Can Zoraxy proxy an HTTPS request to HTTP?

[comporder1]

I have tried to read through all of the discussions and issues for an answer to this, but couldn't find anything. Sorry if this has been answered.
I would like to have an incoming HTTPS request proxy to an http request to a local server. I think I have tried every setting I can find but nothing seems to work. The problem is the local server will not serve via https. And I don't want to publicly serve on port 80.

[tobychui]

Yes, try follow the quick start walk through if you have difficulties finding the settings.

[comporder1]

Thank you for the reply tobychui. I didn't mean to imply that I do not understand how zoraxy works. I have 6 proxies currently set up and working well. Thank you for creating such an easy tool. But all of those services can serve https. Most use self-signed certificates, so I simply check the ignore box for that. However, on this particular service, it will not serve via https at all. The service is Home Assistant. It by default is http://IP:8123. If you try https://IP:8123 you get nothing. Below is my proxy rule:

When I try to access the site using the url I get:

Where does the this 400 error come from? Maybe I have it configured correctly, but there is a bug?

Other settings:

Thanks for any additional insight.

[comporder1]

I found this comment you made on another thread....
#463 (comment)
But my case seems different than this. I am accessing via https (incoming to zoraxy, see previous screenshot). I have following upstream settings:

[tobychui]

@comporder1 That 400 doesn't seems like it come from Zoraxy. You can check the log file to see if it is originated from Zoraxy. If yes, you will see 400 in your log file too.

Since I have no idea how your HA is set up, have you tried enabling TLS and Skip verification in your upstream settings?

[comporder1]

Thanks again for the reply Tobychui.
Short answer: Yes, I have tried enabling TLS and Skip verification.

Long answer: My HA install is 100% fresh install of Home Assistant OS on proxmox using the install script from https://community-scripts.github.io . All I have done is change the IP address. As stated before, I can access HA by http://ip:8123/, but if you try https://ip:8123/ you get "invalid response" in chrome. In firefox, you get...

When requesting through zoraxy (settings same as previous post) here is what I see in the logs (IP addresses redacted):
[2025-03-25 13:12:44.992087] [router:host-http] [origin:192.x.x.x] [client x.x.x.x] GET / 400
[2025-03-25 13:12:45.119370] [router:host-http] [origin:192.x.x.x] [client x.x.x.x] GET /favicon.ico 400
and this is what I see when examining the request with chrome devtools:

It appears as though zoraxy tries to retrieve the site via HTTPS even though TLS box is not checked. It would be helpful if the log file showed the exact request to the origin server instead of just the IP address.

Let me know if there is anything else I can do to help troubleshoot this issue.

[comporder1]

Continuing to dig into this... The line "strict-origin-when-cross-origin" had me curious. So after some research I found this page - https://www.home-assistant.io/integrations/http#cors_allowed_origins

It also has info on "trusted proxies". So I looked more into HA and found logs section in the settings where I found:

So signs are pointing to additional configuration needed in HA. I will post my findings.

[comporder1]

It's working now. Home Assistant by default will not accept a connection from a reverse proxy. Since I had zero experience with HA, this has been a learning experience. I hope this thread helps others. I was able to make HA accept the connection by editing the configuration.yaml file located at ~/homeassistant/configuration.yaml (or /mnt/data/supervisor/homeassistant in my Home Assistant OS install). The highlighted "http:" section is needed.

I guess the only other way this could work is if zoraxy did not send "x-" forwarding info so that HA did not know that it was a proxy request.

[comporder1]

One more update... After reading a little more about the "http:" section of the configuration.yaml, the "base_url" is not needed. Also, it doesn't look like the loopback address is need. Lastly, rather than trusting my entire network (/24), I only trusted zoraxy's IP.

[IcedRooibos]

This fixed my issue as well - thank you for sharing!