How to configure the proget free with self-connector

rhessinger

ProGet free edition only supports self-connectors when they connect directly to ProGet. If you bypass the proxy, that should resolve the license violations for you.

Thanks,
Rich

viceice

Can i simply use http://localhost instead of my real https://proget.xxxx.com ?

I've configured https://proget.xxxx.com as Web.BaseUrl.

rhessinger

Hi @viceice,

You should be able to use http://localhost or http://<PROGET_IP_ADDRESS> in your connector without issue. Please give that a try and let me know if you run into any issues.

Thanks,
Rich

viceice

Nope, the http://localhost/nuget/Release/v3/index.json points back to the public url, and proget will follow and use the https reverse proxy again.

So i again get the error.

viceice

now trying again with Web.BaseUrl set to empty.

so the index.json looks like for http://localhost

{
    "version": "3.0.0",
    "resources": [{
            "@id": "http://localhost/nuget/Release/v3/search",
            "@type": "SearchQueryService",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/search",
            "@type": "SearchQueryService/3.0.0-rc",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/search",
            "@type": "SearchQueryService/3.0.0-beta",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService/3.0.0-rc",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService/3.0.0-beta",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl/3.0.0-rc",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl/3.0.0-beta",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations-gz/",
            "@type": "RegistrationsBaseUrl/3.4.0",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations-gz/",
            "@type": "RegistrationsBaseUrl/3.6.0",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "http://localhost/nuget/Release/v3/flatcontainer",
            "@type": "PackageBaseAddress/3.0.0",
            "comment": "Base URL of where NuGet packages are stored, in the format https://api.nuget.org/v3-flatcontainer/{id-lower}/{version-lower}/{id-lower}.{version-lower}.nupkg"
        }, {
            "@id": "http://localhost/feeds/Release/{id}/{version}",
            "@type": "PackageDetailsUriTemplate/5.1.0",
            "comment": "URI template used by NuGet Client to construct details URL for packages"
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations/{id-lower}/index.json",
            "@type": "PackageDisplayMetadataUriTemplate/3.0.0-rc",
            "comment": "URI template used by NuGet Client to construct display metadata for Packages using ID"
        }, {
            "@id": "http://localhost/nuget/Release/v3/registrations/{id-lower}/{version-lower}.json",
            "@type": "PackageVersionDisplayMetadataUriTemplate/3.0.0-rc",
            "comment": "URI template used by NuGet Client to construct display metadata for Packages using ID, Version"
        }, {
            "@id": "http://localhost/nuget/Release/",
            "@type": "LegacyGallery"
        }, {
            "@id": "http://localhost/nuget/Release/",
            "@type": "LegacyGallery/2.0.0"
        }, {
            "@id": "http://localhost/nuget/Release/package",
            "@type": "PackagePublish/2.0.0"
        }
    ]
}

and for https://proget.xxx.com

{
    "version": "3.0.0",
    "resources": [{
            "@id": "https://proget.xxx.com/nuget/Release/v3/search",
            "@type": "SearchQueryService",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/search",
            "@type": "SearchQueryService/3.0.0-rc",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/search",
            "@type": "SearchQueryService/3.0.0-beta",
            "comment": "Query endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService/3.0.0-rc",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/autocomplete",
            "@type": "SearchAutocompleteService/3.0.0-beta",
            "comment": "Autocomplete endpoint of NuGet Search service"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl/3.0.0-rc",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations/",
            "@type": "RegistrationsBaseUrl/3.0.0-beta",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations-gz/",
            "@type": "RegistrationsBaseUrl/3.4.0",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations-gz/",
            "@type": "RegistrationsBaseUrl/3.6.0",
            "comment": "Base URL of Azure storage where NuGet package registration info is stored in GZIP format. This base URL includes SemVer 2.0.0 packages."
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/flatcontainer",
            "@type": "PackageBaseAddress/3.0.0",
            "comment": "Base URL of where NuGet packages are stored, in the format https://api.nuget.org/v3-flatcontainer/{id-lower}/{version-lower}/{id-lower}.{version-lower}.nupkg"
        }, {
            "@id": "http://proget.xxx.com/feeds/Release/{id}/{version}",
            "@type": "PackageDetailsUriTemplate/5.1.0",
            "comment": "URI template used by NuGet Client to construct details URL for packages"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations/{id-lower}/index.json",
            "@type": "PackageDisplayMetadataUriTemplate/3.0.0-rc",
            "comment": "URI template used by NuGet Client to construct display metadata for Packages using ID"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/v3/registrations/{id-lower}/{version-lower}.json",
            "@type": "PackageVersionDisplayMetadataUriTemplate/3.0.0-rc",
            "comment": "URI template used by NuGet Client to construct display metadata for Packages using ID, Version"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/",
            "@type": "LegacyGallery"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/",
            "@type": "LegacyGallery/2.0.0"
        }, {
            "@id": "https://proget.xxx.com/nuget/Release/package",
            "@type": "PackagePublish/2.0.0"
        }
    ]
}

here the PackageDetailsUriTemplate/5.1.0 type is using http instead of https

atripp

The NuGet API does require absolute URLS to be returned, hence this behavior. And since the IP address changes (we check for local requests using HttpRequest.IsLocal, which basically just looks for 127.0.0.1), the license violation triggers.

Instead of using the Web.BaseUrl property, you could configure your proxy to use the X-Forwarded-* headers. I attached the code for how the URL is constructed in ProGet, and how these headers work.

    var baseUrl = ProGetConfig.Web.BaseUrl;
    if (string.IsNullOrEmpty(baseUrl))
    {
        var request = HttpContextThatWorksOnLinux.Current?.Request;
        if (request != null)
        {
            var requestUrl = request.Url;

            var forwardedHost = request.Headers["X-Forwarded-Host"];
            int? forwardedPort = AH.ParseInt(request.Headers["X-Forwarded-Port"]);
            var forwardedProtocol = request.Headers["X-Forwarded-Proto"];

            var host = AH.CoalesceString(forwardedHost, requestUrl.Host);
            var protocol = AH.CoalesceString(forwardedProtocol, requestUrl.Scheme);
            int port = forwardedPort ?? requestUrl.Port;

            var uri = new UriBuilder(protocol, host, port);
            if (uri.Uri.IsDefaultPort)
                uri.Port = -1;

            baseUrl = uri.ToString();
            if (!baseUrl.EndsWith("/"))
                baseUrl += "/";
        }
        else
        {
            baseUrl = "/";
        }
    }
    else
    {
        baseUrl = baseUrl.TrimEnd('/') + "/";
    }

viceice

yes, I'm already passing the proxy headers and it basically works.

Only the PackageDetailsUriTemplate url in index.json now points to http instead of https. So i think there is a small bug.

rhessinger

Hi @viceice,

Is your proxy passing X-Forwarded-Proto also? That should be passing https. You could try hard coding that in the proxy.

Thanks,
Rich

viceice

Yes, i think so, using traefik as reverse proxy.

as you can see in above posted json most urls look right, only PackageDetailsUriTemplate has http instead of https protocol.

I also see no new Licensing Violations since friday. Editing and saving license key does not remove the red banner.

rhessinger

Hi @viceice,

Can you please confirm your connector URL contains the https? How is ProGet setup? Is it installed on windows? Are you using IIS? It might be easier to add an SSL binding in IIS for this as well.

Thanks,
Rich

viceice

I'm using the docker linux version with default settings. then i added traefik as https reverse proxy with ssl ofload. it will pass the normal X-Forwarded- http headers, which seem to work correct.

if i download the index.json only one of the urls is missing the https prefix and uses http. So because only one url is wrong i assume a bug on the PackageDetailsUriTemplate url generation.

rhessinger

Hi @viceice,

Thanks for the clarification on your environment! I see what is going on now. I have created a ticket, PG-1809, to track the fix for this. We expect this to be released in ProGet 5.3.11 which we are expecting to be released in September 11, 2020. Basically in that instance, we are not respecting the values within the X-Forwarded-* headers. I'll let you know if anything changes on the timeline.

Thanks,
Rich