fix(terminal): support same-origin WebSocket for Cloudflare tunnel#498
Draft
simonjcarr wants to merge 1 commit intomainfrom
Draft
fix(terminal): support same-origin WebSocket for Cloudflare tunnel#498simonjcarr wants to merge 1 commit intomainfrom
simonjcarr wants to merge 1 commit intomainfrom
Conversation
The browser-side terminal used to connect directly to the absolute INGEST_WS_URL (ws://host:8080). Behind a Cloudflare tunnel only the web app's hostname is publicly reachable, so the direct ingest port is unreachable from a remote browser and the terminal never attaches. INGEST_WS_URL now accepts an empty value: the server action returns a path-only /ws/terminal/<id> URL and the browser resolves it against window.location, so the WebSocket traverses the same tunnel/reverse proxy as the rest of the web traffic. Absolute URLs still work unchanged. http(s):// is rewritten to ws(s):// for convenience. Docs updated with Cloudflare Tunnel, nginx, and Caddy routing examples for /ws/terminal/* and a troubleshooting checklist.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When CT-Ops is accessed through a Cloudflare tunnel (or any reverse proxy that only exposes the web app's hostname), the in-app terminal never connects. The browser reads
INGEST_WS_URLfrom the server action and opens the WebSocket directly to that URL — but a tunnel typically only fronts the web app on port 3000, so the absolutews://host:8080URL is unreachable from a remote browser.This PR adds a same-origin mode so the WebSocket can traverse the same tunnel as the rest of the web traffic.
Changes
apps/web/lib/actions/terminal.ts— ifINGEST_WS_URLis blank, the server action returns a path-only URL (/ws/terminal/<id>). Absolute URLs still work unchanged.http(s)://values are rewritten tows(s)://for convenience.apps/web/components/terminal/terminal-session.tsx— when the returned URL is path-only, the browser resolves it againstwindow.location(pickingwss:for HTTPS pages,ws:for HTTP).docker-compose.single.yml— switched the default operator from:-to-so an explicit emptyINGEST_WS_URLin.envis no longer silently replaced with the localhost default. Existing deployments are unchanged..env.example— documents the two modes (direct vs. same-origin reverse proxy).apps/docs/docs/features/terminal.md— new "Deployment: Reverse Proxies and Cloudflare Tunnels" section withcloudflared, nginx, and Caddy examples, plus a troubleshooting checklist.How to use behind a Cloudflare tunnel
/ws/terminal/*tolocalhost:8080(full example in the docs).INGEST_WS_URL=(empty) in.envand restart the web container.wss://<tunnel-host>/ws/terminal/<id>, which goes through the same tunnel.Absolute
INGEST_WS_URLvalues remain the default, so existing LAN deployments are unaffected.Test plan
INGEST_WS_URL=ws://<lan-ip>:8080) — terminal still connects directlyINGEST_WS_URL=and path-based ingress rule — terminal connects viawss://<tunnel-host>/ws/terminal/.../ws/terminal/upstream to ingest:8080 — terminal connectsINGEST_WS_URL=https://...andhttp://...normalised towss:///ws://pnpm run build(TypeScript) — cleango build ./...inapps/ingest— clean