GitLab Mattermost SSO redirects to 127.0.0.1:8065 + Bad token type

Hello!

I have a GitLab omni installation behind an Apache proxy which works fine. I’ve tried enabling and configuring GitLab Mattermost behind an Apache proxy that’s configured by Plesk with Let’s Encrypt SSL but I can’t get it to work. I have tried every possible combination from the issues I found online but none of them seems to reproduce the behaviour others have experienced. I’m not really good at Apache configuration as I usually use nginx but the company server has Apache so I must use it, here is my current configuration:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/api/v3/users/websocket [NC,OR]
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]

<Location /api/v3/users/websocket>
Require all granted
ProxyPass ws://127.0.0.1:8065/api/v3/users/websocket
ProxyPassReverse ws://127.0.0.1:8065/api/v3/users/websocket
ProxyPassReverseCookieDomain 127.0.0.1 chat.domain.com
<Location />
Require all granted
ProxyPass http://127.0.0.1:8065/
ProxyPassReverse http://chat.domain.com:8065/
ProxyPassReverseCookieDomain [external ip] chat.domain.com
</Location>

Mattermost:

mattermost_external_url 'https://chat.domain.com'
mattermost['enable'] = true
mattermost['service_use_ssl'] = false
mattermost['service_address'] = "127.0.0.1"
mattermost['service_port'] = "8065"
mattermost_nginx['enable'] = false

Here are the situations that I experienced with various configurations:

  • After authentication with GitLab I get redirected to 127.0.0.1:8065 with a bad token type error (if i have https proto header)
  • After authentication with GitLab I get redirected to mattermost with a bad token type error (if i don’t have https proto header)
  • After authentication with GitLab I get redirected to mattermost with invalid state error (when playing around with http and https urls)

The GitLab log usually shows 127.0.0.1:8065 as the redirect url. I’m completely lost, I have tried all the possible solutions I have found online. What am I doing wrong?