Drupal and reverse proxy: How to make Drupal aware that it's protocol is HTTPS?

Question

I have a reverse proxy Docker container in front a Drupal container on a Docker host.

My reverse proxy container is https://hub.docker.com/r/jwilder/nginx-proxy

The public site URL is https://ahora-stage2.dcycleproject.org

When a request is made to https://ahora-stage2.dcycleproject.org, drupal receives the following headers. I ran dpm(\Drupal::request()->headers); using devel/php on a backend web interface:

stdClass Object ( [__CLASS__] => Symfony\Component\HttpFoundation\HeaderBag [headers:protected] => Array ( [authorization] => Array ( [0] => ) [host] => Array ( [0] => ahora-stage2.dcycleproject.org ) [connection] => Array ( [0] => close ) [x-real-ip] => Array ( [0] => 216.246.250.184 ) [x-forwarded-for] => Array ( [0] => 216.246.250.184 ) [x-forwarded-proto] => Array ( [0] => https ) [x-forwarded-ssl] => Array ( [0] => on ) [x-forwarded-port] => Array ( [0] => 443 ) [content-length] => Array ( [0] => 212 ) [accept] => Array ( [0] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 ) [content-type] => Array ( [0] => application/x-www-form-urlencoded ) [origin] => Array ( [0] => https://ahora-stage2.dcycleproject.org ) [accept-language] => Array ( [0] => en-ca                 ) [user-agent] => Array ( [0] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15 ) [referer] => Array ( [0] => https://ahora-stage2.dcycleproject.org/devel/php ) [accept-encoding] => Array ( [0] => gzip, deflate, br ) [cookie] => Array ( [0] => SESS06c9cc57c2abbd62a4b35358c6967749=zmOe3Gexxxxxxxx7238990ldZb50rMxl35yPOeM ) [x-php-ob-level] => Array ( [0] => 0 ) ) [cacheControl:protected] => Array ( ) ) 

Based on that information, https://x-team.com/blog/base_url-drupal-8/, https://medium.com/@lmakarov/drupal-8-and-reverse-proxies-the-base-url-drama-c5553cbc9a3e, and comments in the settings.php file, I put these custom settings in my Drupal settings.php file:

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = ['104.236.70.29','216.246.250.184'];

Nonetheless, Drupal always keep believing that the protol is HTTP, not HTTPS.

See enclosed image.

I'm wondering how I could set it up so that Drupal understands that it's behind a reverse proxy and that it's public URL should be served using the https protocol.

Answer 1

It turns out the IP which should be in the reverse_proxy_addresses is neither the IP which you get when you ping the domain, nor the ID in the headers which you can inspect. Rather, you need to temporarily install devel_php on your site, and then go to /devel/php and enter dpm($_SERVER['REMOTE_ADDR']);. This will give you a result such as 172.18.0.5, which then goes in $settings['reverse_proxy_addresses'];

More info at https://blog.dcycle.com/blog/170a6078/letsencrypt-drupal-docker/

Answer 2

I ran into a similar situation getting a complex site set up on DigitalOcean's App Platform: on the Drupal end, Drupal core and PHP info were seeing plain old HTTP and not HTTPS, likely due to how their services get set up - it's still HTTPS outside of your app container, but Drupal doesn't know this. It was causing various problems which led me down a rabbit hole of learning how to set up the reverse proxy stuff in Drupal core. I don't know if this solves your whole issue, but I found the Trusted Reverse Proxy module very helpful in automating parts of the configuration, namely setting the IPs that are to be trusted.