Anubis breaks openQA developer mode (websockets) #13252

New issue

Closed

opened 2026-04-02 17:23:21 +00:00 by adamwill · 4 comments

adamwill commented

2026-04-02 17:23:21 +00:00

Member

Description of request

We put openQA (prod and stg) behind Anubis yesterday due to a bot flood, but discovered that breaks openQA's "developer mode", which uses websockets. There's some debug steps for developer mode here; there's also an architectural diagram here. On the openQA worker hosts, the ports used for the livehandler -> command server connection (AIUI) are listed in the host vars as tcp_ports, e.g. in https://forge.fedoraproject.org/infra/ansible/raw/branch/main/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org .

### Description of request We put openQA (prod and stg) behind Anubis yesterday due to a bot flood, but discovered that breaks openQA's "developer mode", which uses websockets. There's some debug steps for developer mode [here](https://open.qa/docs/#debugdevelmode); there's also an architectural diagram [here](https://open.qa/docs/images/architecture.svg). On the openQA worker hosts, the ports used for the livehandler -> command server connection (AIUI) are listed in the host vars as `tcp_ports`, e.g. in https://forge.fedoraproject.org/infra/ansible/raw/branch/main/inventory/host_vars/openqa-a64-worker01.rdu3.fedoraproject.org .

smoliicek added the

labels

2026-04-02 19:11:27 +00:00

kevin commented

2026-04-02 22:44:24 +00:00

Owner

So, as near as I can guess, this is happening because the proxy through anubis isn't also proxying websockets...

In roles/httpd/reverseproxy/templates/reversepassproxy.conf we setup some websocket proxy stuff, which results in:

<Proxy "balancer://openqa-websocket">
              BalancerMember "ws://openqa01:80"
          </Proxy>

RewriteEngine on
RewriteCond %{HTTP:Upgrade} ^WebSocket$ [NC]
RewriteCond %{HTTP:Connection} Upgrade [NC]
RewriteRule .* "balancer://openqa-websocket%{REQUEST_URI}" [P]

So what I think we need to do is in roles/httpd/website/templates/website.conf I guess duplicate the above to proxy those before the rest of requests go to anubis... but I am not sure if we have all the right template variables at that point.

So, as near as I can guess, this is happening because the proxy through anubis isn't also proxying websockets... In roles/httpd/reverseproxy/templates/reversepassproxy.conf we setup some websocket proxy stuff, which results in: ``` <Proxy "balancer://openqa-websocket"> BalancerMember "ws://openqa01:80" </Proxy> RewriteEngine on RewriteCond %{HTTP:Upgrade} ^WebSocket$ [NC] RewriteCond %{HTTP:Connection} Upgrade [NC] RewriteRule .* "balancer://openqa-websocket%{REQUEST_URI}" [P] ``` So what I think we need to do is in roles/httpd/website/templates/website.conf I guess duplicate the above to proxy those before the rest of requests go to anubis... but I am not sure if we have all the right template variables at that point.