Anyone get firefly3 to work behind pfsense haproxy?
reddit / selfhosted

----------------------------------------------------------------------
St_B_Boy · 2023-09-26 14:49

I've setup firefly in my home lab docker environment. I use haproxy
(on my pfsense) to access all of my local services securely using
valid ssl certificates and subdomains which are managed and resolved
locally (also on pfsense).

Firefly will not get past the login screen because of:

* warnings related to: Mixed Content", and
* errors related to Content Security Policy (CSP):
   * "Refused to set the document's base URI" and
   * "Refused to send form data".

I've configured firefly (I think) to trust all proxies with the
"TRUSTED\_PROXY=\*\*" environment variable. I've tested access from a
Cloudflare tunnel and it works great with no issues other than
Cloudflare masking email addresses which I'm good with.

I've also tested turning off CSP in Firefly but that caused several
other problems.

I suspect I need to re-write some headers for this particular backend
but I'm not sure which ones need to be added or re-written.

Any suggestions?

----------------------------------------------------------------------
loph12 · 2023-09-27 06:25

This probably isn't the most helpful, but I was successfully able to
get Firefly 3 working behind the reverse proxy caddy. I didn't have to
rewrite any headers. I only had to set TRUSTED_PROXIES=** as you said
you did.

----------------------------------------------------------------------
St_B_Boy · 2023-09-27 08:23

Solved.  I was able to find a solution in this article:
[https://discourse.haproxy.org/t/mixed-content-warning-when-using-
https/981/9](https://discourse.haproxy.org/t/mixed-content-warning-
when-using-https/981/9)

Specifically, I added "http-response set-header Content-Security-
Policy upgrade-insecure-requests" to the "backend pass thru" section
for the HAProxy backend server.

I believe, if I understand this correctly, it forces HAProxy to scan
all page content and replace insecure link references that the page
may contain.

Hopefully this helps someone else.

----------------------------------------------------------------------
St_B_Boy · 2023-09-27 08:28

Thanks for the suggestion. Yes that's seems to be the key for everyone
using proxies other than HAProxy.

I'm guessing default configurations vary amongst the products. Caddy
and NGINx (as well as Cloudflare) seem to handle this out of the box
whereas this needs to be turned on in HAProxy.