incorrect node information and api browser link incorrect

[jalogisch]

desription

if you have a chained Proxy Setup for HTTPS (like in the image)

• you did not get node based data in System / Nodes (all Nodes show the same data)
• the API Browser link is displayed wrong.

Not sure if this is related to #2359 and/or #1576

configuration

Apache Loadbalancer Setup

<VirtualHost *:443>
    ServerName H1

    SSLEngine On
    SSLProxyEngine On
    SSLCertificateFile conf.d/tls/server.pem
    SSLCertificateChainFile conf.d/tls/server.pem

    <Proxy balancer://web>
        BalancerMember "https://H2"
        BalancerMember "https://H3"
    </Proxy>
    ProxyPass        / balancer://web/
    ProxyPassReverse / balancer://web/
</VirtualHost>

Apache Setup on Graylog System

<VirtualHost *:443>
    ServerName H2
    DefaultType None
    SSLEngine On
    SSLCertificateFile conf.d/tls/server.pem
    SSLCertificateChainFile conf.d/tls/server.pem
   <Location /api/>
        ProxyPass http://localhost:12900/
        ProxyPassReverse http://localhost:12900/
    </Location>
    <Location />
        RequestHeader set X-Graylog-Server-URL "https://H1/api/"
        ProxyPass http://localhost:9000/
        ProxyPassReverse http://localhost:9000/
    </Location>
</VirtualHost>

Graylog Server Conf for Web and API

rest_listen_uri = http://127.0.0.1:12900/
web_enable = true
web_listen_uri = http://127.0.0.1:9000/

Environment

• Graylog Version: 2.0.X

[joschi]

@jalogisch How (and on which page exactly) is the link to the API Browser wrong?

[jalogisch]

if you request the page via H1 LB the Link (when you use the API Browser button) is http://127.0.0.1:12900/api-browser

[joschi]

@jalogisch rest_transport_uri must point to the accessible (!) address of each Graylog node. Otherwise the proxying node will always request the node information from rest_listen_uri (which points to localhost in this specific case).

[jalogisch]

As by design each individual API need to be accessible by the browser it is not possible to have them all covered behind a load balance and separated by network design.

The requested feature is not possible and i will close this issue.