Docker and websocket "cable"

[tomelsj]

I have successfully set up chatwoot on a self-hosted device using docker with an Apache reverse proxy. Https also seems to work, but I cannot get the websocket interface to work! Is it hosted on the same port as the web interface? I don't see anywhere in the guide (https://www.chatwoot.com/docs/self-hosted/deployment/docker) how the websocket is set up with nginx, so I assume it "just works" there.

The apache config is setup like this:

<VirtualHost` *:80>
    ServerName hostname.domain
    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
    ProxyPass /cable http://127.0.0.1:3000/cable upgrade=websocket
</VirtualHost>

<VirtualHost *:443>
    SSLEngine On
    SSLProxyEngine On
    ServerName hostname.domain
    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
    ProxyPass /cable http://127.0.0.1:3000/cable upgrade=websocket
    SSLCertificateFile /path/to/cert
    SSLCertificateKeyFile /path/to/cert.key
    SSLCertificateChainFile /path/to/cert.chain
</VirtualHost>

Here is the docker log, sadly not so much information here:

I, [2023-07-10T09:43:59.111512 #1]  INFO -- : source=rack-timeout id=22f5ce92-xxxx-xxxx-82a0-15cca0451818 timeout=15000ms service=2ms state=completed
I, [2023-07-10T09:44:59.213200 #1]  INFO -- : source=rack-timeout id=5d026244-xxxx-xxxx-8c04-d7baf2e291a7 timeout=15000ms state=ready
I, [2023-07-10T09:44:59.213886 #1]  INFO -- : [5d026244-xxxx-xxxx-8c04-d7baf2e291a7] Started GET "/cable" for xxx.xxx.xxx.xxx at 2023-07-10 09:44:59 +0000
I, [2023-07-10T09:44:59.215501 #1]  INFO -- : [5d026244-xxxx-xxxx-8c04-d7baf2e291a7] Started GET "/cable"[non-WebSocket] for xxx.xxx.xxx.xxx at 2023-07-10 09:44:59 +0000
E, [2023-07-10T09:44:59.215558 #1] ERROR -- : [5d026244-xxxx-xxxx-8c04-d7baf2e291a7] Failed to upgrade to WebSocket (REQUEST_METHOD: GET, HTTP_CONNECTION: Keep-Alive, HTTP_UPGRADE: )
I, [2023-07-10T09:44:59.215611 #1]  INFO -- : [5d026244-xxxx-xxxx-8c04-d7baf2e291a7] Finished "/cable"[non-WebSocket] for xxx.xxx.xxx.xxx at 2023-07-10 09:44:59 +0000
I, [2023-07-10T09:44:59.215727 #1]  INFO -- : source=rack-timeout id=5d026244-xxxx-xxxx-8c04-d7baf2e291a7 timeout=15000ms service=3ms state=completed

[tomelsj]

Don't know what solved it, but I put ProxyPass /cable wss://127.0.0.1:3000/cable upgrade=websocket b e f o r e ProxyPass / http://127.0.0.1:3000/ and also added a location directive:

<Location /cable>
    ProxyPass wss://127.0.0.1:3000/cable upgrade=websocket
</Location>

Anyways, works now!

[tyler-wright]

I found your post really helpful setting up my configuration, but the configuration here didn't quite work for me for a few reasons. I'm trying to setup a production instance of Chatwoot using apache as the reverse proxy. But I'm using HTTPS and certbot for the front end in addition to the standard docker setup.

Here's the configuration that worked for me, I deployed as a config file in /etc/apache2/conf-available/chatwoot-proxy.conf and then used a2enconf chatwoot-proxy.conf to enable.

<VirtualHost *:80>
    ServerName domain.tld

    ProxyPass /cable ws://127.0.0.1:3000/cable upgrade=websocket
    ProxyPassReverse /cable ws://127.0.0.1:3000/cable upgrade=websocket

    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/

    RewriteEngine on
    RewriteCond %{SERVER_NAME} =domain.tld
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
    ServerName domain.tld

    SSLEngine On
    SSLProxyEngine On
    ProxyRequests Off

    ProxyPass /cable ws://127.0.0.1:3000/cable upgrade=websocket
    ProxyPassReverse /cable ws://127.0.0.1:3000/cable upgrade=websocket

    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/

    SSLCertificateFile /etc/letsencrypt/live/domain.tld/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/domain.tld/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/domain.tld/chain.pem

    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

<Location /cable>
    ProxyPass ws://127.0.0.1:3000/cable upgrade=websocket
</Location>

There are a bunch of differences that I'll elaborate on:

1. Using ws:// - because the docker container is not looking for SSL connections to come through the reverse proxy, it doesn't expect wss:// to be the protocol, so changing to ws:// worked for me.
2. ProxyRequests - I got Error 500, Reason: Error during SSL Handshake with remote server when I didn't have ProxyRequests off despite the remainder of the configuration being correct.
3. Auto generated SSL config - the lines about Rewrite Engine in the <VirtualHost *:80> definition and the SSL certificate files and letsencrypy SSL options in <VirtualHost *:443> were added automatically by running certbot --webroot -w /var/www/ssl-proof/chatwoot/ -d yourdomain.com -i apache which I did based on the tutorial on Chatwoot's website. The problem is it seems to not include the line about SSLCertificateChainFile /etc/letsencrypt/live/domain.tld/chain.pem for some reason and so I added that back in, I don't know if this is essential
4. ProxyPassReverse - I added the ProxyPassReverse lines in based on other sources I came across troubleshooting the Error 500, but just like the SSLCertificateChainFile I dont know if this is necessasry in the config. it works, but I might remove it later and test again.

So the basic sequence I followed is:

1. mkdir -p /var/www/ssl-proof/chatwoot/.well-known
2. Create config file at /etc/apache2/conf-available/chatwoot-proxy.conf
3. certbot --webroot -w /var/www/ssl-proof/chatwoot/ -d yourdomain.com -i apache
4. Edit config file at /etc/apache2/conf-available/chatwoot-proxy.conf to match above adapted to your domain settings
5. Test and conclude

I hope this helps you as much as the above post helped me get on track.

[sojan-official]

Thanks for posting this 🙏