Can I properly use Subsonic (with https) and Apache2

[GH0]

Right now I am stuck with a bit of a problem:

Shielf.PNG

The dreaded shield.

Subsonic doesn't properly or is leaving some traffic unencrypted. Which leaves me with a subsonic webpage that sometimes doesn't load certain elements or work 100% of the time correctly.

I can easily disable this shield, but I don't want to, I would rather have a fully encrypted connection. Part of the problem with this is that I use apache2 so I can serve all web applications under my domain and certificate on one port, and not open up several ports. Now, is there any way with either ProxyPass or Apache2 itself that this can be done? I know if I try and serve Subsonic using https with proxypass, I just get an error because I am trying to proxy an encrypted connection. But there has to be some way that I can use a fully encrypted service doing this.

[ericvonnine]

How did you configure Apache?

I followed the guide for reverse proxy and everything is working over https AFAICT.

[GH0]

How did you configure Apache?

I followed the guide for reverse proxy and everything is working over https AFAICT.

It works, but you don't receive a message like this in Chrome?

Mixed Content: The page at 'https://omit.org/subsonic/index.view' was loaded over HTTPS, but requested an insecure resource 'http://omit.org/subsonic/home.view;jsessionid=[omit]'. This request has been blocked; the content must be served over HTTPS.

This is my issue.

[ericvonnine]

I don't normally use chrome, but I installed chromium to test. Neither Firefox nor Chromium complain about my setup. I get the little padlock icon in both cases. Did you follow a guide for setting up the reverse proxy?

[baaldemon]

The mixed content is from the artist information that is loaded from last.fm as well as possible other external includes. Currently subsonic pulls that data in over http which causes the warning you are seeing.

[ericvonnine]

Is that done client side? Because I am not seeing the mixed content warning.

[sfunk1x]

I also experience this problem. Vanilla Subsonic install of the latest version. Most notably, this will occur on the 'Settings' screen. Until I allow mixed content (Firefox) by clicking the shield and turning the security feature off, I won't see anything. Something is indeed requesting several resources as if the HTTP part of the addressing scheme was actually hard coded somewhere, which I expect the be the case.

For me, I have subsonic listening to 127.0.0.1, and nginx is forwarding requests to subsonic.

[daneren2005]

You just have to specify to listen on a HTTPS port instead of http one in the Subsonic config. I believe the default is something like SUBSONIC_HTTP_PORT and it needs to be changed HTTPS. I don't have access to my config right now to say exactly what it is.

[daneren2005]

As a follow up, here is my config for use with nginx:

Code: Select all

# For example, to specify that Subsonic should use port 80 (for http)
# and 443 (for https), and use a Java memory heap size of 200 MB, use
# the following:
#
# SUBSONIC_ARGS="--port=80 --https-port=443 --max-memory=200"

HOST=127.0.0.1
PORT=0
HTTPS_PORT=4040
CONTEXT_PATH=/subsonic

SUBSONIC_ARGS="--max-memory=500 --context-path=${CONTEXT_PATH} --port=${PORT} --https-port=${HTTPS_PORT}"


# The user which should run the Subsonic process. Default "root".
# Note that non-root users are by default not allowed to use ports
# below 1024. Also make sure to grant the user write permissions in
# the music directories, otherwise changing album art and tags will fail.

SUBSONIC_USER=www-data