nginx proxy configuration causes 400 bad requests

[BlackZork]

Describe the bug

RabbitMQ 3.11.16 Erlang 25.3

I enabled management plugin and used https://www.rabbitmq.com/management.html#http-api-proxy to configure access behind nginx proxy.

In this configuration I cannot open user page (admin -> users -> click on user).

Http log from plugin:

192.168.88.7 - sds [17/May/2023:10:36:06 +0200] "GET /api/users/%2F/guest HTTP/1.0" 400 0 "https://myhost/rabbitmq/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"

I changed nginx config like this:

location /rabbitmq {
    proxy_pass http://myhost:15672/;
    rewrite ^/rabbitmq/(.*)$ /$1 break;
}

.. and user management starts to work.

Http log from plugin:

192.168.88.7 - sds [17/May/2023:10:46:29 +0200] "GET /api/users/guest HTTP/1.0" 200 173 "https://myhost/rabbitmq/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"

But after this change I cannot open queue details:

192.168.88.7 - sds [17/May/2023:11:02:36 +0200] "GET /api/queues/dead_letter_queue HTTP/1.0" 404 0 "https://myhost/rabbitmq/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"

I have to use original example for queuest to work. What is the correct way to put ui managment behind nginx?

Reproduction steps

See description

Expected behavior

Need valid example for nginx proxy.

Additional context

No response

[michaelklishin]

We cannot provide a one-size-fits-all kind of answer.

If you rename your default virtual host to not be a slash, it will not be encoded in the URI and no additional configuration will be necessary for the proxying locations.

docker-library/rabbitmq#173 describes this in more detail.

Another important thing would be to make anyone pass on the basic auth header, I am not sure if it does so by default.

[michaelklishin]

Also, /rabbitmq is not a prefix that RabbitMQ uses. By default it is /api and it must be proxied.

I cannot suggest much more with just a single location provided.

[BlackZork]

If default configuration creates virtual host "/" then docs should provide working nginx example for this configuration. Or better, a configuration that works regardless of virtual host name.

This configuration seems to work ok for vhost '/'

        # https://dev.to/davedodea/bytesize-rabbitmq-management-ui-and-nginx-4ob9
        location /rabbitmq/api/ {
            rewrite ^ $request_uri;
            rewrite ^/rabbitmq/api/(.*) /api/$1 break;
            return 400;
            proxy_pass http://myhost:15672$uri;
        }

        location /rabbitmq {
            rewrite ^/rabbitmq$ /rabbitmq/ permanent;
            rewrite ^/rabbitmq/(.*)$ /$1 break;
            proxy_pass http://myhost:15672;
            proxy_buffering                    off;
            proxy_set_header Host              $http_host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

I did not test it for other virtual hosts.

[michaelklishin]

I'd be happy to test it and update the docs but I do not understand the intent of returning 400 after the rewrites.

[BlackZork]

I think it is redundant, because second rewrite will always match.