Port-forwarded https access without subdomain issues

Troubleshooting
1

Hello! I've been working with Silverbullet and it's been incredible so far, but i wanted to make use of the pwa features by connecting through https. Problem is, the closest thing to a domain name I have is Tailscale's MagicDNS, which does not allow for subdomains. My current approach has port 3001 used by nginx to add an SSL certificate and then forward to port 3000, and this works for the most part, however a few things don't. Specifically, any calls to /session are met with a 403-FORBIDDEN with reason "cross-origin dashboard request denied". What ways do I have to work around this?

Ps: I'd rather not buy a proper domain, both for money reasons and because my setup isn't solid enough to be exposed to the internet (currently all requests to my services are denied if not coming from inside my Tailscale VPN)

2

Hi,

I have a similar setup and do it as follows - hopefully you can find what may be missing and configure it in Nginx:

  1. I run Caddy and have this block below in my Caddyfile. I also run SilverBullet as a Tailscale service with tailscale serve --service=svc:silverbullet --https=443 127.0.0.1:8080 (8080 being the host port that maps to Caddy's Docker port)
  2. In SilverBullet dashboard > Admin , my Primary URL is https://silverbullet.tailxyz.ts.net
  3. In SilverBullet dashboard > Spaces > My Space, Hostname is set to the primary hostname from step 2, and I use a prefix of /notes. I see this in the dropdown in the dashboard but in the spaces.json it doesn't set one at all.
  4. I then access my space on https://silverbullet.tailxyz.ts.net/notes

I think for Nginx you need to add proxy_set_header X-Forwarded-Proto $scheme; and proxy_set_header Host $http_host; so SilverBullet knows the request came in over HTTPS and sees your host:3001 and not just host.

Caddyfile:

http://silverbullet.tailxyz.ts.net {
        reverse_proxy silverbullet:3000
}
3

I'm exposing several services only within my Zerotier network, and I use a free DuckDNS domain that resolves to my server's internal network IP. I believe that the certbot challenge can only be DNS in this case.

Silverbullet is then exposed to a dedicated port, it doesn't even need a subdomain, e.g. https://mydomain.duckdns.org:1234.

I also run nginx, I can share details of you are interested.

4

You sir are a lifesaver, thank you!

5

Glad this got sorted. For anyone who lands here later with the same nginx-on-a-non-standard-port setup: the "cross-origin ... request denied" kind of 403 usually comes from the backend comparing the Origin header (which includes :3001) with the Host it sees, and nginx's default proxy_set_header Host $host drops the port. In my nginx configs, switching to

proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;

(plus the Upgrade/Connection headers if you need websockets) is normally what makes the two match again. Setting the primary URL in the dashboard to the exact https://name:3001 address you open in the browser, like @vxnick described, covers the app side.