Run Pgadmin4 behind reverse proxy

Question

I'm trying to run pgadmin4 behind an Nginx reverse proxy but I'm having an issue because I need for pgadmin to know it is at myhost.com/pgadmin and not simply at myhost.com.... or at least I think that is the problem.

In other web apps there is usually some setting called webroot or something like that to designate that it should consider itself located there but I can't find anything like that for pgadmin4.

Does this setting exist, if so, where is it?

If not, is there a workaround?

I have this working for pgadmin4, give me a minute to dig up my configs. It has nothing to do with webroots though — Thomas Ward, May 03 '18 at 17:26
Can you confirm how you currently access pgadmin4 without the reverse proxy? — Thomas Ward, May 03 '18 at 17:33
So, I dug into this and the way I had it won't work. The problem is you're trying to serve it from a sublocation. The only way this would work is, technically, running as an uwsgi application, because there's no way to have pgadmin4 know its own 'web root'. It only knows how to talk with its own root directory (such as with http://ipaddress:5000/ as the example of how it'd be reachable without nginx in line). Since this isn't the easiest to do it's nontrivial to set this up. Let me dig into this. (It's not going to be a pure NGINX solution though) — Thomas Ward, May 03 '18 at 17:53
I'm away from my desk now but it is through fenglc docker image specifically — Dean MacGregor, May 03 '18 at 17:58
why do you want a reverse proxy for this, instead of just leaving it exposed and control access to it on an as-needed basis? — Thomas Ward, May 03 '18 at 18:01
Well 2 reasons, I already have an app at the root of mydomain.com and also for ssl. I suppose it can do its own ssl so reason 1 it is. — Dean MacGregor, May 03 '18 at 18:03
The proper way to do this would be a subdomain such as pgadmin.domain.tld pointing to the same server, with its own nginx server { } block to handle the SSL on port 443 with https://pgadmin.domain.tld and a direct proxy_pass to the pgadmin4 backend. pgadmin4 doesn't give us the ability to set a 'script root' or alter the URLs it provides us for the web frontend resources directly, and it's infinitely nontrivial in just nginx to properly get all the resources to display with rewrites. — Thomas Ward, May 03 '18 at 18:14

score 4 · Answer 1 · answered May 28 '20 at 09:19

According to https://www.pgadmin.org/docs/pgadmin4/latest/container_deployment.html you should add a request header. Assuming you place pgAdmin4 under /pgadmin4 instead of /

Nginx: proxy_set_header X-Script-Name /pgadmin4;
Apache HTTPD: RequestHeader set X-Script-Name /pgadmin4

score 3 · Accepted Answer · answered May 03 '18 at 18:21

The core problem you're having here is that the pgadmin4 backend is highly sensitive to the URIs being passed to it. It's also statically configured, so we can't add a 'prefix' to the URIs for how to process it.

Therefore, since we can't alter the pgadmin4 'paths' to serve in the frontend, we have to take the much more evil path of serving this as a subdomain - pgadmin.domain.tld with corresponding SSL certificates.

The nginx configuration bits would be as follows:

server {
    listen 80;

    server_name pgadmin.domain.tld;

    # Redirect any non-HTTPS requests to HTTPS (aka: Force HTTPS)
    return 301 https://pgadmin.domain.tld$request_uri;
}

server {
    listen 443 ssl;

    # SSL Config goes here, but the bare minimum is this:
    ssl_certificate /path/to/ssl/cert/with/fullchains.pem;
    ssl_certificate_key /path/to/privkey.pem;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://127.0.0.1:5050;
    }
}

This presupposes you already have, or know how to get, the SSL certificates to put into place in the configurations. However that's outside the scope of the question.

This is, unfortunately, the most simple solution to getting pgadmin4 to work with a 'reverse proxy', but you won't be able to easily do it within a location block on an existing site. It's been requested for a couple years but never developed.

Just make sure you also harden the server and close off ports that shouldn't be accessed directly (like the pgadmin4 port from the 'outside'). Otherwise the reverse proxy component can be circumvented easily.

Run Pgadmin4 behind reverse proxy

2 Answers2