Dynmap doesn't work from domain
Polda18 opened this issue ยท 12 comments
Issue Description: When accessing dynmap from ip:port address, it does work. But when accessing through domain:port (planning just domain with reverse proxy to the port), it suddenly refuses to work and times out connection.
- Dynmap Version: core=3.1-beta4-421, plugin=3.1-beta4-421
- Server Version: paper 1.16.3 build git-Paper-195
- Pastebin of Configuration.txt: https://hasteb.in/uyesecim.yaml
- Server Host (if applicable): self-hosted with domain DNS (mc.7biom.cz or play.7biom.cz)
- Pastebin of crashlogs or other relevant logs: Not applicable
- Other Relevant Data/Screenshots: See section of screenshots
- Steps to Replicate: Not sure. Install plugin, configure it, access via domain, I guess?
I couldn't even get it to work after cache flush and temporary files deletion
Screenshots
- I have looked at all other issues and this is not a duplicate - Not sure, as I found this issue, but it has been closed as not reproducable. Could be something with DNS, but I already verified the domain works just fine, it only refuses connection to the dynmap.
- I have been able to replicate this
This isnt an issue with dynmap but rather an issue with your reverse proxy
Also, if you use a reverse proxy you shouldn't need a port.
I didn't configure the reverse proxy yet, I wanted to first test the dynmap straight from the port to see if it works.
Still not a dynmap issue if you can access it ip:port but not domain:port
I would make sure all your A records are configured correctly
Affirmative. As I said, I already verified that the domain correctly points to the IP address. It could be Cloudflare's fault as it proxies everything behind our domain, but if I test it without the port, it displays the Pterodactyl panel we use for our BungeeCord network setup, as I expect it without reverse proxy set up, so I don't know.
Oh, I guess it could be because of HTTPS is enabled on CloudFlare. Should I enable SSL for that?
FYI I would not expose your pterodactyl panel to the public web, thats asking to be hacked.
Cloudflare does have a TTL on dns changes, did you just make a change? Could be that
RE: https due to chrome not allowing http content to be served over https connection you will need to fully get the reverse proxy set up with SSL to view it from https
You should be able to access it from http://domain:ip/ though
No, I guess it was the proxy. I disabled Cloudflare proxy for the domain and now it works. Can I somehow configure dynmap to be used with Cloudflare proxy?
If you set up the proxy to only serve over https the proxy won't work. IIRC cloudflare doesn't proxy http connections by default
https://boilercraft.com/maps here is my map behind a cloudflare proxy
We'll configure the reverse proxy to be accessed over HTTPS. I've set up our domain to be proxied over https and enforce https when possible. Maybe that's what was causing the issues. Removed the proxy temporarily and it worked. In fact, this is our NGINX configuration we plan to use:
server {
listen 80;
server_name dynmap.7biom.cz;
return 301 https://$server_name$request_uri;
}
server {
listen 443;
server_name dynmap.7biom.cz;
# SSL Configuration
ssl_certificate /etc/letsencrypt/live/dynmap.7biom.cz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/dynmap.7biom.cz/privkey.pem;
ssl_session_cache shared:SSL:10m;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
ssl_prefer_server_ciphers on;
# See https://hstspreload.org/ before uncommenting the line below.
# add_header Strict-Transport-Security "max-age=15768000; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header Content-Security-Policy "frame-ancestors 'self'";
add_header X-Frame-Options DENY;
add_header Referrer-Policy same-origin;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://127.0.0.1:8124
}
}
But if I enable SSL in dynmap config, I would need to change the proxy pass to pass through https, wouldn't I?
There is no SSL option in dynmaps config- only to pull from MySQL over https vs http
I'm not 100% familiar with nginx but that config should serve the webpage to visitors over https and only use http between the webserver and the dynmap webserver. Since the dynmap webserver and the nginx webserver are behind the same firewall this is mostly safe