I would also like to note that if nginx and =3D websocket proxy are on the same machine you cannot have both nginx and =3D websocket proxy listening on 6100… it would be best to change the =3D websocket proxy listening port and then proxy both ipv4 and 6 with nginx = =3D :)

From:= =3D = =3D users-bounces(a)ovirt.org [mailto:users-bounces(a)ovirt.org] On Behalf O= f =3D Donny Davis
Sent: Thursday, December 18, 2014 9:06 =3D AM
To: users(a)ovirt.org
Subject: [ovirt-users] IPv6 = =3D Functionality for WebSocket Proxy

I just =3D realized this morning that my noVNC connections were not working for =3D IPv6 only on cloudspin.me

For those = =3D who want to deploy dual stack functionality for ovirt-websocket-proxy =3D here is a very simple and elegant fix.

NGINX is a = =3D useful tool :)

You will = =3D need nginx to proxy the connection between your IPv6 customers, and the =3D IPv4 listening only websocket proxy(however that can be changed in =3D /usr/share/ovirt-engine/services/ovirt-websocket-proxy/ovirt-websocket-pr= =3D oxy.conf but you can't have your cake and eat it too… one or the =3D other ipv4 or ipv6)

Anyways, here is = =3D the fix

Install nginx on your websocket proxy server - Why =3D Nginx, because I like it better than apache. The default config for =3D Ovirt could be setup to do this with the web server that is already =3D running :) just sayin

For my =3D configuration I am running the websocket proxy on a different host, but =3D I imagine you could use this config in a full deployment and use =3D websocket proxy on the engine host

server =3D {

server_name =3D web.cloudspin.me; # this is the hostname that you told the engine that =3D the websocket proxy would be listening on

#listen =3D 6100; &n= =3D bsp; #Commented because I am using this for ipv6 only, but you could use = =3D nginx to proxy both and only open one port in the =3D firewall

listen [::]:6100 =3D ssl; #NOTE this needs to listen on the same port = =3D you told the engine the websocket proxy would be listening =3D on

ssl_certificate= =3D =3D /physical/path/to/ssl/cert; #I used the same cert that my websocket =3D proxy is using

=3D ssl_certificate_key =3D /physical/path/to/ssl/key;

ssl =3D on;

=3D ssl_session_cache builtin:1000 =3D shared:SSL:10m;

ssl_protocols = =3D TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers =3D HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;

=3D ssl_prefer_server_ciphers =3D on;

access_log =3D /var/log/nginx/websocket.cloudspin.me-access.log;

error_log =3D /var/log/nginx/websocket.cloudspin.me-error.log;

location / =3D {

&nb= =3D sp; proxy_pass https://ip_address_of= =3D _websocket_proxy:6100;

=3D proxy_http_version 1.1;

=3D proxy_set_header Upgrade $http_upgrade;

=3D proxy_set_header Connection "upgrade";

&nb= =3D sp;

}

Too easy to fix = =3D the many problems I have had getting websocket proxy to work. If you =3D have a commerical cert and key, this would be a great place to put it, =3D so your users don't have to bother with trusting your CA, it will just =3D work

Cheers and I =3D hope this helps

If anyone needs = =3D any help getting this to work give me a shout

Donny =3D D

cloudspin.me