Why this Grafana behind Nginx reverse proxy on Docker configuration is not working?

Question

I have got problem with setting up Grafana behind reverse proxy. Configuration below does not work. What's odd, I managed to get login page and login successfully a few times after a few nginx reloads. But right after login redirection to https://www.mydomain.io/grafana fails and I have got that screen with orange warning.

My configs

nginx.conf

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name www.mydomain.io;

    # SSL
    ssl_certificate /ssl/cert/...;
    ssl_certificate_key /ssl/cert/...;
    ssl_trusted_certificate /ssl/cert/...;

    location /grafana/ {
        proxy_pass http://grafana:3001/;
    }

docker-compose.yml

version: "3"
services:
    grafana:
        container_name: grafana
        image: grafana/grafana:latest
        volumes:
          - ./grafana/provisioning/:/etc/grafana/provisioning/
          - grafana_vol:/var/lib/grafana
        environment:
          - "GF_SECURITY_ADMIN_PASSWORD=pwd"
          - GF_USERS_ALLOW_SIGN_UP=false
          - GF_INSTALL_PLUGINS=grafana-piechart-panel
          - GF_SERVER_HTTP_PORT=3001
          - GF_SERVER_PROTOCOL=http
          - GF_SERVER_DOMAIN=www.mydomain.io
          - GF_SERVER_ROOT_URL=https://www.mydomain.io/grafana/
          - GF_SERVER_SERVE_FROM_SUB_PATH=true
        expose:
          - 3001
        networks:
          - my_network

volumes:
   grafana_vol:

networks:
   my_network:

pjoter · Accepted Answer · 2020-05-10 19:44:46Z

3

Ok, so I found solution. Besides given config i was importing another one where I set strict Content-Security-Policy headers.

You need to allow: script-src: 'unsafe-eval' 'unsafe-inline'; You can do it only for one location even if you already add one somewhere else (headers may be duplicated as long as they can be correctly concatenated, see: Are Duplicate HTTP Response Headers acceptable?).

Updated config contains:

location /grafana/ {
 add_header Content-Security-Policy "script-src: 'unsafe-eval' 'unsafe-inline';";
 proxy_pass http://grafana:3001/;
}

See: https://github.com/grafana/grafana/issues/6820 and https://github.com/grafana/grafana/issues/16655

answered May 10, 2020 at 19:44

pjoter

1732 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Why this Grafana behind Nginx reverse proxy on Docker configuration is not working?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related