Liquidsoap harbor served over nginx ssl

[SkillenUK]

After recently experiencing an issue with a harbor using ssl, it was suggested to me that I could terminate encrypted connections via nginx. So my understanding is that the Liquidsoap configuration would contain an unencrypted harbor hidden behind my firewall, then I would essentially configure a proxy pass in nginx for the client to connect to the harbor over an encrypted ssl connection.

The Liquidsoap harbor configuration would be similar to the following...

djlive = input.harbor("live",port=8010,password="hackme",buffer=2.)

The nginx config would be along the lines of...

server {
        listen 9010 ssl;
        server_name website.com;

        ssl_certificate /etc/ssl/certs/cert.crt;
        ssl_certificate_key /etc/ssl/private/key.key;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Port $server_port;

                include proxy_params;
                proxy_redirect off;

		proxy_pass http://localhost:8010;
        }
}

I've been experimenting with this and I'm struggling to find an nginx configuration that works. I can connect to the harbor, but the audio stream doesn't come through.

I'm wondering if anybody has any experience of this and has successfully got it working? Could you share the nginx config which worked for you? Are there any best practices for achieving this? Thanks,

Skillen.

[gAlleb]

Hi @SkillenUK

I haven't tried your set up. But try this one. Seems that you lack some crutial params. You can exlude include proxy_params; and include this:

 location / {
            proxy_pass                        http://localhost:8010;

            # Websocket
            proxy_http_version                 1.1;
            proxy_cache_bypass                 $http_upgrade;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        "upgrade";

            # Proxy headers
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host  $host;
            proxy_set_header X-Forwarded-Port  $server_port;
            proxy_set_header X-Forwarded-Scheme $scheme;
            proxy_set_header Accept-Encoding "";

            # Proxy buffering
            proxy_buffering           off;
            proxy_ignore_client_abort off;

            # Proxy timeouts if you want :)
            proxy_connect_timeout            2400s;
            proxy_send_timeout                 60s;
            proxy_read_timeout                 60s;
        }

[vitoyucepi]

You should treat icecast as a tls+tcp stream, because every server I tried cannot handle continuous streams.

So you should define a top-level stream section:

stream {
    server {
        listen 1234 ssl;
        proxy_pass liquidsoap:8000;
        ssl_certificate /etc/nginx/ssl/cert.pem;
        ssl_certificate_key /etc/nginx/ssl/key.pem;
    }
}

You should also tune the protocols and ciphers for the streams according to common security practices.

I haven't tested this with butt and metadata, but ffmpeg streaming works fine.

ffmpeg \
  -hide_banner \
  -re -f lavfi -i 'sine=frequency=200:duration=2000' \
  -b:a 320k -c:a mp3 \
  -f mp3 \
  -tls 1 \
  icecast://source:[email protected]:1234/live

While researching this topic, I came across several instructions.

• https://libretime.org/docs/admin-manual/install/reverse-proxy/

  The current input and output streams are Icecast based protocols and doesn't support being behind a reverse proxy. Don't attempt to reverse proxy Icecast or the Liquidsoap harbor inputs.

• https://stackoverflow.com/questions/51786404/icecast2-running-under-nginx-not-able-to-connect

  tl;dr - Don't reverse proxy Icecast.

• https://github.com/aswild/icecast-notes

  -chunked_post 1: use chunked transfer encoding.
  -send_expect_100 0: don't send an Expect: 100-continue header, as this confuses Icecast when combined with chunked transfer encoding.

I can't be sure, maybe everyone else has the same problem with the http proxy, but for me the problem manifests itself like this:

1. Start liquidsoap and the http proxy.
2. Start streaming.
3. Proxy gets headers with expect: 100-continue and no content-length.
4. Liquidsoap gets headers and expects content.
5. Proxy is getting stream body but isn't passing it to liquidsoap.
6. After 30 seconds liquidsoap timeouts the stream, because it doesn't receive anything except the initial headers.

[SkillenUK]

Thank you both for all of the information, it is appreciated. I'll spend some more time on it over the weekend.

@vitoyucepi I think the problem which you describe is what I am seeing now. I'll do some more testing.

Skillen.

[SkillenUK]

@vitoyucepi your suggestion has worked :)