Getting 400 APIErrorCode.CANT_DETERMINE_VALID_WORKSPACE

[shirkan]

Hi,
I've created a docker compose yml file as described in https://docs.fief.dev/self-hosting/deployment/docker-compose/ using postgres, checking fief server logs i see:

INFO [alembic.runtime.migration] Context impl PostgresqlImpl.
INFO [alembic.runtime.migration] Will assume transactional DDL.
Main Fief workspace already exists
Main Fief user already exists
INFO: Started server process [1]
INFO: Waiting for application startup.
2023-02-21 16:27:41.958 | INFO | fief.app:on_startup:40 - Fief Server started - {"version": "0.22.1"}
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)

yet when I try to connect on port 8000 I get this in log:

INFO: <my_ip>:64434 - "GET / HTTP/1.1" 400 Bad Request

and in the browser I see

400
APIErrorCode.CANT_DETERMINE_VALID_WORKSPACE

what am i missing?
Thanks!

[fief-bailiff[bot]]

Hail, @shirkan 👋 Welcome to Fief's kingdom!

Our team will get back to you very soon to help.

In the meantime, take a minute to star our repository ⭐️

Farewell!

[frankie567]

Hi @shirkan 👋

This error happens when Fief server was not able to determine the workspace given the hostname.

The environment variable FIEF_DOMAIN should match with the hostname you want to use to access the server. Examples:

• FIEF_DOMAIN=localhost:8000 -> Open http://localhost:8000/admin/
• FIEF_DOMAIN=fief.mydomain.com -> Open http://fief.mydomain.com/admin/

[shirkan]

Ok so I changed FIEF_DOMAIN=0.0.0.0:8000 and now I get a good response for locally running curl http://0.0.0.0:8000/admin/ - I can see in the response this is a good log in page.
Now I'm trying to set a dns name so I can connect from outside e.g. fief.mydomain.com. I'm using nginx to tunnel traffic from port 80 to 443 and add ssl cert for security. The nginx config looks like this (notice I have another server on the same instance, locally listening to port 2323 and tunneled to api.mydomain.com):

server {
    listen [::]:80;
    listen 80;
    server_name api.mydomain.com;
    return 301 https://api.mydomain.com$request_uri;
}

server {
    listen [::]:80;
    listen 80;
    server_name fief.mydomain.com;
    return 301 https://fief.mydomain.com$request_uri;
}

server {
     listen [::]:443 ssl http2;
     listen 443 ssl http2;

     server_name api.mydomain.com;

     ssl_certificate /etc/letsencrypt/live/api.mydomain.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/api.mydomain.com/privkey.pem;

    location / {
         proxy_pass http://0.0.0.0:2323;
         proxy_redirect off;
         proxy_read_timeout    90;
         proxy_connect_timeout 90;
         proxy_set_header  X-Real-IP  $remote_addr;
         proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header  Host $http_host;
     }
}

server {
     listen [::]:443 ssl http2;
     listen 443 ssl http2;

     server_name fief.mydomain.com;

     ssl_certificate /etc/letsencrypt/live/fief.mydomain.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/fief.mydomain.com/privkey.pem;

    location / {
         proxy_pass http://0.0.0.0:8080;
         proxy_redirect off;
         proxy_read_timeout    90;
         proxy_connect_timeout 90;
         proxy_set_header  X-Real-IP  $remote_addr;
         proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header  Host $http_host;
     }
}

Does this makes sense?
Do I need to change FIEF_DOMAIN to fief.mydomain.com ?
Notice I've already created certificates using letsencrypt

Thanks again!

[shirkan]

UPDATE: I changed my nginx configuration and now I'm able to access from https://fief.mydomain.com/admin/ endpoint to the dashboard. The problem is it won't load correctly and won't navigate to clients, tenants and so due to some error:
Failed to load response data: No data found for resoutce with given identifier

Can you please advise?
Thanks!

[shirkan]

UPDATE 2: I managed to solve by changing nginx config with some help in stack overflow, now it looks like it works.
Thanks again :)

[frankie567]

Great to hear!

For reference though: yes, you'll need to change FIEF_DOMAIN to fief.mydomain.com; otherwise, you'll get the same error again when accessing https://fief.mydomain.com.

Be sure also to set the environment variable FORWARDED_ALLOW_IPS=* so Fief server can trust the forwarded headers from your proxy.

[shirkan]

Be sure also to set the environment variable FORWARDED_ALLOW_IPS=* so Fief server can trust the forwarded headers from your proxy.

What a great tip, you just saved me another question as I was wondering why would the forms generate using http.
Thank you and good luck! :)