fix: adjust reverse proxy port detection logic

Refine how the front-end proxy port is detected when running
behind Nginx to ensure correct redirect URL generation.

Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>

docker-compose/.env.example

@@ -4,6 +4,22 @@ COTURN_IMAGE=coturn/coturn:edge-alpine
 
 # Enable reverse proxy mode (e.g. Nginx in front of GLKVM Cloud).
 # When enabled, TLS is handled by the proxy and GLKVM Cloud runs in plain HTTP.
+#
+# Note:
+# In reverse-proxy mode, remote device access depends on the correct forwarded headers
+# from the front-end proxy. If these headers are missing or incorrect, GLKVM Cloud may
+# generate redirect URLs with the internal port (e.g. :10443).
+#
+# Please make sure your Nginx config includes:
+#   proxy_set_header Host                $host;
+#   proxy_set_header X-Forwarded-Host    $host;
+#   proxy_set_header X-Forwarded-Proto   $scheme;
+#   proxy_set_header X-Forwarded-Port    $server_port;
+#   proxy_set_header X-Real-IP           $remote_addr;
+#   proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
+#
+# Reference (verified working example):
+# https://github.com/gl-inet/glkvm-cloud/blob/main/docker-compose/nginx-reverse-proxy-example.conf
 REVERSE_PROXY_ENABLED=false
 
 # GLKVM access IP seen by devices/users.

http.go

@@ -351,6 +351,27 @@ func httpProxyRedirect(srv *RttyServer, c *gin.Context, group string) {
             location = fmt.Sprintf("https://%s%s?sid=%s", redirHost, cfg.AddrHttpProxy, sid)
             log.Info().Msgf("Using domain redirect: %s", location)
         } else {
+            // ---- verify forwarded headers from reverse proxy ----
+            rawHost := c.GetHeader("Host")
+            xfHost := c.GetHeader("X-Forwarded-Host")
+            xfProto := c.GetHeader("X-Forwarded-Proto")
+            xfPort := c.GetHeader("X-Forwarded-Port")
+            xRealIP := c.GetHeader("X-Real-IP")
+            xFF := c.GetHeader("X-Forwarded-For")
+
+            log.Info().Msgf(
+                "reverse-proxy info: method=%s uri=%s host=%q tls=%v remoteIP=%q",
+                c.Request.Method,
+                c.Request.URL.String(),
+                rawHost,
+                c.Request.TLS != nil,
+                c.ClientIP(),
+            )
+            log.Info().Msgf(
+                "reverse-proxy headers: Host=%q X-Forwarded-Host=%q X-Forwarded-Proto=%q X-Forwarded-Port=%q X-Real-IP=%q X-Forwarded-For=%q",
+                rawHost, xfHost, xfProto, xfPort, xRealIP, xFF,
+            )
+
             // 0) scheme: follow reverse proxy
             scheme := ""
             if v := strings.TrimSpace(c.GetHeader("X-Forwarded-Proto")); v != "" {
@@ -361,34 +382,17 @@ func httpProxyRedirect(srv *RttyServer, c *gin.Context, group string) {
                 scheme = "http"
             }
 
-            // 1) external port: prefer the one user actually accessed (Host or forwarded headers)
+            // 1) external port: prefer the one user actually accessed
             port := ""
-
-            // Prefer port from Host
-            if _, p, err := net.SplitHostPort(c.Request.Host); err == nil && p != "" {
-                port = p
-            }
-
-            // Fallback to forwarded headers
-            if port == "" {
-                if fp := strings.TrimSpace(c.GetHeader("X-Forwarded-Port")); fp != "" {
-                    port = strings.TrimSpace(strings.Split(fp, ",")[0])
-                } else if fh := strings.TrimSpace(c.GetHeader("X-Forwarded-Host")); fh != "" {
-                    fh = strings.TrimSpace(strings.Split(fh, ",")[0])
-                    if _, p, err := net.SplitHostPort(fh); err == nil && p != "" {
-                        port = p
-                    }
-                }
-            }
-
-            // 2) If still empty, fallback to cfg.AddrHttpProxy (which is a PORT, not a path)
-            if port == "" && strings.TrimSpace(cfg.AddrHttpProxy) != "" {
-                portTmp := strings.TrimSpace(cfg.AddrHttpProxy)
-                // Common cases: ":10443", "0.0.0.0:10443", "[::]:10443"
-                if _, p, err := net.SplitHostPort(portTmp); err == nil {
+            if fp := strings.TrimSpace(c.GetHeader("X-Forwarded-Port")); fp != "" {
+                port = strings.TrimSpace(strings.Split(fp, ",")[0])
+            } else if fh := strings.TrimSpace(c.GetHeader("X-Forwarded-Host")); fh != "" {
+                fh = strings.TrimSpace(strings.Split(fh, ",")[0])
+                if _, p, err := net.SplitHostPort(fh); err == nil && p != "" {
                     port = p
                 }
             }
+            log.Info().Msgf("port: %s", port)
 
             // 3) Build host: in proxy mode redirect domain to be redirHost
             hostPort := redirHost