Problem accessing spreedme through nginx about nextcloud-spreedme HOT 54 CLOSED

global
        log  /dev/log  local1 debug      #warning
        #log  127.0.0.1  #local1 notice
        maxconn  4096
        uid  0
        gid  0
        daemon
        ssl-default-bind-options no-sslv3

defaults
        log   global
        mode  http
        option  httplog
        option  httpclose
        option  dontlognull
        #option forwardfor
        retries  3
        #option http-use-proxy-header
        option  redispatch
        #option  http-server-close
        maxconn  2000
        timeout  connect 61s
        timeout  client 50s
        timeout  server 50s

listen HAProxy-Statistics
        bind *:3307
        mode http
        option httplog
        option httpclose
        stats enable
        stats uri /haproxy?stats
        stats refresh 20s
        stats show-node
        stats show-legends
        stats show-desc Workaround haproxy for SSL
        stats auth zzzzzzzzzzzzzzzzzzzzzzzzzzzzz

frontend fe_sni_ssl
        bind :443
        log global 
        mode tcp
        option tcplog
        tcp-request inspect-delay 10s
        tcp-request content accept if { req_ssl_hello_type 1 }
        acl chk_sandcats req_ssl_sni -m sub yyyyyy.sandcats.io 
        use_backend be_sandcats if chk_sandcats
        use_backend be_vxn  if { req_ssl_sni -m sub vpn.xxxxxxx.net }
        use_backend be_wxn  if { req_ssl_sni -m sub -i webrtc.xxxxxxx.net }
        default_backend be_routing

backend be_sandcats
        mode tcp
        log global
        server sr_sandcats_ssl  192.168.6.5:7443 

backend be_vxn
        mode tcp
        log global
        stick-table type binary len 32 size 30k expire 30m
        acl clienthello req_ssl_hello_type 1
        acl serverhello rep_ssl_hello_type 2
        tcp-request inspect-delay 5s
        tcp-request content accept if clienthello
        tcp-response content accept if serverhello
        stick on payload_lv(43,1) if clienthello
        stick store-response payload_lv(43,1) if serverhello 
        option ssl-hello-chk
        server nas_ssl          192.168.6.21:443

backend be_nxn
        mode tcp
        log global
        stick-table type binary len 32 size 30k expire 30m
        acl clienthello req_ssl_hello_type 1
        acl serverhello rep_ssl_hello_type 2
        tcp-request inspect-delay 5s
        tcp-request content accept if clienthello
        tcp-response content accept if serverhello
        stick on payload_lv(43,1) if clienthello
        stick store-response payload_lv(43,1) if serverhello 
        option ssl-hello-chk
        server sr_nextcloud_ssl 192.168.6.5:443

backend be_wxn
        mode tcp
        log global
        stick-table type binary len 32 size 30k expire 30m
        acl clienthello req_ssl_hello_type 1
        acl serverhello rep_ssl_hello_type 2
        tcp-request inspect-delay 5s
        tcp-request content accept if clienthello
        tcp-response content accept if serverhello
        stick on payload_lv(43,1) if clienthello
        stick store-response payload_lv(43,1) if serverhello 
        option ssl-hello-chk
        server sr_core_webrtc   192.168.6.5:5443

backend be_routing
        mode tcp
        log global
        stick-table type binary len 32 size 30k expire 30m
        acl clienthello req_ssl_hello_type 1
        acl serverhello rep_ssl_hello_type 2
        tcp-request inspect-delay 5s
        tcp-request content accept if clienthello
        tcp-response content accept if serverhello
        stick on payload_lv(43,1) if clienthello
        stick store-response payload_lv(43,1) if serverhello 
        option ssl-hello-chk
        use-server sr_vpn           if { req_ssl_sni -m sub -i vpn.xxxxxxx.net }
        server sr_vpn                   192.168.6.21:443 weight 0
        use-server sr_owncloud_ssl  if { req_ssl_sni -m sub -i oc.xxxxxxx.net }
        server sr_owncloud_ssl          127.0.0.1:444   weight 0
        use-server sr_xn_ssl        if { req_ssl_sni -m sub -i xxxxxxx.net }
        server sr_xn_ssl                127.0.0.1:444   weight 0
        use-server sr_xo_ssl        if { req_ssl_sni -m sub -i xxxxxxx.org }
        server sr_xo_ssl                127.0.0.1:444   weight 0
        use-server sr_localhost_ssl if { req_ssl_sni -m sub -i yyyy.zzzzz.nl }
        server sr_localhost_ssl         127.0.0.1:444   weight 0
        use-server sr_nxn           if { req_ssl_sni -m sub -i nc.xxxxxxx.net }
        server sr_nxn                   192.168.6.5:443 weight 0
        use-server sr_wxn           if { req_ssl_sni -m sub -i webrtc.xxxxxxx.net }
        server sr_wxn                   192.168.6.5:5443 weight 0
        use-server sr_bosh          if { req_ssl_sni -m sub -i bosh.xxxxxxx.net }
        server sr_bosh                  127.0.0.1:5281  weight 0
        use-server sr_xmpp          if { req_ssl_sni -m sub -i xmpp.xxxxxx.net }
        server sr_xmpp                  127.0.0.1:5223  weight 0

  upstream php-handler {
    #server unix:/var/run/php5-fpm.sock;
    # or
    server 127.0.0.1:9000;
  }

  map $http_upgrade $connection_upgrade {
          default upgrade;
          ''      close;
  }

  server {
    listen  192.168.6.5:443 ssl http2;
    server_name nc.xxxxxxx.net;
    #proxy set_header Host nc.xxxxxxx.net:443 ;

    ssl_certificate /etc/letsencrypt/live/www.xxxxxxx.net/fullchain.pem ; 
    ssl_certificate_key /etc/letsencrypt/live/www.xxxxxxx.net/privkey.pem ;

    # Add headers to serve security related headers
    # Before enabling Strict-Transport-Security headers please read into this
    # topic first.
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

    # Path to the root of your installation
    root /var/www/nc.xxxxxxx.net/htdocs/;

    location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
    }

    location = /data/htaccesstest.txt {
      allow all;
      log_not_found off;
      access_log off;
    }

    # The following 2 rules are only needed for the user_webfinger app.
    # Uncomment it if you're planning to use this app.
    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
    # last;

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }
    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    # set max upload size
    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    # Disable gzip to avoid the removal of the ETag header
    gzip off;

    # Uncomment if your server is build with the ngx_pagespeed module
    # This module is currently not supported.
    #pagespeed off;

    error_page 403 /core/templates/403.php;
    error_page 404 /core/templates/404.php;

    location / {
      rewrite ^ /index.php$uri;
    }

    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
      deny all;
    }

    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
      deny all;
    }

    location ~ ^/http-bind/ {
      proxy_pass http://firewall:5280 ;
    }

    # Spreed WebRTC
    location ^~ /webrtc {
        proxy_pass http://127.0.0.1:5080;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_buffering             on;
        proxy_ignore_client_abort   off;
        proxy_redirect              off;
        proxy_connect_timeout       90;
        proxy_send_timeout          90;
        proxy_read_timeout          90;
        proxy_buffer_size           4k;
        proxy_buffers               4 32k;
        proxy_busy_buffers_size     64k;
        proxy_temp_file_write_size  64k;
        proxy_next_upstream         error timeout invalid_header http_502 http_503 http_504;
    }

    # cache_purge (with $http_cookies we have unique keys for the user)
    fastcgi_cache_key $http_cookie$request_method$host$request_uri;
    fastcgi_cache_use_stale error timeout invalid_header http_500;
    fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
      fastcgi_split_path_info ^(.+\.php)(/.*)$;

      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param PATH_INFO $fastcgi_path_info ;
      fastcgi_param HTTPS on;
      fastcgi_pass php-handler;
      }

    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
      try_files $uri/ =404;
      index index.php;
    }

    # Adding the cache control header for js and css files
    # Make sure it is BELOW the PHP block
    location ~* \.(?:css|js)$ {
      try_files $uri /index.php$uri$is_args$args;
      add_header Cache-Control "public, max-age=7200";
    # removed because they are added twice... causing warnings
    # Add headers to serve security related headers (It is intended to
    # have those duplicated to the ones above)
    # Before enabling Strict-Transport-Security headers please read into
    # this topic first.
    # add_header Strict-Transport-Security "max-age=15768000;
    #  includeSubDomains; preload;";
    #  add_header X-Content-Type-Options nosniff;
    #  add_header X-Frame-Options "SAMEORIGIN";
    #  add_header X-XSS-Protection "1; mode=block";
    #  add_header X-Robots-Tag none;
    #  add_header X-Download-Options noopen;
    #  add_header X-Permitted-Cross-Domain-Policies none;
    # Optional: Don't log access to assets
      access_log off;
    }

    location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
      try_files $uri /index.php$uri$is_args$args;
      # Optional: Don't log access to other assets
      access_log off;
    }

  }

log_format upgrade '$request $status .$http_upgrade. $connection_upgrade';

GET /ws HTTP/1.1 101 .websocket. upgrade

bind *:443 ssl crt /etc/ssl/dummy.pem alpn h2,http/1.1

Chrome 49 / XP SP3  RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Chrome 51 / Win 7  R    RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 31.3.0 ESR / Win 7  RSA 2048 (SHA256)   TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 47 / Win 7  R   RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 49 / XP SP3 RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Firefox 49 / Win 7  R   RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Googlebot Feb 2015  RSA 2048 (SHA256)   TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
IE 6 / XP   No FS 1   No SNI 2  Server closed connection
IE 7 / Vista    RSA 2048 (SHA256)   TLS 1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   ECDH secp256r1  FS
IE 8 / XP   No FS 1   No SNI 2  Server closed connection
IE 8-10 / Win 7  R  RSA 2048 (SHA256)   TLS 1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   ECDH secp256r1  FS
IE 11 / Win 7  R    RSA 2048 (SHA256)   TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   ECDH secp256r1  FS
IE 11 / Win 8.1  R  RSA 2048 (SHA256)   TLS 1.2 > http/1.1      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   ECDH secp256r1  FS
IE 10 / Win Phone 8.0   RSA 2048 (SHA256)   TLS 1.0 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA   ECDH secp256r1  FS
IE 11 / Win Phone 8.1  R    RSA 2048 (SHA256)   TLS 1.2 > http/1.1      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   ECDH secp256r1  FS
IE 11 / Win Phone 8.1 Update  R RSA 2048 (SHA256)   TLS 1.2 > http/1.1      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   ECDH secp256r1  FS
IE 11 / Win 10  R   RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Edge 13 / Win 10  R RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS
Edge 13 / Win Phone 10  R   RSA 2048 (SHA256)   TLS 1.2 > h2    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   ECDH secp256r1  FS

curl 'https://redemption.intranet.struktur.de:8444/ws' -H 'Pragma: no-cache' -H 'Origin: https://redemption.intranet.struktur.de:8444' -H 'Accept-Encoding: gzip, deflate, sdch, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'Sec-WebSocket-Key: HcE5iHMv0LBfyYB0U61o6w==' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.44 Safari/537.36' -H 'Upgrade: websocket' -H 'Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits' -H 'Cache-Control: no-cache' -H 'Connection: Upgrade' -H 'Sec-WebSocket-Version: 13' -H 'DNT: 1' --compressed

curl -v 'https://redemption.intranet.struktur.de:8444/ws' -H 'Pragma: no-cache' -H 'Origin: https://redemption.intranet.struktur.de:8444' -H 'Accept-Encoding: gzip, deflate, sdch, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'Sec-WebSocket-Key: HcE5iHMv0LBfyYB0U61o6w==' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.44 Safari/537.36' -H 'Upgrade: websocket' -H 'Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits' -H 'Cache-Control: no-cache' -H 'Connection: Upgrade' -H 'Sec-WebSocket-Version: 13' -H 'DNT: 1' --compressed
* Hostname was NOT found in DNS cache
*   Trying 10.1.1.201...
* Connected to redemption.intranet.struktur.de (10.1.1.201) port 8444 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*    subject: C=DE; ST=Baden-Wuerttemberg; L=Stuttgart; OU=struktur AG IT; CN=redemption.intranet.struktur.de
*    start date: 2016-05-31 07:25:16 GMT
*    expire date: 2017-05-31 07:25:16 GMT
*    subjectAltName: redemption.intranet.struktur.de matched
*    issuer: C=DE; ST=Baden-Wuerttemberg; L=Stuttgart; O=struktur AG; OU=IT; CN=struktur AG Server CA (2013); [email protected]
*    SSL certificate verify ok.
> GET /ws HTTP/1.1
> Host: redemption.intranet.struktur.de:8444
> Accept: */*
> Pragma: no-cache
> Origin: https://redemption.intranet.struktur.de:8444
> Accept-Encoding: gzip, deflate, sdch, br
> Accept-Language: en-US,en;q=0.8,de;q=0.6
> Sec-WebSocket-Key: HcE5iHMv0LBfyYB0U61o6w==
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.44 Safari/537.36
> Upgrade: websocket
> Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
> Cache-Control: no-cache
> Connection: Upgrade
> Sec-WebSocket-Version: 13
> DNT: 1
> 
< HTTP/1.1 101 Switching Protocols
* Server nginx is not blacklisted
< Server: nginx
< Date: Fri, 18 Nov 2016 12:39:42 GMT
< Connection: upgrade
< Upgrade: websocket
< Sec-WebSocket-Accept: 798KWVopbQxtvY0tBojT2Job/x4=
..... websocket data follows

*   Trying zzz.zzz.zzz.zzz...
* TCP_NODELAY set
* Connected to nc.xxxxxxx.net (zzz.zzz.zzz.zzz) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=www.xxxxxxx.net
*  start date: Sep 29 19:59:00 2016 GMT
*  expire date: Dec 28 19:59:00 2016 GMT
*  subjectAltName: host "nc.xxxxxxx.net" matched cert's "nc.xxxxxxx.net"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET /webrtc/ws HTTP/1.1
> Host: nc.xxxxxxx.net
> Accept: */*
> Pragma: no-cache
> Origin: https://nc.xxxxxxx.net
> Accept-Encoding: gzip, deflate, sdch, br
> Accept-Language: nl-NL,nl;q=0.8,en-US;q=0.6,en;q=0.4
> Sec-WebSocket-Key: WQU..../dg==
> User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2902.0 Safari/537.36
> Upgrade: websocket
> Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
> Cache-Control: no-cache
> Cookie: oc_sessionPassphrase=faM......J; nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; i18next=nl; ocuinqirkrns=284.....qf4
> Connection: Upgrade
> Sec-WebSocket-Version: 13
> DNT: 1
>
< HTTP/1.1 400 Bad Request
< Server: nginx/1.10.1
< Date: Fri, 18 Nov 2016 13:23:31 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 12
< Connection: keep-alive
< Keep-Alive: timeout=20
< Sec-Websocket-Version: 13
< X-Content-Type-Options: nosniff
<
Bad Request
* Curl_http_done: called premature == 0
* Connection #0 to host nc.xxxxxxx.net left intact

curl -k -v 'https://redemption.intranet.struktur.de:8444/ws' -H 'Pragma: no-cache' -H 'Origin: https://redemption.intranet.struktur.de:8444' -H 'Accept-Encoding: gzip, deflate, sdch, br' -H 'Accept-Language: en-US,en;q=0.8,de;q=0.6' -H 'Sec-WebSocket-Key: HcE5iHMv0LBfyYB0U61o6w==' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.44 Safari/537.36' -H 'Upgrade: websocket' -H 'Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits' -H 'Cache-Control: no-cache' -H 'Connection: Upgrade' -H 'Sec-WebSocket-Version: 13' -H 'DNT: 1' --compressed
*   Trying 10.1.1.201...
* Connected to redemption.intranet.struktur.de (10.1.1.201) port 8444 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 703 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_256_GCM_SHA384
*    server certificate verification SKIPPED
*    server certificate status verification SKIPPED
*    common name: redemption.intranet.struktur.de (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: RSA
*    certificate version: #3
*    subject: C=DE,ST=Baden-Wuerttemberg,L=Stuttgart,OU=struktur AG IT,CN=redemption.intranet.struktur.de
*    start date: Tue, 31 May 2016 07:25:16 GMT
*    expire date: Wed, 31 May 2017 07:25:16 GMT
*    issuer: C=DE,ST=Baden-Wuerttemberg,L=Stuttgart,O=struktur AG,OU=IT,CN=struktur AG Server CA (2013),[email protected]
*    compression: NULL
* ALPN, server accepted to use http/1.1
> GET /ws HTTP/1.1
> Host: redemption.intranet.struktur.de:8444
> Accept: */*
> Pragma: no-cache
> Origin: https://redemption.intranet.struktur.de:8444
> Accept-Encoding: gzip, deflate, sdch, br
> Accept-Language: en-US,en;q=0.8,de;q=0.6
> Sec-WebSocket-Key: HcE5iHMv0LBfyYB0U61o6w==
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.44 Safari/537.36
> Upgrade: websocket
> Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
> Cache-Control: no-cache
> Connection: Upgrade
> Sec-WebSocket-Version: 13
> DNT: 1
> 
< HTTP/1.1 101 Switching Protocols
< Server: nginx
< Date: Fri, 18 Nov 2016 13:34:33 GMT
< Connection: upgrade
< Upgrade: websocket

GET /webrtc/ws HTTP/1.1
Connection: upgrade
X-Forwarded-Proto: https
Host:nc.xxxxxxx.net:443
X-Real-IP: 192.168.6.1
X-Forwarded-For: 192.168.6.1
Pragma: no-cache
Cache-Control: no-cache
Origin: https://nc.xxxxxxx.net
Sec-WebSocket-Version: 13
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2902.0 Safari/537.36
DNT: 1
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: nl-NL,nl;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: oc_sessionPassphrase=faMS........HJhKQJ; nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; i18next=nl; ocuinqirkrns=2845....4
Sec-WebSocket-Key: y1XD...........jg==
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Sec-Websocket-Version: 13
X-Content-Type-Options: nosniff
Date: Fri, 18 Nov 2016 13:43:31 GMT
Content-Length: 12

# Copyright 1999-2012 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/app-portage/epm/epm-1.33.ebuild,v 1.7 2012/05/16 15:46:54 fuzzyray Exp $

inherit git-r3 user
DESCRIPTION="Spreed.me webrtc server"
HOMEPAGE="https://github.com/strukturag/spreed-webrtc"
EGIT_REPO_URI="https://github.com/strukturag/spreed-webrtc.git"

LICENSE="AGPL"
SLOT="0"
KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sparc x86 ~sparc-fbsd ~x86-fbsd"
IUSE="intl"

DEPEND="net-misc/curl >=dev-lang/go-1.4.0 >=net-libs/nodejs-0.6.0 "

RDEPEND="${DEPEND}"

src_compile() {
        ./autogen.sh
        econf
        emake
}

pkg_setup() {
        enewgroup spreed-webrtc
    enewuser spreed-webrtc -1 -1 -1 spreed-webrtc
}

src_install() {
        emake dc_destdir=$D DESTDIR=$D install
        insinto /etc/spreed-webrtc
        newins   $FILESDIR/server.conf          server.conf
        newinitd $FILESDIR/spreed-webrtc.initd  spreed-webrtc
        newconfd $FILESDIR/spreed-webrtc.confd  spreed-webrtc
    insinto /var/log/spreed-webrtc
        fowners spreed-webrtc:spreed-webrtc /var/log/spreed-webrtc
}

WEBRTC_CONF=/etc/spreed-webrtc/server.conf
WEBRTC_LOG=/var/log/spreed-webrtc/server.log
WEBRTC_NOFILE=4096
WEBRTC_GOMAXPROCS=5
WEBRTC_ARGS=""

#!/sbin/openrc-run

DESC='Spreed Speak Freely'
NAME=spreed-webrtc
DAEMON=/usr/sbin/spreed-webrtc-server
SCRIPTNAME=/etc/init.d/$NAME

# Exit if the package is not installed
[ -x $DAEMON ] || exit 0

WEBRTC_PID=/run/spreed-webrtc/spreed-webrtc.pid
WEBRTC_RUN_DIR=/run/spreed-webrtc
WEBRTC_USER=spreed-webrtc
WEBRTC_GROUP=spreed-webrtc


#
# Function that starts the daemon/service
#
start()
{
        ebegin Start $NAME
        start-stop-daemon --start \
                      --quiet \
                      --pidfile $WEBRTC_PID \
                      --startas $DAEMON \
                      --test > /dev/null \
        || return 1

    # Create the run directory.
    test -e $WEBRTC_RUN_DIR || mkdir -p $WEBRTC_RUN_DIR || true
    chown -R $WEBRTC_USER:$WEBRTC_GROUP $WEBRTC_RUN_DIR || true
    chmod 770 $WEBRTC_RUN_DIR || true

    # Set some performance parameters
    ulimit -n $WEBRTC_NOFILE
    export GOMAXPROCS=$WEBRTC_GOMAXPROCS

    start-stop-daemon --start \
                      --quiet \
                      --background \
                      --make-pidfile \
                      --pidfile $WEBRTC_PID \
                      --chuid $WEBRTC_USER \
                      --group $WEBRTC_GROUP \
                      --startas $DAEMON \
                      -- \
                      -c $WEBRTC_CONF \
                      -l $WEBRTC_LOG \
                      $WEBRTC_ARGS
    eend $?
}

#
# Function that stops the daemon/service
#
stop()
{
        ebegin Stop $NAME
        start-stop-daemon --stop \
                      --quiet \
                      --retry=TERM/30/KILL/5 \
                      --pidfile $WEBRTC_PID \
                      --name $NAME
        RETVAL="$?"
        [ "$RETVAL" != 2 ] && rm -f $WEBRTC_PID
        eend "$RETVAL"
}

#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
    do_stop
    do_start
        return 0
}

 location ^~ /webrtc {
        proxy_pass http://127.0.0.1:5080;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

2>&1 nginx -V | xargs -n1
--with-cc-opt=-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2
--with-ld-opt=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now
--prefix=/usr/share/nginx
--conf-path=/etc/nginx/nginx.conf
--http-log-path=/var/log/nginx/access.log
--error-log-path=/var/log/nginx/error.log
--lock-path=/var/lock/nginx.lock
--pid-path=/run/nginx.pid
--http-client-body-temp-path=/var/lib/nginx/body
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--http-proxy-temp-path=/var/lib/nginx/proxy
--http-scgi-temp-path=/var/lib/nginx/scgi
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi
--with-debug
--with-pcre-jit
--with-ipv6
--with-http_ssl_module
--with-http_stub_status_module
--with-http_realip_module
--with-http_auth_request_module
--with-http_addition_module
--with-http_dav_module
--with-http_geoip_module
--with-http_gunzip_module
--with-http_gzip_static_module
--with-http_image_filter_module
--with-http_v2_module
--with-http_sub_module
--with-http_xslt_module
--with-stream
--with-stream_ssl_module
--with-mail
--with-mail_ssl_module
--with-threads
--add-module=/build/nginx-H0pUyB/nginx-1.10.2/debian/modules/nginx-auth-pam
--add-module=/build/nginx-H0pUyB/nginx-1.10.2/debian/modules/nginx-dav-ext-module
--add-module=/build/nginx-H0pUyB/nginx-1.10.2/debian/modules/nginx-echo
--add-module=/build/nginx-H0pUyB/nginx-1.10.2/debian/modules/nginx-upstream-fair
--add-module=/build/nginx-H0pUyB/nginx-1.10.2/debian/modules/ngx_http_substitutions_filter_module