Dynmap-Forge/Fabric

Dynmap-Forge/Fabric

888k Downloads

Dynmap doesn't work from domain

Polda18 opened this issue ยท 12 comments

commented

Issue Description: When accessing dynmap from ip:port address, it does work. But when accessing through domain:port (planning just domain with reverse proxy to the port), it suddenly refuses to work and times out connection.

  • Dynmap Version: core=3.1-beta4-421, plugin=3.1-beta4-421
  • Server Version: paper 1.16.3 build git-Paper-195
  • Pastebin of Configuration.txt: https://hasteb.in/uyesecim.yaml
  • Server Host (if applicable): self-hosted with domain DNS (mc.7biom.cz or play.7biom.cz)
  • Pastebin of crashlogs or other relevant logs: Not applicable
  • Other Relevant Data/Screenshots: See section of screenshots
  • Steps to Replicate: Not sure. Install plugin, configure it, access via domain, I guess?

I couldn't even get it to work after cache flush and temporary files deletion

Screenshots

image

  • I have looked at all other issues and this is not a duplicate - Not sure, as I found this issue, but it has been closed as not reproducable. Could be something with DNS, but I already verified the domain works just fine, it only refuses connection to the dynmap.
  • I have been able to replicate this
commented

This isnt an issue with dynmap but rather an issue with your reverse proxy
Also, if you use a reverse proxy you shouldn't need a port.

commented

I didn't configure the reverse proxy yet, I wanted to first test the dynmap straight from the port to see if it works.

commented

Still not a dynmap issue if you can access it ip:port but not domain:port

I would make sure all your A records are configured correctly

commented

Affirmative. As I said, I already verified that the domain correctly points to the IP address. It could be Cloudflare's fault as it proxies everything behind our domain, but if I test it without the port, it displays the Pterodactyl panel we use for our BungeeCord network setup, as I expect it without reverse proxy set up, so I don't know.

commented

Oh, I guess it could be because of HTTPS is enabled on CloudFlare. Should I enable SSL for that?

commented

FYI I would not expose your pterodactyl panel to the public web, thats asking to be hacked.

Cloudflare does have a TTL on dns changes, did you just make a change? Could be that

RE: https due to chrome not allowing http content to be served over https connection you will need to fully get the reverse proxy set up with SSL to view it from https

You should be able to access it from http://domain:ip/ though

commented

No, I guess it was the proxy. I disabled Cloudflare proxy for the domain and now it works. Can I somehow configure dynmap to be used with Cloudflare proxy?

commented

If you set up the proxy to only serve over https the proxy won't work. IIRC cloudflare doesn't proxy http connections by default

commented

https://boilercraft.com/maps here is my map behind a cloudflare proxy

commented

We'll configure the reverse proxy to be accessed over HTTPS. I've set up our domain to be proxied over https and enforce https when possible. Maybe that's what was causing the issues. Removed the proxy temporarily and it worked. In fact, this is our NGINX configuration we plan to use:

server {
    listen 80;
    server_name dynmap.7biom.cz;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443;
    server_name dynmap.7biom.cz;
	
    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/dynmap.7biom.cz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dynmap.7biom.cz/privkey.pem;
    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
    ssl_prefer_server_ciphers on;

    # See https://hstspreload.org/ before uncommenting the line below.
    # add_header Strict-Transport-Security "max-age=15768000; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header Content-Security-Policy "frame-ancestors 'self'";
    add_header X-Frame-Options DENY;
    add_header Referrer-Policy same-origin;
	
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:8124
    }
}

But if I enable SSL in dynmap config, I would need to change the proxy pass to pass through https, wouldn't I?

commented

There is no SSL option in dynmaps config- only to pull from MySQL over https vs http

I'm not 100% familiar with nginx but that config should serve the webpage to visitors over https and only use http between the webserver and the dynmap webserver. Since the dynmap webserver and the nginx webserver are behind the same firewall this is mostly safe

commented

Okay, so thank you and I'll try it out then :)