starred/tacticalrmm

Fork 0

mirror of https://github.com/amidaware/tacticalrmm.git synced 2026-04-26 15:05:57 +03:00

[GH-ISSUE #135] Tactical behind a Reverse proxy #2021

New issue

Closed

opened 2026-03-14 02:07:51 +03:00 by kerem · 6 comments

kerem commented

2026-03-14 02:07:51 +03:00

Owner

Originally created by @simiplex on GitHub (Oct 9, 2020).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/135

I have an apache webserver. I setup it to forward rmm, api and the mesh urls through it to the nginx server and the ssl certificates show up as valid. I have all web interfaces working over the internet and everything works and connects except the mesh agent wont install and this is the error I get in the apache logs

8/Oct/2020:19:54:38 +0000] "GET /api/v2/meshexe/ HTTP/1.1" 401 451 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36"
It works fine on the local LAN as well if I change the NAT rules directly to the Tactical server.
Is what I am trying to do possible, or can I change the port from 443 if needed for the mesh client?

Thanks

Originally created by @simiplex on GitHub (Oct 9, 2020). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/135 I have an apache webserver. I setup it to forward rmm, api and the mesh urls through it to the nginx server and the ssl certificates show up as valid. I have all web interfaces working over the internet and everything works and connects except the mesh agent wont install and this is the error I get in the apache logs 8/Oct/2020:19:54:38 +0000] "GET /api/v2/meshexe/ HTTP/1.1" 401 451 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36" It works fine on the local LAN as well if I change the NAT rules directly to the Tactical server. Is what I am trying to do possible, or can I change the port from 443 if needed for the mesh client? Thanks

kerem closed this issue

2026-03-14 02:07:57 +03:00

kerem commented

2026-03-14 02:08:03 +03:00

Author

Owner

@wh1te909 commented on GitHub (Oct 9, 2020):

Nginx's only purpose in the rmm setup is to act as a reverse proxy, so if you want to use apache there is no need for nginx you should just have apache acting as the proxy. Look at the 3 nginx conf files in /etc/nginx/sites-available (rmm.conf for the django backend, meshcentral.conf and frontend.conf for the vue frontend) and just translate those to apache conf's and you can get rid of ngnix.

@wh1te909 commented on GitHub (Oct 9, 2020): Nginx's only purpose in the rmm setup is to act as a reverse proxy, so if you want to use apache there is no need for nginx you should just have apache acting as the proxy. Look at the 3 nginx conf files in /etc/nginx/sites-available (rmm.conf for the django backend, meshcentral.conf and frontend.conf for the vue frontend) and just translate those to apache conf's and you can get rid of ngnix.

kerem commented

2026-03-14 02:08:08 +03:00

Author

Owner

@bradhawkins85 commented on GitHub (Oct 12, 2020):

It is possible to have the whole system behind a reverse proxy. Mine is behind HAProxy for the exact same reason, I have a wildcard certificate on the reverse proxy which covers all my sites and domains. I'll put snippets of the HAProxy config which may or may not be useful for you.

frontend my_frontend
bind *:80 name http
bind *:443 name https ssl crt /etc/letsencrypt/live/mycert.pem
option httplog
option forwardfor
option http-keep-alive
option prefer-last-server
no option httpclose
no option http-server-close
no option forceclose
no option http-tunnel
acl host_rmm hdr(Host) -i rmm.mydomain.com.au
acl host_rmmapi hdr(Host) -i api.mydomain.com.au
acl host_rmmmesh hdr(Host) -i mesh.mydomain.com.au
use_backend bk_tactical if host_rmm
use_backend bk_tactical if host_rmmapi
use_backend bk_tactical if host_rmmmesh

backend bk_tactical
option http-keep-alive
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
http-check expect string 200\ OK
server tactilermm internalip:443 ssl verify none maxconn 1000 weight 10 check

@bradhawkins85 commented on GitHub (Oct 12, 2020): It is possible to have the whole system behind a reverse proxy. Mine is behind HAProxy for the exact same reason, I have a wildcard certificate on the reverse proxy which covers all my sites and domains. I'll put snippets of the HAProxy config which may or may not be useful for you. frontend my_frontend bind *:80 name http bind *:443 name https ssl crt /etc/letsencrypt/live/mycert.pem option httplog option forwardfor option http-keep-alive option prefer-last-server no option httpclose no option http-server-close no option forceclose no option http-tunnel acl host_rmm hdr(Host) -i rmm.mydomain.com.au acl host_rmmapi hdr(Host) -i api.mydomain.com.au acl host_rmmmesh hdr(Host) -i mesh.mydomain.com.au use_backend bk_tactical if host_rmm use_backend bk_tactical if host_rmmapi use_backend bk_tactical if host_rmmmesh backend bk_tactical option http-keep-alive option forwardfor http-request set-header X-Forwarded-Port %[dst_port] http-request add-header X-Forwarded-Proto https if { ssl_fc } http-check expect string 200\ OK server tactilermm internalip:443 ssl verify none maxconn 1000 weight 10 check

kerem commented

2026-03-14 02:08:13 +03:00

Author

Owner

@simiplex commented on GitHub (Oct 12, 2020):

Thanks. I was able to get it almost all working except the agent installer seems to fail after downloading the salt minion. If I forward the 443 port directly to the Tactical server it works and installs properly etc...

Installer - Install 165 -ERROR HTTPSConnectionPool (host='api.mydomain.com', port 443) : Max Retries exceed with url: /api/v2/mesexe (Caused by SSLError(SSLCertVerficationError(1, '[SSL:CERTIFCATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

If I browse to api.mydomain.com/longurlkey...... or rmm or mesh the certificate comes up as valid. I will review my server logs to see if I missed anything. Any pointers will be appreciated.

Thanks

@simiplex commented on GitHub (Oct 12, 2020): Thanks. I was able to get it almost all working except the agent installer seems to fail after downloading the salt minion. If I forward the 443 port directly to the Tactical server it works and installs properly etc... Installer - Install 165 -ERROR HTTPSConnectionPool (host='api.mydomain.com', port 443) : Max Retries exceed with url: /api/v2/mesexe (Caused by SSLError(SSLCertVerficationError(1, '[SSL:CERTIFCATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate If I browse to api.mydomain.com/longurlkey...... or rmm or mesh the certificate comes up as valid. I will review my server logs to see if I missed anything. Any pointers will be appreciated. Thanks

kerem commented

2026-03-14 02:08:18 +03:00

Author

Owner

@wh1te909 commented on GitHub (Oct 12, 2020):

Only time I've seen that error is when using a domain CA, see here https://github.com/wh1te909/winagent/issues/3
Support for that has already been added, when you run the installer pass it the --cert C:\path\to\your\ca.pem flag but doesn't seem like that's your issue

What do you mean by if you forward 443 port directly to the server? Are you still using nginx behind apache or did you get rid of nginx and just using apache?

@wh1te909 commented on GitHub (Oct 12, 2020): Only time I've seen that error is when using a domain CA, see here https://github.com/wh1te909/winagent/issues/3 Support for that has already been added, when you run the installer pass it the ```--cert C:\path\to\your\ca.pem``` flag but doesn't seem like that's your issue What do you mean by if you forward 443 port directly to the server? Are you still using nginx behind apache or did you get rid of nginx and just using apache?

kerem commented

2026-03-14 02:08:23 +03:00

Author

Owner

@simiplex commented on GitHub (Oct 13, 2020):

Thanks for your help. I followed @bradhawkins85 advice and used HAproxy and it works. My lab setup currently is a mess of different servers built upon previous server and I don't take the time to clean up the routing and design. This forced me to do some reconfiguration to make things run smoother.

@simiplex commented on GitHub (Oct 13, 2020): Thanks for your help. I followed @bradhawkins85 advice and used HAproxy and it works. My lab setup currently is a mess of different servers built upon previous server and I don't take the time to clean up the routing and design. This forced me to do some reconfiguration to make things run smoother.

kerem commented

2026-03-14 02:08:28 +03:00

Author

Owner

@bradhawkins85 commented on GitHub (Oct 14, 2020):

@simiplex Glad you got it sorted.

@bradhawkins85 commented on GitHub (Oct 14, 2020): @simiplex Glad you got it sorted.

kerem referenced this issue

2026-03-14 06:51:45 +03:00

[GH-ISSUE #2021] [UI Tweeks] Add more info to the automation policies for checks #3202