Unable to view the consul UI on 1.10.1+ent

Consul
1

We have a ngnix which redirects to Consul-UI.

We have no issues with redirection with Consul 1.7.2+ent. But after upgrading to Consul1.10.1+ent we are seeing 404 - please check attached screenshot.

Example :- https://xyz.abc.com/my-console/ redirects to
https://xyz.abc.com/ui/my-console/consul/ui/

Screenshot 2023-02-27 at 8.07.19 PM
Screenshot 2023-02-27 at 8.07.19 PM3058×1306 164 KB

I can confirm ACL is enabled / set to true. But in consul-ui code - CONSUL_ACLS_ENABLED is returning false (which is disabling the UI elements).

@service('env') env;
  get can() {
    return this.env.var('CONSUL_ACLS_ENABLED');
  }

But after we click on Go back in the attached screenshot - it lists the consul services (https://xyz.abc.com/ui/xyz/services), but we do not see any options to select nodes/services/key value/ intentions etc.

Below is the html code which redirects to Consul UI :-

<div class="consul btn-logo" onclick="window.location.href='/my-console/consul/ui/';">
  <div class="logo"></div>
  <div class="fd-button fd-button--emphasized"> Consul</div>
</div>

Nginx rewrite conf :-

location ~ ^/(consul|nomad)  {
    if ($request_method ~ "(PUT)|(POST)" ) {
        return 405;
    }
    rewrite ^/(consul)/(.*)$ /$2  break;
    include custom.location.conf;
    proxy_pass http://$1-ws;
    proxy_set_header Accept-Encoding "";
 }

Below is the custom.location.conf :-

sub_filter_once off;
sub_filter_types *;
sub_filter '/ui//' '/my-console/$1/ui//';
sub_filter 'rootURL: \'/ui/\''  'rootURL: \'/my-console/$1/ui/\'';
sub_filter '/ui/assets' '/my-console/$1/ui/assets';
sub_filter '\"v1\"' '\"my-console/$1/v1\"';
sub_filter '/v1/' '/my-console/$1/v1/'

I wanted to know if its an issue with ACLs or any nginx configuration or the consul-ui version! I can provide more information if needed

Any help or guidance would be appreciated, thanks.

2

Consul’s web UI is a complex JavaScript application. To the best of my knowledge, it doesn’t support being hosted behind an HTTP proxy which rewrites the URL path in this way.

(Although I know the ui_config.content_path option exists, it sounds like it just moves the UI resources, and not the access to the Consul API which is also needed by the UI to display.)

Because of this, I would switch to using a unique hostname for each HashiCorp product, and not try to rewrite the URL-paths.

3

Thanks for the reply maxb.

So, in that case the access to Consul API is moved along with UI resources in 1.7.2 ? As it currently works with this older version but not with 1.10.1.

4

Consul 1.7 is a very long time ago. It might have used simpler UI technologies with less JavaScript, that didn’t care about the URL path being re-mapped, whilst the newer UI does.