code-server works locally but failed as a back-end behind apache2

[Nibikibaba]

I have a code-server set up similar to that of cleanet #4030

My code-server runs on a local machine with a local ip addr of 192.168.1.123 with a config like this:

---
bind-addr: 0.0.0.0:8080
auth: password
password: ajsjd82kblahblah
cert: false

It works flawlessly if I access it from a browser on a machine in the local network.

Another machine in the local network runs an apache2 server and is exposed to the internet through Cloudflare (A. for https protection and B. my ISP only allows port 80 access to my network.)

So https://www.mydomain.com would reach the apache2 server.

Similar to what cleanet has tried, I have added a VirtualHost to apache2 to allow access to the code-server as a back-end server through a sub-domain: code.mydomain.com

The apache VirtualHost section for that is like this:

<VirtualHost *:80>
    ServerName code.mydomain.com
    ProxyPreserveHost On
    ProxyPass "/" "http://192.168.1.123:8080/"
    ProxyPassReverse "/" "http://192.168.1.123:8080/"
</VirtualHost>

Of course I have a CNAME entry in the DNS settings on Cloudflare for code.mydomain.com to reach my apache2 server.

When I tried to access the code-server with: https://code.mydomain.com for the first time it brought up the password dialog correctly (just like in cleanet's case) proving that apache2's redirection worked.

However, after the successful authentication with the correct password, the page turned blank with the script behind got into some endless activities what consume a lot of CPU cycles (closing the page would immediately brought down CPU usage to normal.)

Local access to the code-server through http://192.168.1.123:8080 remains flawless and the code-server program has never crashed.

I'm guessing that this is probably caused by some simple reverse proxy setup mistakes/omissions that have messed up the communication between the script loaded into the browser (after authentication) and the apache2 entry point.

(I think I've found the crux of the problem now. See Edit at the end.)

Many thanks!

Nibikibaba

PS. I've tried setting code-server to listen on port 80 directly and removed the :8080 part from the VirtualHost section but that did not change anything -- local access still ok but sub-domain back-end server access still ended up with that busy blank page.

Edit: I have gone through the errors in the browser and have found that the problem is that it is unable to establish a websocket connection to the code-server machine. This is because apache2 is unable to reverse proxy websocket communications. It seems that the solution would have to be something like the use of something like HAProxy to act as a front-end to apache2 and code-server. Does anyone know if the Cloudflare proxy front would allow websocket communications to go through at all?

[jsjoeio]

This is because apache2 is unable to reverse proxy websocket communications. It seems that the solution would have to be something like the use of something like HAProxy to act as a front-end to apache2 and code-server. Does anyone know if the Cloudflare proxy front would allow websocket communications to go through at all?

Nice debugging! Maybe @code-asher knows?

[code-asher]

I think you are probably just missing the websocket upgrade. This comment may be of help: #2104 (comment)

[code-asher]

In addition you might also need to ensure proxy_wstunnel_module is enabled.

[Nibikibaba]

Thanks for the pointer! I have been misled by old internet info about Apache2's missing support for websocket. Indeed upgrading from apache 2.3 to 2.4 and then enabling proxy_wstunnel + rewrite modules solves the problem. I would still explore the HAProxy front-end option to see if that would have any performance improvement over apache2's websocket reverse proxy support.