Summary
Hosting Mattermost (via GitLab Omnibus) on my private server works fine using multiple clients and operating systems but doesn’t work at all for some clients (Chromium, Android app, macOS App) by just showing a blank/white page or by simply stating “Cannot connect to server”.
Steps to reproduce
Ubuntu Server 22.04 with Mattermost installed via GitLab Omnibus v16.8.1.
Relevant config from gitlab.rb:
mattermost_external_url 'https://REDACTED.de:444'
mattermost['home'] = '/home/mattermost'
mattermost['gitlab_enable'] = true
mattermost['gitlab_id'] = "REDACTED"
mattermost['gitlab_secret'] = "REDACTED"
mattermost['gitlab_auth_endpoint'] = "https://REDACTED.de/gitlab/oauth/authorize"
mattermost['gitlab_token_endpoint'] = "https://REDACTED.de/gitlab/oauth/token"
mattermost['gitlab_user_api_endpoint'] = "https://REDACTED.de/gitlab/api/v4/user"
mattermost['file_directory'] = "/home/mattermost/data"
mattermost_nginx['enable'] = true
mattermost_nginx['listen_port'] = 82
mattermost_nginx['listen_https'] = false
The nginx SSL reverse proxy config for mattermost:
upstream backend {
server 127.0.0.1:82;
keepalive 32;
}
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=mattermost_cache:10m max_size=3g inactive=120m use_temp_path=off;
server {
listen 444 ssl http2;
server_name REDACTED.de;
http2_push_preload on; # Enable HTTP/2 Server Push
ssl_certificate /etc/letsencrypt/live/REDACTED.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/REDACTED.de/privkey.pem;
server_tokens off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers on;
ssl_session_tickets off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_buffer_size 8k;
ssl_stapling on;
ssl_stapling_verify on;
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "object-src 'none'; base-uri 'none'; require-trusted-types-for 'script'; frame-ancestors 'self';";
add_header Content-Security-Policy "frame-ancestors 'self';";
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
ssl_dhparam /etc/ssl/certs/dh4096.pem;
location ~ /api/v[0-9]+/(users/)?websocket$ {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 50M;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_buffers 256 16k;
proxy_buffer_size 16k;
client_body_timeout 60;
send_timeout 300;
lingering_timeout 5;
proxy_connect_timeout 90;
proxy_send_timeout 300;
proxy_read_timeout 90s;
proxy_http_version 1.1;
proxy_pass http://backend;
}
location / {
client_max_body_size 50M;
proxy_set_header Connection "";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Frame-Options SAMEORIGIN;
proxy_buffers 256 16k;
proxy_buffer_size 16k;
proxy_read_timeout 600s;
proxy_cache mattermost_cache;
proxy_cache_revalidate on;
proxy_cache_min_uses 2;
proxy_cache_use_stale timeout;
proxy_cache_lock on;
proxy_http_version 1.1;
proxy_pass http://backend;
}
}
It’s really just the recommended nginx config (Configure NGINX as a proxy for Mattermost server — Mattermost documentation) with the SSL settings from here (Secure Your Nginx Server in 2024: Achieving an A+ Rating on Qualys SSL Labs).
Expected behavior
I’d expect this to work with all clients instead of just some.
Observed behavior
I’m getting a blank screen with Chromium (macOS, Android) and the macOS app after connecting to the server (before the user login). When looking into the Chromium developer consol, I can see this structure:
Using the Android app, I cannot even connect to the server as the app will just show “Cannot connect to server”.
It works absolutely fine with Firefox 122 (macOS, Android, iOS), Safari (macOS, iOS) and the iOS app.
There were a lot of similar threads and issues but nothing did exactly fit what I’m experiencing.