# Is AWX behind a reverse proxy actually possible? **URL:** \ **Category:** Get Help\ **Tags:** proxy, callback, awx\ **Created:** [September 20, 2023, 4:32pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964 "2023-09-20T16:32:23Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [September 20, 2023, 4:32pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/1 "2023-09-20T16:32:23Z")
Is it actually possible to place AWX behind a reverse proxy (of almost any kind) in such a way as that TLS terminates at the proxy and hands off to AWX on, say, port 80 at `example.com/awx/` so that all AWX features including callbacks work? If so, would you be willing to share your configuration? ---
**Author:** ![fosterseth](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fosterseth/32/101_2.png) [@fosterseth](https://forum.ansible.com/u/fosterseth)\ **Post date:** [September 20, 2023, 6:44pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/2 "2023-09-20T18:44:26Z")
Hi! There seems to an issue with AWX running from a non-root path, for example the /awx/ would likely cause issues with the way current AWX works see these tickets [https://github.com/ansible/awx/issues/13821](https://github.com/ansible/awx/issues/13821) [https://github.com/ansible/awx/issues/12241](https://github.com/ansible/awx/issues/12241) ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [September 20, 2023, 8:08pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/3 "2023-09-20T20:08:38Z")
Thank you, Seth. That’s a shame, but I assume we can hope it might be addressed at some point. ---
**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\ **Post date:** [September 21, 2023, 5:53am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/4 "2023-09-21T05:53:03Z")
I almost have it running. The only thing that I cannot get to work is the _Provisioning Callback_ My AWX instance is on k3s, on a single node (just for training and testing purposes, no production) I followed [https://github.com/kurokobo/awx-on-k3s/blob/main/tips/troubleshooting.md#provisioning-callback-does-not-work](https://github.com/kurokobo/awx-on-k3s/blob/main/tips/troubleshooting.md#provisioning-callback-does-not-work), but that didn’t help. awx.conf ```auto server { listen 80; server_name awx.example.net; return 301 https://awx.example.net$request_uri; } server { listen 443 ssl; server_name awx.example.net; client_max_body_size 16G; ssl_certificate /etc/tls/certificates/_.example.net.crt; ssl_certificate_key /etc/tls/certificates/_.example.net.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location /websocket/ { proxy_pass https://localhost:8443; proxy_http_version 1.1; proxy_buffering off; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade $http_upgrade; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Real-IP $remote_addr; proxy_read_timeout 86400; proxy_redirect off; proxy_ssl_verify off; proxy_ssl_session_reuse on; proxy_ssl_server_name on; } # Optional optimisation - please refer to # http://nginx.org/en/docs/http/configuring_https_servers.html # ssl_session_cache shared:SSL:10m; location / { proxy_pass https://localhost:8443; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_redirect off; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade $http_upgrade; } } ``` Traefik settings ```auto --- apiVersion: helm.cattle.io/v1 kind: HelmChartConfig metadata: name: traefik namespace: kube-system spec: valuesContent: |- hostNetwork: true ports: web: exposedPort: 8080 websecure: exposedPort: 8443 ``` Remote Host Headers ```auto [ "HTTP_TRUE_CLIENT_IP", "HTTP_X_FORWARDED_FOR", "REMOTE_ADDR", "REMOTE_HOST" ] ``` ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [September 21, 2023, 6:21am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/5 "2023-09-21T06:21:14Z")
I could paste kilometers of “almost have it running” 😜 It’s the _almost_ bit I’m worried about. ---
**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\ **Post date:** [September 21, 2023, 6:26am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/6 "2023-09-21T06:26:01Z")
Totally agree, but this was my attempt until yesterday. Today I got success. I have added ```auto proxy_set_header X-Original-Forwarded-For $remote_addr; ``` to the Nginx configuration and added `"HTTP_X_ORIGINAL_FORWARDED_FOR",` to the _Remote Host Headers_. ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [October 6, 2023, 8:59am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/7 "2023-10-06T08:59:59Z")
Can we mark this as solved @tonk? Or are you looking for some input from the AWX team on this approach? ---
**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\ **Post date:** [October 6, 2023, 9:14am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/8 "2023-10-06T09:14:16Z")
As far as I’m concerned this works, so I’m good. @jpmens is the initial question asker, if he’s good as well then you can close it. ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [October 6, 2023, 9:15am UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/9 "2023-10-06T09:15:46Z")
Oops, good catch, I’ll wait on that reply 😉 ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [October 7, 2023, 1:27pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/10 "2023-10-07T13:27:50Z")
How did you test, @tonk: 1. `example.com/awx` or 2. `awx.example.com` ? Ah, stupid question, sorry. You tested the 2nd. ---
**Author:** ![tonk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tonk/32/214_2.png) [@tonk](https://forum.ansible.com/u/tonk)\ **Post date:** [October 7, 2023, 1:40pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/11 "2023-10-07T13:40:41Z")
Indeed, the second one. It doesn’t work when you add an extra path. ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [November 6, 2023, 1:40pm UTC](https://forum.ansible.com/t/is-awx-behind-a-reverse-proxy-actually-possible/964/12 "2023-11-06T13:40:45Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.