Document problems with reverse proxies and large sign-in redirects

[kenjenkins]

Not sure where this should go, maybe in the Troubleshooting page?

What's incorrect or missing

We've had a number of bug reports involving problems when running Pomerium behind another reverse proxy. My understanding is that we don't currently recommend to run Pomerium in this configuration, but it still seems fairly common. One recurring problem relates to large sign-in redirects:

• Google as Identity Provider does not work (HTTP 502) pomerium#4097
• Here is a bug...even idk how to describe it ... pomerium#4076
• v0.21.x and 0.22.x not working on synology docker pomerium#4052
• possibly even as far back as 502 Bad Gateway pomerium#426

What's the resolution?

Let's add a note in the documentation describing the problem, with examples of the configuration settings in nginx and Apache to permit these large sign-in redirects. Maybe something like this?

When operating Pomerium behind another reverse proxy, you may need to adjust your reverse proxy settings to account for long sign-in redirect URLs.

If using nginx, you may need to set something like:

proxy_buffer_size  32k;

If using Apache, you may need to set something like:

ProxyPass / http://<pomerium URL> responsefieldsize=32768
LimitRequestLine 32768