Static file over https in AWS with ECS and LoadBalancer

[Mowinski]

Static file over https in AWS with ECS and LoadBalancer

[vishalbollu]

I had a similar set up with webserver deployed on ECS behind an ALB with a cert. The static files were being served from http:// which caused issues when the rest of the webserver was using https://.

After updating the dockerfile command to

CMD ["uvicorn", "...",  "--proxy-headers", "--forwarded-allow-ips", "*"]

It started working for me - note the lack of quotes around *.

See referenced suggestion from a starlette thread: encode/starlette#538 (comment)

[onejgordon]

Thanks for your response @aminalaee, in fact we did get this working using:

class CustomUvicornWorker(UvicornWorker):
    CONFIG_KWARGS = {
        "proxy_headers": True,
        "forwarded_allow_ips": "*"
    }

[Mowinski]

Just look at your own eyes - https://app.narravia.com/admin/

Thanks guys, it is working :)
Just:
CMD ["poetry", "run", "uvicorn", "rest_api.api:app", "--host", "0.0.0.0", "--port", "8000", "--reload", "--forwarded-allow-ips", "*", "--proxy-headers"]

[aminalaee]

TBH this is a very specific deployment issue, not sure how I can help with that.
But clearly the issue is not with SQLAdmin itself rather in Uvicorn and the AWS deployment. I think you might have better chances of opening a discussion there.

[neara]

Having same issue: #721
My details: #721 (comment)

One deployment works, one doesn't. So far, looks like an issue with SQLAdmin itself. Docs app served from the same FastAPI server, knows that it's https and works properly.
I outputted the headers and sql admin app is getting the x-forwarded-proto=https, it should know to use the https urls.

Please advise what might be the issue.

[NightSkySK]

I've also had my project deployed on AWS ECS using Fargate with load balancer and I've managed to make it work with static files as well. All I did to make it work, I've change the execution command from
uvicorn main:app --reload --port 8000 --host 0.0.0.0
to
uvicorn main:app --reload --port 8000 --host 0.0.0.0 --forwarded-allow-ips='*' --proxy-headers

You need to have some other error in the configuration of your AWS infrastructure.

[neara]

I tried adding --forwarded-allow-ips='*' and --proxy-headers and still same result.
Also tried this:

CMD ["gunicorn", "app.main:app", "--workers=4", "--worker-class=app.uvcorn_worker.CustomUvicornWorker", "--bind=0.0.0.0:8000", "--forwarded-allow-ips='*'", "--proxy-allow-from='*'", "--proxy-protocol"]

with the custom worker:

from uvicorn.workers import UvicornWorker


class CustomUvicornWorker(UvicornWorker):
    CONFIG_KWARGS = {"proxy_headers": True}

All the same.

Curl on /admin returns location as http.

Headers are passed to the admin app and indicate https.

[NightSkySK]

How did you assign SSL certificates to your page. Maybe there is a problem ...

[neara]

The SSL is created via ACM, validated via DNS. Browsers trust the license.

Is there any way to force https?

[NightSkySK]

Contact me via form at https://www.mspacelock.com/contact if you wish we can do some troubleshooting via call or email and compare our configurations

[neara]

Thanks for the offer. Still don't know what's the issue exactly. I bypassed it by setting up FastAPI app with ssl + updating the target group to use https for the traffic with the container.

[acuku]

@neara what would you think of a solution where you inject a middleware on the Admin class initialization and in the dispatch method to change the scheme from http to https inside the fastapi request.
request.scope["scheme"] = "https"

[SrDonEmilio]

I'm having the same issue. I think that happens because the python project starts as HTTP, without a certificate, so the function url_for in base.html generates a url with http. The python project doesn't know that the ALB assigns a certificate.

Right now I can't try and test, but I came up with the following ideas:

1. Use custom templates, with the same login.html (and others templates) but a custom base.html

2. Manually overwrite the starlette route "admin:statics"

[onejgordon]

We're seeing this too, and it's blocking deploys to EBS/EC2 where we're using the Docker platform and running gunicorn with UvicornWorker similar to #720 (comment).

Anyone found a workaround?

[aminalaee]

@onejgordon Didn't what @vishalbollu mention work?

[aminalaee]

@Mowinski can you also confirm this has worked for you so we can close this?