Cannot access thumbnails over nginx proxy

[Byorun]

I am fairly new to OME and I am trying to access thumbnails over my nginx http proxy, but unfortunately I only get 404 when I access the url from the web. Streaming LLHLS works fine.

When calling curl http://127.0.0.1:3333/app/stream/thumb.jpg directly from the hosts console I get a binary response and the log shows the following

ome                | [2024-06-19 19:06:15.981] I [SPLLHLS-t3333:9] HTTP.Server | http_server.cpp:149  | Client(<ClientSocket: 0x7f3692c05010, #10, Connected, TCP, Nonblocking, 172.22.0.1:36132>) is connected on *:3333
ome                | [2024-06-19 19:06:15.982] I [SPLLHLS-t3333:9] HTTP.Server | http_server.cpp:223  | Client(<ClientSocket: 0x7f3692c05010, #10, Disconnected, TCP, Nonblocking, 172.22.0.1:36132>) has disconnected from *:3333

When calling from the web via https://hls.my.host/app/stream/thumb.jpg over the nginx proxy I get

ome                | [2024-06-19 19:07:37.224] I [SPLLHLS-t3333:9] HTTP.Server | http_server.cpp:149  | Client(<ClientSocket: 0x7f3692c05410, #10, Connected, TCP, Nonblocking, 172.22.0.1:59766>) is connected on *:3333
ome                | [2024-06-19 19:07:37.225] E [SPLLHLS-t3333:9] HTTP.Server | http_exchange.cpp:42   |
ome                | [Client] HttpConnection(0x7f3692c05010) : HTTP/1.1 <ClientSocket: 0x7f3692c05410, #10, Connected, TCP, Nonblocking, 172.22.0.1:59766> TLS(Disabled) (Elapsed: 0)
ome                | [Request] GET http://hls.my.host/app/stream/thumb.jpg (HTTP/1.0, Request Time: 2024-06-19T19:07:37.224+02:00)
ome                | [Response] 404 Not Found (95 bytes sent, Response Time: 2024-06-19T19:07:37.225+02:00)
ome                | [2024-06-19 19:07:37.225] I [SPLLHLS-t3333:9] HTTP.Server | http_server.cpp:216  | Client(<ClientSocket: 0x7f3692c05410, #10, Closed, TCP, Nonblocking, 172.22.0.1:59766>) has been disconnected by *:3333

The log also only shows http://hls.my.host/app/stream/thumb.jpg as url

Docker Compose

version: '3'
services:
    ovenmediaengine:
        container_name: ome
        environment:
            - TZ=Europe/Berlin
        ports:
          - 1935:1935
          #- 9999:9999/udp
          #- 9000:9000
          - 3333:3333
          #- 3334:3334
          #- 3478:3478
          #- 10000-10009:10000-10009/udp
        volumes:
          - type: bind
            source: ./confs
            target: /opt/ovenmediaengine/bin/origin_conf

          - type: bind
            source: ./logs
            target: /var/log/ovenmediaengine

        image: airensoft/ovenmediaengine:latest
        restart: unless-stopped
        networks:
         - ome

networks:
  ome:

Nginx

server {
        listen 443 ssl;
        listen [::]:443 ssl;


        server_name hls.my.host;

        include /etc/nginx/snippets/letsencrypt;

        location / {
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-Host $host;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                set $upstream http://127.0.0.1:3333;

                proxy_pass $upstream;
        }

        access_log off;
        error_log off;
}

Server.xml

<?xml version="1.0" encoding="UTF-8" ?>
<Server version="8">
	<Name>OvenMediaEngine</Name>
	<Type>origin</Type>
	<IP>*</IP>
	<PrivacyProtection>false</PrivacyProtection>

	<!--
        <StunServer>stun.ovenmediaengine.com:13478</StunServer>
        -->
	<Modules>
		<HTTP2>
			<Enable>false</Enable>
		</HTTP2>
		<LLHLS>
			<Enable>true</Enable>
		</LLHLS>
		<P2P>
			<Enable>false</Enable>
			<MaxClientPeersPerHostPeer>2</MaxClientPeersPerHostPeer>
		</P2P>
	</Modules>
	<!-- Settings for the ports to bind -->
	<Bind>
		<Providers>
			<RTMP>
				<Port>${env:OME_RTMP_PROV_PORT:1935}</Port>
				<WorkerCount>1</WorkerCount>
			</RTMP>
		</Providers>
		<Publishers>
			<LLHLS>
				<Port>${env:OME_LLHLS_STREAM_PORT:3333}</Port>
				<WorkerCount>2</WorkerCount>
			</LLHLS>
			<Thumbnail>
				<Port>${env:OME_LLHLS_STREAM_PORT:3333}</Port>
			</Thumbnail>
		</Publishers>
	</Bind>
	<VirtualHosts>
		<VirtualHost include="VHost*.xml"/>
		<VirtualHost>
			<Name>default</Name>
			<Distribution>my.host</Distribution>
			<!-- Settings for multi ip/domain and TLS -->
			<Host>
				<Names>
					<Name>*</Name>
				</Names>
				<TLS>
					<CertPath>/certs/cert.pem</CertPath>
					<KeyPath>/certs/privkey.pem</KeyPath>
					<ChainCertPath>/certs/chain.pem</ChainCertPath>
				</TLS>
			</Host>
			<!-- Default CORS Settings -->
			<CrossDomains>
				<Url>*</Url>
			</CrossDomains>
			<!-- Settings for applications -->
			<Applications>
				<Application>
					<Name>app</Name>
					<!-- Application type (live/vod) -->
					<Type>live</Type>
					<OutputProfiles>
						<!-- Enable this configuration if you want to hardware acceleration using GPU -->
						<HWAccels>
							<Decoder>
								<Enable>false</Enable>
							</Decoder>
							<Encoder>
								<Enable>false</Enable>
							</Encoder>
						</HWAccels>
						<OutputProfile>
							<Name>source</Name>
							<OutputStreamName>${OriginStreamName}</OutputStreamName>
							<Encodes>
								<Video>
									<Bypass>true</Bypass>
								</Video>
								<Audio>
									<Bypass>true</Bypass>
								</Audio>
								<Image>
									<Codec>jpeg</Codec>
									<Framerate>0.1</Framerate>
									<Width>640</Width>
									<Height>360</Height>
								</Image>
							</Encodes>
						</OutputProfile>
					</OutputProfiles>
					<Providers>
						<RTMP>
							<BlockDuplicateStreamName>true</BlockDuplicateStreamName>
						</RTMP>
					</Providers>
					<Publishers>
						<AppWorkerCount>1</AppWorkerCount>
						<StreamWorkerCount>8</StreamWorkerCount>
						<LLHLS>
							<OriginMode>true</OriginMode>
							<ChunkDuration>0.3</ChunkDuration>
							<PartHoldBack>1</PartHoldBack>
							<SegmentDuration>2</SegmentDuration>
							<SegmentCount>10</SegmentCount>
							<CrossDomains>
								<Url>*</Url>
							</CrossDomains>
						</LLHLS>
						<Thumbnail>
							<CrossDomains>
								<Url>*</Url>
							</CrossDomains>
						</Thumbnail>
					</Publishers>
				</Application>
			</Applications>
		</VirtualHost>
	</VirtualHosts>
</Server>

[getroot]

Your nginx is making requests to OME over http1.0. (Is it an old nginx?) We didn't expect this. We fixed it to work on http1.0, would you like to test it on the master branch?

[Byorun]

I am using nginx version: nginx/1.27.0

Do I need to pull :dev instead of :latest in order to get master?

[getroot]

I've never used nginx before, but I found out that there is a way to make requests with HTTP/1.1.
proxy_http_version
https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version

Or as you said, you can use :dev.

[Byorun]

Right now I have some trouble connecting to ome via nginx reverse proxy (probably related to some firewall rules), but I already tested it with proxy_http_version 1.1; which had the same results at that time. I will test :dev after I get nginx to talk to the server again

[Byorun]

I didn't even need the :dev container. Whatever was changed between my initial Post and the current :latest seems to fix my problem. All that remains is that ome does not evaluate X-FORWARD-* header in order to detect the real client IP behind the proxy, but this is a completely different probleme.