Trying to open my rmm server to an external proxy server

[gabmega]

I have some servers that have to run on the same public ip, for this I use an nginx server, however I need to install rmm on a server, and it must be accessible via the same public ip and with a subdomain of the same dns name

I've made great progress, and I can now log in and manage things via rmm. However, I am still facing 2 problems, in the api log there is an error with natsws, and the mesh cannot connect to the computer remotely, the "connect" button is disabled when I use "take control"

My rmm server: 192.168.1.41
My Nginx server: 192.168.1.54

Nginx log error:
2024/12/03 18:47:39 [error] 817#817: *1085253 recv() failed (104: Unknown error) while proxying upgraded connection, client: (my public ip), server: api.example.com, request: "GET /natsws HTTP/1.1", upstream: "http://192.168.1.41:8080/natsws", host: "api.example.com"

Rmm api log error:
2024/12/03 20:25:12 [error] 735#735: *14458 recv() failed (104: Connection reset by peer) while proxying upgraded connection, client: 192.168.1.54, server: , request: "GET /natsws HTTP/1.1", upstream: "http://127.0.0.1:9235/natsws", host: "api.example.com"

Nginx server > /etc/nginx/sites-available/rmm.conf

server {
    listen 80;
    server_name rmm.example.com api.example.com mesh.example.com;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name rmm.example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        error_log  /var/log/nginx/rmm-frontend-error.log;
        access_log /var/log/nginx/rmm-frontend-access.log;

        location / {

                proxy_pass http://192.168.1.41:80;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

        }
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name mesh.example.com;

        proxy_send_timeout 330s;
        proxy_read_timeout 330s;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_session_cache shared:WEBSSL:10m;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        error_log  /var/log/nginx/rmm-mesh-error.log;
        access_log /var/log/nginx/rmm-api-access.log;

        location / {

                proxy_pass http://192.168.1.41:4430/;
                proxy_http_version 1.1;

                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

        }

}


server {

        listen 443 ssl reuseport;
        listen [::]:443 ssl;
        server_name api.example.com;

        client_max_body_size 300M;

        error_log  /var/log/nginx/rmm-api-error.log;
        access_log /var/log/nginx/rmm-api-access.log;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        location / {

                proxy_pass http://192.168.1.41:8080/;
                proxy_http_version 1.1;

                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                uwsgi_read_timeout 300s;
                uwsgi_ignore_client_abort on;

        }
}

Rmm server > /etc/nginx/sites-available/rmm.conf

server_tokens off;

upstream tacticalrmm {
    server unix:////rmm/api/tacticalrmm/tacticalrmm.sock;
}

map $http_user_agent $ignore_ua {
    "~python-requests.*" 0;
    "~go-resty.*" 0;
    default 1;
}

server {
    listen 8080 default_server;
    listen [::]:8080 default_server;

    client_max_body_size 300M;

    access_log /rmm/api/tacticalrmm/tacticalrmm/private/log/access.log combined if=$ignore_ua;
    error_log /rmm/api/tacticalrmm/tacticalrmm/private/log/error.log;

    location /static/ {
        root /rmm/api/tacticalrmm;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
    }

    location /private/ {
        internal;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
        alias /rmm/api/tacticalrmm/tacticalrmm/private/;
    }

    location /assets/ {
        internal;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
        alias /opt/tactical/reporting/assets/;
    }

    location ~ ^/ws/ {
        proxy_pass http://unix:/rmm/daphne.sock;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
    }

    location ~ ^/natsws {
        proxy_pass http://127.0.0.1:9235;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        uwsgi_pass  tacticalrmm;
        include     /etc/nginx/uwsgi_params;
        uwsgi_read_timeout 300s;
        uwsgi_ignore_client_abort on;
    }
}

Rmm server > /etc/nginx/sites-available/frontend.conf

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    charset utf-8;

    location / {
        root /var/www/rmm/dist;
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
        add_header Pragma "no-cache";
    }

    error_log  /var/log/nginx/frontend-error.log;
    access_log /var/log/nginx/frontend-access.log;

}

Any advice on how to solve my problem would be a great help.