What I need to achieve is normal users can login and chat using https (secure), while gitlab webhook able to send notification to Mattermost using http.
Mattermost can’t serve both http and https at the same time on its own, but you can do it through a proxy. To do this you’d need:
Mattermost serving http over some port other than 80 or 443 (we use 8065 by default)
A proxy configured to forward the following to Mattermost:
Any https connection on port 443
Any http connection to /hooks/* on port 80
I’m not sure if our documentation is applicable to Google Cloud Platform, but we have instructions for setting up NGINX included in our setup guides which will get you through everything but allowing the webhook connections on port 80. That’ll require some additional work.
Thanks for the suggestion, the redirection in nginx seems working fine if a user key in http://food.3lc.my (Mattermost URL) and it will be redirected to https://food.3lc.my:8065.
Now seems like redirect from http to https are fine, but when I use the same method to apply in gitlab webhook to Mattermost, it didn’t work.
Let’s say I’ve Mattermost webhook URL generated like https://food.3lc.my:8065/hooks/xxxxxx , I copied this URL in my Gitlab and modified it become http://food.3lc.my/hooks/xxxxxx since the redirection works.
No error messages displayed in Gitlab, but the webhook just didn’t work.
To make it clear, I have the following settings in my environment:
If you’re using NGINX, you’ll want to have Mattermost serving plain http with NGINX in front of it to receive and handle the https and non-https connections. Mattermost should only be accessible via NGINX, and NGINX can deal with which connections should be allowed. Your configuration should look something like
# nginx config
upstream backend {
server <internal_mattermost_address>:8065;
}
server {
listen 80;
server_name <external_address>;
# don't include the 301 redirect here like you had previously
location ~ /hooks/[a-z0-9]+$ {
...
proxy_pass http://upstream; # allow webhook traffic to Mattermost over plain http
}
location / {
...
return 301 https://$server_name$request_uri; # redirect all other https traffic to http
}
}
server {
listen 443;
server_name <external_address>;
# don't include the 301 redirect here like you had previously
ssl on;
...
location ~ /api/v[0-9]+/(users/)?websocket$ {
...
}
location / {
...
proxy_pass http://upstream; # pass https traffic to Mattermost
}
}
Note that I don’t have a ton of experience with setting up proxies so I may have missed something, but this general structure should probably work.