brianpooe/homelab-blueprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix WebSocket for UDM and UNAS by stripping Origin header

Browse source 
UniFi devices validate the Origin header on WebSocket upgrades and reject
connections where it doesn't match their own hostname, causing real-time
dashboard stats to show N/A. Add unifi-upstream snippet that strips Origin
before forwarding, and apply it to both udm and unas proxy blocks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Brian Pooe 2026-06-20 22:15:22 +02:00
parent c4b6fd0783
commit 4db6fdc36b
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
docker-compose-files/caddy/Caddyfile_template
View file

@ -50,6 +50,18 @@
header_up Host {upstream_hostport}
}
# Like office-admin-upstream but also strips the Origin header.
# UniFi devices (UDM, UNAS) validate Origin on WebSocket upgrades and reject
# connections where Origin doesn't match their own hostname, causing real-time
# dashboard stats to show N/A. Stripping Origin bypasses that check.
(unifi-upstream) {
transport http {
tls_insecure_skip_verify
}
header_up Host {upstream_hostport}
header_up -Origin
}
# Shared security headers for office admin apps.
(office-admin-security) {
header {
@ -71,7 +83,7 @@ switchlite8poe.{{CADDY_BASE_DOMAIN:-home.example.com}} {
udm.{{CADDY_BASE_DOMAIN:-home.example.com}} {
import common
reverse_proxy {{CADDY_LAN_PREFIX:-10.0.1}}.1:443 {
import office-admin-upstream
import unifi-upstream
}
import office-admin-security
}
@ -96,7 +108,7 @@ nas.{{CADDY_BASE_DOMAIN:-home.example.com}} {
unas.{{CADDY_BASE_DOMAIN:-home.example.com}} {
import common
reverse_proxy {{CADDY_OFFICE_PREFIX:-10.0.10}}.25:443 {
import office-admin-upstream
import unifi-upstream
}
import office-admin-security
}