[Bug] Terminal Proxy not working behind reverse proxy

[markushergeth]

Describe the bug

When running PegaProx behind a reverse proxy with HTTPS (port 443), the application incorrectly derives WebSocket ports using internal offset logic (+1/+2), even in reverse proxy mode. This results in invalid WebSocket URLs such as :445, which cannot be reached via the configured reverse proxy.

Steps to Reproduce

1. Switch to VNC Console
2. Switch to Term

Expected behavior

The console for the lxc container should launch

Environment

• PegaProx Version: Beta 0.9.12.3
• Installation Method: Automated in LXC Container
• OS: PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
  NAME="Debian GNU/Linux"
  VERSION_ID="13"
  VERSION="13 (trixie)"
  VERSION_CODENAME=trixie
  DEBIAN_VERSION_FULL=13.5
  ID=debian
• Browser: Edge 149.0.4022.62 and Firefox 151.0.1
• Behind Reverse Proxy? Caddy
• UI? Modern Layout

Logs

(index):5154 VNC: Starting connection...
(index):5160 VNC: Getting ticket...
(index):5161 VNC: Got ticket
(index):5163 Using main port for VNC (Reverse Proxy Enabled): 443
(index):5196 VNC: Connecting...
(index):5205 VNC: Connected!
rfb.js:2839 Server did not accept the resize request: Resize is administratively prohibited
_handleExtendedDesktopSize @ rfb.js:2839
_handleRect @ rfb.js:2594
_framebufferUpdate @ rfb.js:2557
_normalMsg @ rfb.js:2473
_handleMessage @ rfb.js:977
_recvMessage @ websock.js:342
[NEW] Explain Console errors by using Copilot in Edge: click  to explain an error. Learn moreDon't show again
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):5211 VNC: Disconnected {clean: true}
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):5081 WebSocket connection to 'wss://pegaprox.hergeth.net:445/api/clusters/f10bfb81/vms/pve01/lxc/105/termwebsocket (url shorted to show the issue)
start @ (index):5081
(index):5084 [term] ws error: Event {isTrusted: true, type: 'error', target: WebSocket, currentTarget: WebSocket, eventPhase: 2, …}
ws.onerror @ (index):5084
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6210 SSE: Token refresh cycle starting...
(index):6204 SSE token obtained (expires in 600 s)
(index):6210 SSE: Got new token, reconnecting...
(index):6204 Connecting to SSE...
(index):6204 SSE token obtained (expires in 600 s)
(index):6208 SSE connected
(index):6219 SSE authenticated, client: bc444d4d-14c8-4a7e-a40b-d8b5dbfe7f79
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25
(index):6220 SSE tasks received for cluster f10bfb81: 25

Screenshots

Checklist

• I have searched existing issues to make sure this is not a duplicate
• I am using the latest version of PegaProx

[mkellermann97]

Confirmed and fixed — nice catch, your console log made it a quick one. The LXC/VM terminal was deriving its WebSocket port from an internal window.__pegaproxReverseProxy global that isn't reliably set, so behind your Caddy proxy it still aimed at main + 2 (:445) instead of 443 — meanwhile VNC and the node shell already key off the proper reverse-proxy flag, which is exactly why VNC connected and only the terminal failed. Fixed on Testing (c3366c6): the term WS now uses the main port in reverse-proxy mode just like VNC, and I rebuilt the compiled frontend.

It'll ship in the next release — after you update and hard-refresh, the LXC console should connect over 443. Thanks for the clean repro; opencollective.com/pegaprox if PegaProx is pulling its weight for you. — Marcus

[mkellermann97]

Shipped in v0.9.13 🎉 — the terminal WebSocket now uses the main port in reverse-proxy mode (just like VNC) instead of main + 2, so behind your Caddy it stays on 443. Update via the in-app updater (Settings → Updates) or ./update.sh, then hard-refresh the browser (Ctrl-Shift-R) so it picks up the rebuilt frontend.

Closing as fixed — reopen if the LXC console still won't connect after the update. Thanks for the clean repro + console log, made it a quick one. opencollective.com/pegaprox if PegaProx is pulling its weight for you. — Marcus