Reverse Proxy

How to use SCM-Manager with common reverse proxies

SCM-Manager can run behind any reverse proxy, but a few rules must be respected. The reverse proxy should not encode slashes and the X-Forwarded-For and X-Forwarded-Host headers must be sent to SCM-Manager. If the proxy uses a different protocol as the SCM-Manager e.g. https on proxy and http on scm-manager, the X-Forwarded-Proto header must be sent too. If XSRF protection is enabled on the SCM-Manager server, the cookie has to be HttpOnly=false and must not be modified.

For SCM-Manager to work properly, the configuration forwardHeadersEnabled has to be set to true in the config.yml. To avoid timeouts due to caching in the reverse proxies, you also might want to increase the idleTimeout to a higher value, depending on the size of your repositories (you might want to start with 300000, that would be five minutes). See the section about reverse proxies in SCM-Server configuration for more information.

nginx

# set required forward headers
proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# if https is used make sure X-Forwarded-Proto header is send
proxy_set_header X-Forwarded-Proto $scheme;

# assuming scm-manager is running on localhost at port 8080
location /scm {
    proxy_pass http://scm:8080;
}

Apache

If you use VirtualHost sections, please make sure to put the directives AllowEncodedSlashes, RequestHeader, ProxyPass, and ProxyPassReverse into the same section as the Location for SCM-Manager.

# Ensure mod_proxy and mod_proxy_http modules are loaded
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so

# avoid encoding of slashes
AllowEncodedSlashes NoDecode

# if https is used, make sure X-Forwarded-Proto is send
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
RequestHeader set "X-Forwarded-SSL" expr=%{HTTPS}

# assuming scm-manager is running on localhost at port 8080
ProxyPass /scm http://localhost:8080/scm nocanon
ProxyPassReverse /scm http://localhost:8080/scm

<Location /scm>
    Order allow,deny
    Allow from all
</Location>

Notes

  • Setting ProxyPassReverseCookiePath would most likely cause problems with session handling!
  • If you encounter timeout problems, please have a look at Apache Module mod_proxy#Workers.

HAProxy

backend scm
    # use http as proxy protocol
    mode http
    # sets X-Forwarded-For header
    option forwardfor
    # check if scm is running
    option httpchk GET /scm/api/v2
    # assuming scm-manager is running on localhost at port 8080
    server dcscm1 localhost:8080 check
    # sets X-Forwarded-Host header
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    # sets X-Forwarded-Proto to https if ssl is enabled
    http-request set-header X-Forwarded-Proto https if { ssl_fc }