Bug: time to time goes to :8443 behind aws lb -> nginx ingress -> vectr

[marcispauls]

Describe the bug
Time to time we face that running VECTR behind nginx as ingress in AWS it tries to load assets/js/apis on :8443 even we have configured:

VECTR_HOSTNAME = vectr.example.com
VECTR_PORT              = 8443
VECTR_EXTERNAL_HOSTNAME = vectr.example.com
VECTR_EXTERNAL_PORT     = 443

To Reproduce
Steps to reproduce the behavior:

1. setup k8s with nginx ingress
2. create service in k8s which points to caddy-gateway:8443
3. create ingress on 443 which points to that service
4. Some assets tries to load from 8443 like /static/icons/ /static/ /sra-purpletools-webui/app/ /sra-purpletools-rest/ etc

Expected behavior
Should respect everywhere whats in VECTR_EXTERNAL_HOSTNAME and VECTR_EXTERNAL_PORT

User Platform(please complete the following information):

• OS: windows
• Browser: Chrome
• Version: 130

VECTR Host(please complete the following information):

• Linux Distro: Docker
• Linux Version: Docker
• VECTR Version 9.4.0

[p-b--]

We don't offer support Kubernetes for VECTR community edition. We know users have successfully deployed VECTR to such environments and others are welcome to comment if they have suggestions if they would like. I will mark support for such deployments as a feature request.

[p-b--]

If you do find that you can replicate this issue in our supported set up (via the docker compose), please let us know and we can investigate further.

What would also help would be a list of the exact requests that get made against the other port (you don't need to include credential info).

[marcispauls]

I will replicate the issue with docker-compose, but that will be next week

[yaroslav-nakonechnikov]

hm... if i do curl with verbose, i see this part:

...
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 302
< date: Thu, 17 Apr 2025 08:49:28 GMT
< content-length: 0
< alt-svc: h3=":8443"; ma=2592000
< location: /sra-purpletools-webui/app/
< strict-transport-security: max-age=31536000; includeSubDomains
* Ignoring the response-body
...

what is alt-svc: h3=":8443"; ma=2592000 ?

[yaroslav-nakonechnikov]

after long time, finally got that thing: VECTR_GATEWAY_PORT setting for gateway container will replace 8443 port.
interesting, that it has to be ":443" or ""

and now still facing some issues with proxying thru ingress - js scripts are not being caught correctly by chrome.
But in Firefox and direct curls are working fine.

[yaroslav-nakonechnikov]

and another thing: if someone will try to create single pod - be ready, that webui and gateway are both listening on 80.
and there is no supported way to change these settings.

so i had to remove gateway, and left only webui and tomcat.