If i put a reverse proxy for https termination infront of proget, docker client can't login because a wrong www-authenticate header. the response tries to redirect to http instead of https which isn't allowed
passed proxy headers (fetched via containous/whoami docker image)
Hostname: 68ff07e4f3c9
IP: 127.0.0.1
IP: 172.22.0.4
RemoteAddr: 172.22.0.2:60372
GET / HTTP/1.1
Host: wai-test.kriese.eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7
Cache-Control: max-age=0
Dnt: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 172.22.0.1
X-Forwarded-Host: wai-test.kriese.eu
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: ee3e7e9207a9
X-Real-Ip: 172.22.0.1
proget response header
curl -sv https://proget-test.kriese.eu/v2/
* Trying 192.168.158.122:443...
* TCP_NODELAY set
* Connected to proget-test.kriese.eu (192.168.158.122) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=kriese.eu
* start date: Sep 13 03:22:32 2020 GMT
* expire date: Dec 12 03:22:32 2020 GMT
* subjectAltName: host "proget-test.kriese.eu" matched cert's "*.kriese.eu"
* issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x564ea06937c0)
> GET /v2/ HTTP/2
> Host: proget-test.kriese.eu
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 401
< cache-control: private
< content-type: application/json
< date: Thu, 29 Oct 2020 15:17:28 GMT
< docker-distribution-api-version: registry/2.0
< server: Kestrel
< vary: Authorization
< www-authenticate: Bearer realm="http://proget-test.kriese.eu/v2/_auth",service="proget-test.kriese.eu"
< x-proget-version: 5.3.15.2
< content-length: 145
<
* Connection #0 to host proget-test.kriese.eu left intact
{"errors":[{"code":"UNAUTHORIZED","message":"Anonymous is not permitted to perform the Feeds_ViewFeed task for the current scope.","detail":[]}]}
traefik/traefik#6047
