Sunstone's vnc not working behind nginx reverse proxy

Community Support
1

Hi guys! I am new to opennebula. I have two node setup: sunstone is living in a small vm, and hypervisor is placed on dedicated bare-metal server with CentOS 7. I have setup nginx as reverse proxy for sunstone one the same vm. I am getting “VNC Server disconnected (code: 1006)” error. Here is my configuration:

/etc/nginx/conf.d/opennebula.conf:

upstream sunstone  {
        server 127.0.0.1:9869;
}


upstream vnc_proxy {
        server 127.0.0.1:29876; 
}

server {
        listen 80;
        server_name 10.xx.xx.xx;

        ### Permanent redirect to HTTPS (optional)
        return 301 https://$server_name:443;
}


server {
        listen 443 ssl;
        server_name 10.xx.xx.xx;
        ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
        ssl_certificate_key /etc/ssl/nginx-selfsigned.key;

        ### Proxy requests to upstream
        location / {
                 proxy_pass http://sunstone;
        }
  

  location /websockify {
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Server $host;
          proxy_set_header x-forwarded-proto  $scheme;
          proxy_set_header Host $host;
          proxy_http_version 1.1;
          proxy_read_timeout 86400;
          proxy_pass https://vnc_proxy;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
        }
}

/etc/oned/sunstone-server.conf:

:tmpdir: /var/tmp
:one_xmlrpc: http://localhost:2633/RPC2
:host: 127.0.0.1
:port: 9869
:sessions: memory
memcache_host: localhost
:memcache_port: 11211
:memcache_namespace: opennebula.sunstone
:env: 'prod'
:debug_level: 3
:auth: opennebula
:core_auth: cipher
:remote_version: http://downloads.opennebula.org/latest
:vnc_proxy_port: 29876
:vnc_proxy_support_wss: yes
:vnc_proxy_cert: /etc/one/certs/one-tornasol.crt
:vnc_proxy_key: /etc/one/certs/one-tornasol.key
:vnc_proxy_ipv6: false
:vnc_request_password: false
:lang: en_US
:table_order: desc
:marketplace_url: http://marketplace.opennebula.systems/
:oneflow_server: http://localhost:2474/
:routes:
    - oneflow
    - vcenter
    - support

What am I doing wrong?

2

I notice the cert-name, is it really selfsigned?
If so, check this post:

hope this helps!

3

Hi! 10x for your answer. I’ll try it out this week!) I did almostly the same things, but I could do some mistakes. I’ll double check it.)

4

HI! Finally I solved this issue: here is

nginx.conf

upstream sunstone  {
    server 127.0.0.1:9869;
}


upstream vnc_proxy {
    server 127.0.0.1:29876; 
}

server {
    listen 80;
    server_name 10.xx.xx.xx;

    ### Permanent redirect to HTTPS (optional)
    return 301 https://$server_name:443;
}


server {
    listen 443 ssl;
    server_name 10.xx.xx.xx;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;

    ### Proxy requests to upstream
    location / {
             proxy_pass http://sunstone;
    }
  

  location /websockify {
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header x-forwarded-proto  $scheme;
      proxy_set_header Host $host;
      proxy_http_version 1.1;
      proxy_read_timeout 86400;
      proxy_pass https://vnc_proxy;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
    }
}

sunstone-server.conf

:tmpdir: /var/tmp
:one_xmlrpc: http://localhost:2633/RPC2
:one_xmlrpc_timeout: 60
:host: 127.0.0.1
:port: 9869
:sessions: memory
:memcache_host: localhost
:memcache_port: 11211
:memcache_namespace: opennebula.sunstone
:env: 'prod'
:debug_level: 3
:auth: opennebula
:core_auth: cipher
:remote_version: http://downloads.opennebula.org/latest
:vnc_proxy_port: 29876
:vnc_proxy_support_wss: only
:vnc_proxy_cert: /etc/one/ssl/nginx.crt
:vnc_proxy_key: /etc/one/ssl/nginx.key
:vnc_proxy_ipv6: false
:vnc_request_password: false
:keep_me_logged: true
:lang: en_US
:table_order: desc
:mode: 'mixed'
:marketplace_url: http://marketplace.opennebula.systems/
:oneflow_server: http://localhost:2474/
:routes:
- oneflow
- vcenter
- support
3 Likes