Replacing Nginx with Traefik caused Django to use admin files via HTTP instead of HTTPS, breaking functionality

Question

I had a perfectly fine Django CMS 3.4.1 setup running behind Nginx as an edge-server with SSL termination. The complete chain was:

nginx (SSL) → nginx (django server) → gunicorn → django

All I did was to replace the first nginx reverse proxy with traefik, for a better integration of other services. Everything is run with docker (compose)

The issue is, that Django now wants to redirect HTTPS calls to admin files (and ajax calls) to HTTP, breaking functionality because those files are blocked by the browser. I did not change anything with the django installation. In fact, it even is the same docker image as before.

Because it did work with the old setup, I don't think that it is an issue with the Django CMS code using hardcoded http://. SSL was terminated before the django reverse proxy, as well.

Does anyone see something I am missing?

Here are some configuration files, from top to bottom:

traefic.yml:

global:
  sendAnonymousUsage: false

api:
  dashboard: true
  insecure: true

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    watch: true
    exposedByDefault: false

log:
  level: INFO
  format: common

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"

certificatesResolvers:
  letsencrypt:
    acme:
      email: ***
      storage: /etc/acme/acme.json
      httpChallenge:
        entryPoint: http

relevant parts of django-server docker-compose file:

# ...
services:

  cms-nginx:
    build: "./nginx"
    depends_on:
      - postgres
    networks:
      - proxy
      - cms
    volumes:
      - cms_static:/usr/src/app/static
      - cms_media:/usr/src/app/media
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"
      - "traefik.http.routers.cms.rule=Host(`***`)"
      - "traefik.http.routers.cms.tls=true"
      - "traefik.http.routers.cms.tls.certresolver=letsencrypt"

  cms:
    restart: always
    build: ./cms
    links:
      - postgres:postgres
      - static:static
    expose:
      - "8000"
    volumes:
      - ./cms:/usr/src/app
      - static_out:/usr/src/app/data/generated
      - cms_static:/usr/src/app/data/static
      - cms_media:/usr/src/app/data/media
    depends_on:
      - static
    env_file:
      - .env
      - ./cms/.env
    command: /bin/sh -c "./docker-init.sh"
    networks:
      - cms

django server nginx conf:

server {

    listen 80;
    server_name *** default_server;
    charset utf-8;

    client_max_body_size 75M;

    location ^~ /static/ {
        alias /usr/src/app/static/;
    }

    location ^~ /media/ {
        alias /usr/src/app/media/;
    }

    location / {
        proxy_pass http://cms:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Protocol $scheme;
    }

    error_log /var/log/nginx/deckel_error.log;
}

gunicorn start command:

/usr/local/bin/gunicorn cms.wsgi:application -w 2 -b :8000

django settings part:

SESSION_COOKIE_SECURE = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')
CSRF_COOKIE_SECURE = True
SECURE_SSL_REDIRECT = True

Replacing Nginx with Traefik caused Django to use admin files via HTTP instead of HTTPS, breaking functionality

0 Answers0