Can't get v6 webinterface behind nginx reverse proxy to work

General Beta 6.0
1

Hey there,

after upgrading Pi-hole to v6, I can't reach the webinterface behind a nginx reverse proxy anymore.
I use nginx, because I have more web services running on the Pi-hole box, so I configure them to different ports, and reverse-proxy them to an internal hostname, e.g. pi-hole.home for my Pi-hole instance.

For v5 I configured lighttpd to localhost:

server.port                 = 8001
server.bind                 = "127.0.0.1"

and used this nginx config for years which worked like a charm:

server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://127.0.0.1:8001/admin/;
        }

        location /admin/ {
                return 301 $scheme://$host/;
        }
}

Now after update, I can't get this to work.
I already figured out with this post to run
pihole-FTL --config webserver.port 8001 to get back "my" port.

But this now ends in a redirect loop:

So I stripped down the config to just do a plain reverse proxy:

server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://127.0.0.1:8001/;
        }
}

Which ends in a different situation: http://pi-hole.home/ replys with 403 Forbidden, and nearly all script/stylesheet requests (except /admin/vendor/datatables/, /admin/vendor/daterangepicker/ and /admin/vendor/bootstrap-toggle/) return a 301 Moved Permanently to http://pi-hole.home/
This results in black text on black background:

image
image387×146 603 Bytes

Which basically wants to tell me:
image
image373×128 2.68 KB

So how can I get my configuration to work?
It seems as other users got it to work with a lighttpd reverse proxy config.

PS: http://pi.hole:8001/ works, but that's not the url I want it to be at.

2

I got one step further:

image
image503×305 6.2 KB

The new server doesn't seem to expect X-Real-IP but classic X-Forwarded-For

But when I click the http://pi-hole.home/admin/ I get a 301 Moved permanently to http://pi-hole.home/ which doesn't help me.

Manually going to http://pi-hole.home/admin/login shows this:

image
image491×395 8.99 KB

But login doesn't work and http://pi-hole.home/admin/img/logo.svg replys with 301 Moved Permanently http://pi-hole.home/, that's why the logo is missing.

3

I'm not a nginx user, but maybe this should be location /admin/ {

4

Thanks! I just wanted to object because a location / with proxy_pass http://127.0.0.1:8001/; should reverse proxy all paths including /admin...

But weirdly, this config works, setting up two separate reverse proxies for /admin and /api
So this is the full config I now use:

server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                return 301 $scheme://$host/admin/;
        }
        location /admin/ {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://127.0.0.1:8001/admin/;
        }
        location /api/ {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://127.0.0.1:8001/api/;
        }
}

server {
        # redirect non-standard TLD to proper domain
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi.hole;

        location / {
                return 301 $scheme://pi-hole.home/admin/;
        }
}

So run pihole-FTL --config webserver.port "127.0.0.1:8001" to not expose this port to the network interface(s) and you are done.

With v5 I didn't see a reason to have Pi-hole set up under /admin, that's why I moved it to the root. But I don't insist on that, so I'm fine with the new setup.

So thanks for making me try out that way.

2 Likes
5

As per the documentation (from pihole.toml or All settings » Webserver and API in the webUI), you could either set webserver.acl to e.g. +127.0.0.1,+[::1] to restrict access, or bind the webserver to the loopback addresses by setting webserver.port to e.g. 127.0.0.1:80,[::1]:80.

2 Likes
6

Thanks, worked for me with a podman install behind Nginx too.

1 Like