CSRF Problem, again, yes I read the other guides

[nicedevil007]

Description

Ok long story. I have a running Tandoor Installation in Docker and Tandoor is the last container why I have to keep my docker instance up and running. I try to get everything deployed as LXC right now on my Proxmox Hypervisor.

Main reason to switch right now is the dropped support for PostgreSQL 11 that is deprecated.
3 trys later in docker with dumping the old database, installing version 15 or 16 and so on.... just no, no more trys.

So I picked a cup of coffee and went through the manual installation guide on a LXC with Ubuntu 23.10.
Went flawless until I tried connecting over my DNS record/reverseproxy.

My hope is now, because CSRF was a problem in the past to get it working again and maybe I try to right down a small guide at the end if we get it solved.

What I have?

• NginxProxyManager 2.10.4 (short: NPM)
• Ubuntu 23.10 with installed Tandoor (followed this guide => https://docs.tandoor.dev/install/manual/)

I can create my first User (admin) with the LAN IP address put into the browser. Ofc I can also create my first Space.
Then I try the same with https://myrecipes.example.com that is handled in first place by my NPM.

The NPM Config looks like this:

Details

Note

Custom Locations

Note

SSL Settings

Note

Advanced

Note

Config Files

The nginx inside my Ubuntu got a config that looks like this:

server {
    listen 8080;
    #access_log /var/log/nginx/access.log;
    #error_log /var/log/nginx/error.log;

    # serve media files
    location /static/ {
        alias /var/www/recipes/staticfiles;
    }

    location /media/ {
        alias /var/www/recipes/mediafiles;
        #alias /media/;
    }

    location / {
        proxy_set_header Host $http_host;
        proxy_pass http://unix:/var/www/recipes/recipes.sock;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

My .env inside /var/www/recipes looks like this:

# only set this to true when testing/debugging
# when unset: 1 (true) - dont unset this, just for development
DEBUG=1
SQL_DEBUG=1
DEBUG_TOOLBAR=1
# Gunicorn log level for debugging (default value is "info" when unset)
# (see https://docs.gunicorn.org/en/stable/settings.html#loglevel for available settings)
GUNICORN_LOG_LEVEL="debug"

# HTTP port to bind to
TANDOOR_PORT=8080

# hosts the application can run under e.g. recipes.mydomain.com,cooking.mydomain.com,...
ALLOWED_HOSTS=*

# Cross Site Request Forgery protection
# (https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-CSRF_TRUSTED_ORIGINS)
# CSRF_TRUSTED_ORIGINS = []

# Cross Origin Resource Sharing
# (https://github.com/adamchainz/django-cors-header)
# CORS_ALLOW_ALL_ORIGINS = True

# random secret key, use for example `base64 /dev/urandom | head -c50` to generate one
# ---------------------------- AT LEAST ONE REQUIRED -------------------------
SECRET_KEY=****************************************************************
SECRET_KEY_FILE=
# ---------------------------------------------------------------

# your default timezone See https://timezonedb.com/time-zones for a list of timezones
TZ=Europe/Berlin

# add only a database password if you want to run with the default postgres, otherwise change settings accordingly
DB_ENGINE=django.db.backends.postgresql
# DB_OPTIONS= {} # e.g. {"sslmode":"require"} to enable ssl
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_USER=djangouser
# ---------------------------- AT LEAST ONE REQUIRED -------------------------
POSTGRES_PASSWORD=****************
POSTGRES_PASSWORD_FILE=
# ---------------------------------------------------------------
POSTGRES_DB=djangodb

# database connection string, when used overrides other database settings.
# format might vary depending on backend
# DATABASE_URL = engine://username:password@host:port/dbname

# the default value for the user preference 'fractions' (enable/disable fraction support)
# default: disabled=0
FRACTION_PREF_DEFAULT=0

# the default value for the user preference 'comments' (enable/disable commenting system)
# default comments enabled=1
COMMENT_PREF_DEFAULT=1

# Users can set a amount of time after which the shopping list is refreshed when they are in viewing mode
# This is the minimum interval users can set. Setting this to low will allow users to refresh very frequently which
# might cause high load on the server. (Technically they can obviously refresh as often as they want with their own scripts)
SHOPPING_MIN_AUTOSYNC_INTERVAL=5

# Default for user setting sticky navbar
# STICKY_NAV_PREF_DEFAULT=1

# If base URL is something other than just / (you are serving a subfolder in your proxy for instance http://recipe_app/recipes/)
# Be sure to not have a trailing slash: e.g. '/recipes' instead of '/recipes/'
# SCRIPT_NAME=/recipes

# If staticfiles are stored at a different location uncomment and change accordingly, MUST END IN /
# this is not required if you are just using a subfolder
# This can either be a relative path from the applications base path or the url of an external host
STATIC_URL=/staticfiles/

# If mediafiles are stored at a different location uncomment and change accordingly, MUST END IN /
# this is not required if you are just using a subfolder
# This can either be a relative path from the applications base path or the url of an external host
MEDIA_URL=/mediafiles/
#MEDIA_URL=/var/www/recipes/mediafiles/

# Serve mediafiles directly using gunicorn. Basically everyone recommends not doing this. Please use any of the examples
# provided that include an additional nxginx container to handle media file serving.
# If you know what you are doing turn this back on (1) to serve media files using djangos serve() method.
# when unset: 1 (true) - this is temporary until an appropriate amount of time has passed for everyone to migrate
GUNICORN_MEDIA=0

# GUNICORN SERVER RELATED SETTINGS (see https://docs.gunicorn.org/en/stable/design.html#how-many-workers for recommended settings)
# GUNICORN_WORKERS=1
# GUNICORN_THREADS=1

# S3 Media settings: store mediafiles in s3 or any compatible storage backend (e.g. minio)
# as long as S3_ACCESS_KEY is not set S3 features are disabled
# S3_ACCESS_KEY=
# S3_SECRET_ACCESS_KEY=
# S3_BUCKET_NAME=
# S3_REGION_NAME= # default none, set your region might be required
# S3_QUERYSTRING_AUTH=1 # default true, set to 0 to serve media from a public bucket without signed urls
# S3_QUERYSTRING_EXPIRE=3600 # number of seconds querystring are valid for
# S3_ENDPOINT_URL= # when using a custom endpoint like minio
# S3_CUSTOM_DOMAIN= # when using a CDN/proxy to S3 (see https://github.com/TandoorRecipes/recipes/issues/1943)

# Email Settings, see https://docs.djangoproject.com/en/3.2/ref/settings/#email-host
# Required for email confirmation and password reset (automatically activates if host is set)
# EMAIL_HOST=
# EMAIL_PORT=
# EMAIL_HOST_USER=
# EMAIL_HOST_PASSWORD=
# EMAIL_USE_TLS=0
# EMAIL_USE_SSL=0
# email sender address (default 'webmaster@localhost')
# DEFAULT_FROM_EMAIL=
# prefix used for account related emails (default "[Tandoor Recipes] ")
# ACCOUNT_EMAIL_SUBJECT_PREFIX=

# allow authentication via the REMOTE-USER header (can be used for e.g. authelia).
# ATTENTION: Leave off if you don't know what you are doing! Enabling this without proper configuration will enable anybody
#   to login with any username!
# See docs for additional information: https://docs.tandoor.dev/features/authentication/#reverse-proxy-authentication
# when unset: 0 (false)
REMOTE_USER_AUTH=0

# Default settings for spaces, apply per space and can be changed in the admin view
# SPACE_DEFAULT_MAX_RECIPES=0 # 0=unlimited recipes
# SPACE_DEFAULT_MAX_USERS=0 # 0=unlimited users per space
# SPACE_DEFAULT_MAX_FILES=0 # Maximum file storage for space in MB. 0 for unlimited, -1 to disable file upload.
# SPACE_DEFAULT_ALLOW_SHARING=1 # Allow users to share recipes with public links

# allow people to create local accounts on your application instance (without an invite link)
# social accounts will always be able to sign up
# when unset: 0 (false)
ENABLE_SIGNUP=1

# If signup is enabled you might want to add a captcha to it to prevent spam
# HCAPTCHA_SITEKEY=
# HCAPTCHA_SECRET=

# if signup is enabled you might want to provide urls to data protection policies or terms and conditions
# TERMS_URL=
# PRIVACY_URL=
# IMPRINT_URL=

# enable serving of prometheus metrics under the /metrics path
# ATTENTION: view is not secured (as per the prometheus default way) so make sure to secure it
# trough your web server (or leave it open of you dont care if the stats are exposed)
ENABLE_METRICS=1

# allows you to setup OAuth providers
# see docs for more information https://docs.tandoor.dev/features/authentication/
# SOCIAL_PROVIDERS = allauth.socialaccount.providers.github, allauth.socialaccount.providers.nextcloud,

# Should a newly created user from a social provider get assigned to the default space and given permission by default ?
# ATTENTION: This feature might be deprecated in favor of a space join and public viewing system in the future
# default 0 (false), when 1 (true) users will be assigned space and group
# SOCIAL_DEFAULT_ACCESS = 1

# if SOCIAL_DEFAULT_ACCESS is used, which group should be added
# SOCIAL_DEFAULT_GROUP=guest

# Django session cookie settings. Can be changed to allow a single django application to authenticate several applications
# when running under the same database
# SESSION_COOKIE_DOMAIN=.example.com
# SESSION_COOKIE_NAME=sessionid # use this only to not interfere with non unified django applications under the same top level domain

# by default SORT_TREE_BY_NAME is disabled this will store all Keywords and Food in the order they are created
# enabling this setting makes saving new keywords and foods very slow, which doesn't matter in most usecases.
# however, when doing large imports of recipes that will create new objects, can increase total run time by 10-15x
# Keywords and Food can be manually sorted by name in Admin
# This value can also be temporarily changed in Admin, it will revert the next time the application is started
# This will be fixed/changed in the future by changing the implementation or finding a better workaround for sorting
# SORT_TREE_BY_NAME=0
# LDAP authentication
# default 0 (false), when 1 (true) list of allowed users will be fetched from LDAP server
#LDAP_AUTH=
#AUTH_LDAP_SERVER_URI=
#AUTH_LDAP_BIND_DN=
#AUTH_LDAP_BIND_PASSWORD=
#AUTH_LDAP_USER_SEARCH_BASE_DN=
#AUTH_LDAP_TLS_CACERTFILE=
#AUTH_LDAP_START_TLS=

# Enables exporting PDF (see export docs)
# Disabled by default, uncomment to enable
ENABLE_PDF_EXPORT=1

# Recipe exports are cached for a certain time by default, adjust time if needed
# EXPORT_FILE_CACHE_DURATION=600

# if you want to do many requests to the FDC API you need to get a (free) API key. Demo key is limited to 30 requests / hour or 50 requests / day
#FDC_API_KEY=DEMO_KEY

Error message

Warning

What I already tried?

Hints from here: #452
Hints from here: #518

The proxyparts are meant for the nginx directly on ubuntu and not the NPM right? And so the default installation got this already.
What is not 100% clear to me is the /mediafiles or /media The folder that is created is called /var/www/recipes/mediafiles.
So I put in my .env the /mediafiles/ (tried it with fullpath as well /var/www/recipes/mediafiles/)

Here a screen of my installationfolder:

Note

I also tried inside the nginx recipes.conf file to switch from alias /var/www/recipes/mediafiles; to /media/;

Now I don't know what to try next. Hope someone was in the same situation before.

[smilerz]

these settings are invalid - unless you are intending to change the defaults, just comment them out.

# If staticfiles are stored at a different location uncomment and change accordingly, MUST END IN /
STATIC_URL=/staticfiles/
MEDIA_URL=/mediafiles/

Are you putting NPM in front of nginx? I think this ended up being the working NPM config.

[nicedevil007]

Yes NPM is in front of nginx. The link you posted ends up with the same error message.
Both Static/Media URL's are now commented out and my advanced config looks like this on NPM as the guy Manuel posted in Discord.

My config now

Same error with OSRF (yes I did an systemctl reload nginx)

[smilerz]

You rebuilt the tandoor container after changing .env?
Can you share your compose and container logs?

[nicedevil007]

sry nope! I thought it is enough to restart gunicorn with systemctl restart gunicorn_recipes. Now I did it with all these commands from the updating part of the documentation: https://docs.tandoor.dev/install/manual/#updating

Just to clear it up a bit, what exactly do you mean (I guess the docker one and not the one from official documentation right?)

Error still the same, right now after rebuild.

I don't use docker at all for this deployment, followed the manual guide as writte in fist post.

[smilerz]

Can you describe in detail how you have the tandoor environment setup?

[smilerz]

Ubuntu isn't an application, NPM forwarding to Ubuntu doesn't make any sense. Are you saying NPM is forwarding to nginx? Is that nginx installed natively or is it in a container?

[nicedevil007]

Ubuntu isn't an application, NPM forwarding to Ubuntu doesn't make any sense. Are you saying NPM is forwarding to nginx? Is that nginx installed natively or is it in a container?

The flow is going to the OS that is hosting Nginx and Gunicorn. Again no docker, inside the official installation guideline that I used it is installed natively.

[smilerz]

what port is nginx listening on and how is it configured?

[nicedevil007]

it seems like you didn't take care of what I have posted in my posts above. Sry I close this for now.
Doesn't make sense to me, writing all this up to answer it all again and again.

Why did I post my nginx config? Yes to answer all this questions before.

[smilerz]

I'm asking questions because the things you say don't make sense. For example, that can't possibly be right - tandoor listens on 8080.