Reverse proxy (or NAT) problem

I’m setting up RT5.0.4 behind a firewall, and am using HAProxy on the firewall.
As long as I run RT5 as root on port 80, everything seems to work properly, but when I switch to port 8080 (to avoid running as root) I find that RT starts redirecting to : which of course doesn’t work.

The HAProxy part works great, but for reference its config is (lightly redacted):

    bind name ssl prefer-client-ciphers ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256 ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 crt-list /tmp/haproxy/ssl/65e7e651e8d489.80192286.certlist 
    mode http
    option http-keep-alive
    option forwardfor
    option httplog
    option socket-stats
    mode http
    http-reuse safe

So far I’ve set in (partial, I haven’t included everything):

Set( $rtname, '');
Set( $Organization, '' );
Set( $WebDomain, '');
Set( $WebPort, '443' );
Set( $WebBaseURL, '');
Set( $DevelMode, 1 );
Set( $WebSecureCookies, 0 );
Set( $Timezone, 'US/Eastern' );

RT5 itself is being invoked as uid/gid _rt:_rt, and /var/www/rt/* is all chown’d to _rt:_rt. I’m using the built-in Starlet/Plask HTTP server until I get it all working.

When I hit I get the login page, correctly.
If I provide an incorrect password, I get told that immediately - no problem so far.
But if I login with valid credentials, I get redirected to which of course doesn’t work at all.
If I then go back to suddenly I’m logged in!

Any ideas why RT is redirecting to a completely bogus URL that never existed, doesn’t exist, and will never exist?

Again, if I take out WebBaseURL, set WebPort to 80, adjust the HAproxy config, it works 100%. I’m baffled.
Oh, it doesn’t seem to matter what I set WebPort to, nor what I set WebBaseURL to it always redirects to http on port 8080.


Hi, Adam. Did you set $WebBaseURL, $WebURL and/or $CanonicalizeRedirectURLs?
Check RT Config - RT 5.0.5 Documentation - Best Practical

I had missed the setting to Canonicalize redirects (and feeds, too).
It works now.
Thank you!