update docker and apache stuff to new next-orly and make it all more proxy-friendly

2025-10-03 11:44:02 +02:00
parent e8a69077b3
commit 9fdef77e02
15 changed files with 510 additions and 251 deletions
--- a/APACHE-PROXY-GUIDE.md
+++ b/APACHE-PROXY-GUIDE.md
@@ -1,7 +1,7 @@
 # Apache Reverse Proxy Guide for Docker Apps

 **Complete guide for WebSocket-enabled applications - covers both Plesk and Standard Apache**
-**Updated with real-world troubleshooting solutions**
+**Updated with real-world troubleshooting solutions and latest Orly relay improvements**

 ## 🎯 **What This Solves**
 - WebSocket connection failures (`NS_ERROR_WEBSOCKET_CONNECTION_REFUSED`)
@@ -9,24 +9,32 @@
 - Docker container proxy configuration
 - SSL certificate integration
 - Plesk configuration conflicts and virtual host precedence issues
+- **NEW**: WebSocket scheme validation errors (`expected 'ws' got 'wss'`)
+- **NEW**: Proxy-friendly relay configuration with enhanced CORS headers
+- **NEW**: Improved error handling for malformed client data

 ## 🐳 **Step 1: Deploy Your Docker Application**

-### **For Stella's Orly Relay:**
+### **For Stella's Orly Relay (Latest Version with Proxy Improvements):**
 ```bash
-# Pull and run the relay
+# Pull and run the relay with enhanced proxy support
 docker run -d \
-  --name stella-relay \
+  --name orly-relay \
  --restart unless-stopped \
  -p 127.0.0.1:7777:7777 \
  -v /data/orly-relay:/data \
  -e ORLY_OWNERS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx \
  -e ORLY_ADMINS=npub1v30tsz9vw6ylpz63g0a702nj3xa26t3m7p5us8f2y2sd8v6cnsvq465zjx,npub1l5sga6xg72phsz5422ykujprejwud075ggrr3z2hwyrfgr7eylqstegx9z \
-  silberengel/orly-relay:latest
+  -e ORLY_RELAY_URL=wss://your-domain.com \
+  -e ORLY_ACL_MODE=follows \
+  -e ORLY_SPIDER_MODE=follows \
+  -e ORLY_SPIDER_FREQUENCY=1h \
+  -e ORLY_SUBSCRIPTION_ENABLED=false \
+  silberengel/next-orly:latest

 # Test the relay
 curl -I http://127.0.0.1:7777
-# Should return: HTTP/1.1 426 Upgrade Required
+# Should return: HTTP/1.1 200 OK with enhanced CORS headers
 ```

 ### **For Web Apps (like Jumble):**
@@ -253,9 +261,40 @@ sudo a2enmod proxy
 sudo a2enmod proxy_http
 sudo a2enmod proxy_wstunnel
 sudo a2enmod rewrite
+sudo a2enmod headers
 sudo systemctl restart apache2
 ```

+## 🆕 **Step 4: Latest Orly Relay Improvements**
+
+### **Enhanced Proxy Support**
+The latest Orly relay includes several proxy improvements:
+
+1. **Flexible WebSocket Scheme Handling**: Accepts both `ws://` and `wss://` schemes for authentication
+2. **Enhanced CORS Headers**: Better compatibility with web applications
+3. **Improved Error Handling**: More robust handling of malformed client data
+4. **Proxy-Aware Logging**: Better debugging information for proxy setups
+
+### **Key Environment Variables**
+```bash
+# Essential for proxy setups
+ORLY_RELAY_URL=wss://your-domain.com  # Must match your public URL
+ORLY_ACL_MODE=follows                  # Enable follows-based access control
+ORLY_SPIDER_MODE=follows              # Enable content syncing from other relays
+ORLY_SUBSCRIPTION_ENABLED=false      # Disable payment requirements
+```
+
+### **Testing the Enhanced Relay**
+```bash
+# Test local connectivity
+curl -I http://127.0.0.1:7777
+
+# Expected response includes enhanced CORS headers:
+# Access-Control-Allow-Credentials: true
+# Access-Control-Max-Age: 86400
+# Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
+```
+
 ## ⚡ **Step 4: Alternative - Nginx in Plesk**

 If Apache keeps giving issues, switch to Nginx in Plesk:
@@ -327,13 +366,67 @@ After making changes:
 ```bash
 # Essential debugging
 docker ps | grep relay                   # Container running?
-curl -I http://127.0.0.1:7777           # Local relay (should return 426)
+curl -I http://127.0.0.1:7777           # Local relay (should return 200 with CORS headers)
 apache2ctl -S | grep domain.com         # Virtual host precedence
 grep ProxyPass /etc/apache2/plesk.conf.d/vhosts/domain.conf  # Config applied?

 # WebSocket testing
 echo '["REQ","test",{}]' | websocat wss://domain.com/     # Root path
 echo '["REQ","test",{}]' | websocat wss://domain.com/ws/  # /ws/ path
+
+# Check relay logs for proxy information
+docker logs relay-name | grep -i "proxy info"
+docker logs relay-name | grep -i "websocket connection"
+```
+
+## 🚨 **Latest Troubleshooting Solutions**
+
+### **WebSocket Scheme Validation Errors**
+**Problem**: `"HTTP Scheme incorrect: expected 'ws' got 'wss'"`
+
+**Solution**: Use the latest Orly relay image with enhanced proxy support:
+```bash
+# Pull the latest image with proxy improvements
+docker pull silberengel/next-orly:latest
+
+# Restart with the latest image
+docker stop orly-relay && docker rm orly-relay
+# Then run with the configuration above
+```
+
+### **Malformed Client Data Errors**
+**Problem**: `"invalid hex array size, got 2 expect 64"`
+
+**Solution**: These are client-side issues, not server problems. The latest relay handles them gracefully:
+- The relay now sends helpful error messages to clients
+- Malformed requests are logged but don't crash the relay
+- Normal operations continue despite client errors
+
+### **Follows ACL Not Working**
+**Problem**: Only owners can write, admins can't write
+
+**Solution**: Ensure proper configuration:
+```bash
+# Check ACL configuration
+docker exec orly-relay env | grep ACL
+
+# Should show: ORLY_ACL_MODE=follows
+# If not, restart with explicit configuration
+```
+
+### **Spider Not Syncing Content**
+**Problem**: Spider enabled but not pulling events
+
+**Solution**: Check for relay lists and follow events:
+```bash
+# Check spider status
+docker logs orly-relay | grep -i spider
+
+# Look for relay discovery
+docker logs orly-relay | grep -i "relay URLs"
+
+# Check for follow events
+docker logs orly-relay | grep -i "kind.*3"
 ```

 ### **Working Solution (Proven):**
@@ -362,3 +455,28 @@ echo '["REQ","test",{}]' | websocat wss://domain.com/ws/  # /ws/ path
 2. Use `ws://` proxy for Nostr relays, not `http://`
 3. Direct Apache config files are more reliable than Plesk interface
 4. Always check virtual host precedence with `apache2ctl -S`
+5. **NEW**: Use the latest Orly relay image for better proxy compatibility
+6. **NEW**: Enhanced CORS headers improve web app compatibility
+7. **NEW**: Flexible WebSocket scheme handling eliminates authentication errors
+8. **NEW**: Improved error handling makes the relay more robust
+
+## 🎉 **Summary of Latest Improvements**
+
+### **Enhanced Proxy Support**
+- ✅ Flexible WebSocket scheme validation (accepts both `ws://` and `wss://`)
+- ✅ Enhanced CORS headers for better web app compatibility
+- ✅ Improved error handling for malformed client data
+- ✅ Proxy-aware logging for better debugging
+
+### **Spider and ACL Features**
+- ✅ Follows-based access control (`ORLY_ACL_MODE=follows`)
+- ✅ Content syncing from other relays (`ORLY_SPIDER_MODE=follows`)
+- ✅ No payment requirements (`ORLY_SUBSCRIPTION_ENABLED=false`)
+
+### **Production Ready**
+- ✅ Robust error handling
+- ✅ Enhanced logging and debugging
+- ✅ Better client compatibility
+- ✅ Improved proxy support
+
+**The latest Orly relay is now fully optimized for proxy environments and provides a much better user experience!**