTERNAL.COM
collection: bgstack15/c86bcd9f-7526-8083-ca5c-c68bc664ae03
permissions: rwi

I find it worth duplicating entries, to accomplish my goal of being able to seamlessly download calendar events in my browser.

ssh_config: new option in Devuan, March 2023

bgstack15 — Sun, 05 Mar 2023 13:54:19 GMT

From the apt-listchanges message for this month:

openssh (1:9.2p1-1) unstable; urgency=medium

  OpenSSH 9.2 includes a number of changes that may affect existing
  configurations:

   * ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that
     controls whether the client-side ~C escape sequence that provides a
     command-line is available. Among other things, the ~C command-line
     could be used to add additional port-forwards at runtime.

     This option defaults to "no", disabling the ~C command-line that was
     previously enabled by default. Turning off the command-line allows
     platforms that support sandboxing of the ssh(1) client (currently only
     OpenBSD) to use a stricter default sandbox policy.

 -- Colin Watson <cjwatson@debian.org>  Wed, 08 Feb 2023 10:36:06 +0000

So I had to run this on all Devuan systems, to keep my ssh client command-line enabled.

sudo updateval -a -v /etc/ssh/ssh_config '^\s*EnableEscapeCommandline.*' 'EnableEscapeCommandline yes'

Where updateval is from my bgscripts-core package.

socks proxy command

bgstack15 — Wed, 01 Mar 2023 14:29:10 GMT

Run this command.

ssh -D 8880 ${USER}@proxyserver -n -f -N

Set socks proxy in browser settings.

Knowledge Base (Posts about proxy)

owntracks with reverse proxy

References

Novel project: Luanti Web Services Proxy

Using LWSP

Running the proxy server locally

Running proxy server in docker or docker-compose

Configuring Luanti client to use the proxy server

Using multiplexer for ContentDB

Using multiplexer for Serverlist

Author

Alternatives

Further reading

Use Apache httpd as a reverse proxy for Minetest Mapserver

References

Firefox proxy notes

Run SOCKS proxy

Configure firefox proxy

Firefox extension to make it easier

References

Weblinks

My blog

Internal

Newspipe support for reverse proxy

Coming soon to newspipe: reverse proxy support

References

Weblinks

My previous related work

disabling webrtc temporarily

Improving radicale kerberos auth

Changes to apache httpd config

Changes to auth-gssapi.cnf

Changes to radicale rights file

ssh_config: new option in Devuan, March 2023

socks proxy command