From 9528400c6e86ea9f3c88e8de5483a828ba45aa6b Mon Sep 17 00:00:00 2001 From: Yamila Moreno Date: Thu, 13 Aug 2026 12:03:27 +0200 Subject: [PATCH] :bug: Forward internal Host in nginx proxy_pass to backend/exporter (#11233) The global `proxy_set_header Host $http_host;` forwarded the client-facing Host to internal proxy_pass calls (backend/exporter), breaking mTLS routing in service-mesh setups (e.g. Istio STRICT mode), which match outbound requests to a cluster based on Host/:authority. Explicitly set `Host $proxy_host` on /api, /assets, /api/export, /readyz and /ws/notifications so these calls always target the correct internal service host, independent of the client's original Host header. Fixes #10835 Signed-off-by: Sebastien MALOT Co-authored-by: Sebastien MALOT --- docker/images/files/nginx.conf.template | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docker/images/files/nginx.conf.template b/docker/images/files/nginx.conf.template index 3e91a91714..5ca929c124 100644 --- a/docker/images/files/nginx.conf.template +++ b/docker/images/files/nginx.conf.template @@ -111,6 +111,7 @@ http { } location /assets { + proxy_set_header Host $proxy_host; proxy_pass $PENPOT_BACKEND_URI/assets; recursive_error_pages on; proxy_intercept_errors on; @@ -127,10 +128,12 @@ http { } location /api/export { + proxy_set_header Host $proxy_host; proxy_pass $PENPOT_EXPORTER_URI; } location /api { + proxy_set_header Host $proxy_host; proxy_pass $PENPOT_BACKEND_URI/api; proxy_buffering off; } @@ -142,10 +145,12 @@ http { location /readyz { access_log off; + proxy_set_header Host $proxy_host; proxy_pass $PENPOT_BACKEND_URI$request_uri; } location /ws/notifications { + proxy_set_header Host $proxy_host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_pass $PENPOT_BACKEND_URI/ws/notifications;