PBS behind reverse proxy

[virdb]

Hi all,
I have an installation of PBS behind an apache reverse proxy, and I can access to the webui without problems. The console doesn't works but it wasn't a big problem.

Now i want to use proxmox-backup-client to backup a remote VPS to my PBS, but backup fails with:

Starting backup: host/debian/2020-12-10T09:18:28Z
Client name: debian
Starting backup protocol: Thu Dec 10 10:18:28 2020
Error: missing Upgrade header

googling around seems to be an issue related to ws/wss handshake.

For PVE, i use those apache directives to access the console:

        <LocationMatch ^/(api2/json/nodes/[^\/]+/[^\/]+/[^\/]+/vncwebsocket.*)$>
            ProxyPass wss://xxx.xxx.xxx.xxx:8006/$1 retry=0
        </LocationMatch>
  
        <Location /websockify>
            ProxyPass ws://xxx.xxx.xxx.xxx:8006
            ProxyPassReverse ws://xxx.xxx.xxx.xxx:8006
        </Location>
        <LocationMatch ^/(api2/json/nodes/[^\/]+/vncwebsocket.*)$>
            ProxyPass wss://xxx.xxx.xxx.xxx/$1 retry=0
        </LocationMatch>

but i cannot find anywhere similar directives for PBS.
The console is not so important, but the remote backup is very important.

Thanks a lot and best regards

 

[oguz]

hi,

i haven't tried it but maybe just changing the port from 8006 to 8007 could work?

 

[dcsapak]

pbs uses http2 for backups, which needs the 'upgrade' header so you have to configure your proxy to pass that to the backend

 

[virdb]

hi,

i haven't tried it but maybe just changing the port from 8006 to 8007 could work?

Thanks for the suggestion @oguz , but i already forward on my reverse proxy to 8007 in order to have the webui working.

 

[virdb]

pbs uses http2 for backups, which needs the 'upgrade' header so you have to configure your proxy to pass that to the backend

Hi @dcsapak thank you for the suggestion, maybe it's the right path!

I tried this (adapted from Apache docs), but still doesn't works (same error):

        <LocationMatch ^/(api2/json/backup*)$>
            ProxyPass h2://xxx.xxx.xxx.xxx:8007/$1
            ProxyPassReverse h2://xxx.xxx.xxx.xxx:8007
        </LocationMatch>

any ideas?

 

[dcsapak]

<LocationMatch ^/(api2/json/backup*)$>

is that location match not wrong?

as i would read that regex, you allow:

/api2/json/backu
/api2/json/backup
/api2/json/backupp
/api2/json/backuppp

etc...

i'd try to simply allow all paths first and then narrow it down if needed..