"This site is read-only" after upgrade to 6.12 behind nginx

[Frederic Cremer]

Hi,

I just upgraded my Confluence server instance from 6.0 to 6.12. I always ran this behind an nginx reverse proxy, which worked perfectly fine. After the upgrade I restored the server.xml settings required to get the proxied connection working, but now everything page-related seems to be in 'read-only'. When I try to change or publish a new page, I get this warning:

This site is read-only

Starting now, any changes you make won't be saved. We'll let you know when you can start editing again.

After about half a minute, I get this message and the "Publish" button is available again:

Successfully reconnected

We're back in business. You're free to save your page again.

But it gives me the first warning again when I retry.

When I access Confluence directly (not through the nginx proxy), all works perfectly fine. Also changing admin settings or posting comments to existing pages works fine via nginx. I'm very certain it's due to my nginx configuration or server.xml configuration, but I'm failing to find my own error :)

server.xml:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
 maxThreads="48" minSpareThreads="10"
 enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
 protocol="org.apache.coyote.http11.Http11NioProtocol"
 scheme="https" secure="true" proxyName="mydomain.com" proxyPort="443"/>

<Engine name="Standalone" defaultHost="localhost" debug="0">
 <Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false" startStopThreads="4">
 <Context path="/wiki" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">

nginx configuration:

location /wiki {
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-Server $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_pass http://confhost.int.mydomain.com:8090/wiki;
 client_max_body_size 15M;
 }

location /synchrony {
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-Server $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_pass http://confhost.int.mydomain.com:8091/synchrony;
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "Upgrade";
 }

All hints or ideas appreciated, as even Confluence in diagnostic mode doesn't tell much in the log files :)

[Steve Shaw]

If the "This site is read-only" message appears while trying to publish a page, this can also result from a third party plugin.  Please see When publishing a page, the following message appears: "This site is read-only Starting now, any changes you make won't be saved. We'll let you know when you can start editing again." 

[Thomas Deiler]

Dear @Frederic Cremer,

see my apache configuration for Confluence 6.12.0 - you should be able to 'translate' it to nginx:

<VirtualHost wiki.mydomain.com:443>

 ServerName wiki.mydomain.com
 ServerAlias wiki.mydomain.com

 SSLEngine On

 SSLCertificateFile /etc/apache2/ssl/mydomain.com.crt
 SSLCertificateKeyFile /etc/apache2/ssl/mydomain.com.key
 
 ErrorLog /var/log/apache2/ssl-confluence-error.log

 # Possible values include: debug, info, notice, warn, error, crit,
 # alert, emerg.
 LogLevel warn

 CustomLog /var/log/apache2/ssl-confluence-access.log combined
 ServerSignature Off

 ProxyRequests Off
 ProxyPreserveHost On

 RewriteEngine On
 RewriteCond %{REQUEST_URI} !^/synchrony
 RewriteRule ^/(.*) http://localhost:8090/$1 [P]

 <Proxy *>
 Require all granted
 </Proxy>

 ProxyPass /synchrony http://localhost:8091/synchrony

 <Location /synchrony>
 Require all granted
 RewriteEngine on
 RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
 RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
 RewriteRule .* ws://localhost:8091%{REQUEST_URI} [P]
 </Location>

 ProxyPass / http://localhost:8090
 ProxyPassReverse / http://localhost:8090
 ProxyTimeout 300
 LimitRequestBody 10485760

 <Location />
 Require all granted
 </Location>

</VirtualHost>

The difference is that confluence is not on /wiki but on / . And there is no "rewrite" stuff.

At server.xml just the following line was added:

proxyName="wiki.mydomain.com" proxyPort="443" scheme="https"

Probably this helps. Let me know.

So long

Thomas

[Frederic Cremer]

Hi Thomas,

Thanks for your input. However, I found the root cause: my hardened nginx configuration was blocking all non-GET/HEAD/POST HTTP requests/responses ... Nothing to do with Confluence or nginx itself :)