[Mercure] Add HTTPS for `MERCURE_URL` and `MERCURE_PUBLIC_URL`

[seb-jean]

Hello :),
On my local environment, I'm using an HTTPS connection and the Mercure recipe files. However, MERCURE_PUBLIC_URL and MERCURE_URL are in HTTP.

When I run symfony var:export --multiline | grep MERCURE, I get the following lines:

export MERCURE_PUBLIC_URL=http://127.0.0.1:32928/.well-known/mercure
export MERCURE_URL=http://127.0.0.1:32928/.well-known/mercure

I would rather have the URLs in HTTPS.

Is there any additional configuration missing from the recipe?

# compose.yaml

[...]

###> symfony/mercure-bundle ###
  mercure:
    image: dunglas/mercure
    restart: unless-stopped
    environment:
      # Uncomment the following line to disable HTTPS,
      SERVER_NAME: ':80'
      MERCURE_PUBLISHER_JWT_KEY: '!ChangeThisMercureHubJWTSecretKey!'
      MERCURE_SUBSCRIBER_JWT_KEY: '!ChangeThisMercureHubJWTSecretKey!'
      # Set the URL of your Symfony project (without trailing slash!) as value of the cors_origins directive
      MERCURE_EXTRA_DIRECTIVES: |
        cors_origins https://127.0.0.1:8000
    # Comment the following line to disable the development mode
    command: /usr/bin/caddy run --config /etc/caddy/dev.Caddyfile
    healthcheck:
      test: ["CMD", "curl", "-f", "https://localhost/healthz"]
      timeout: 5s
      retries: 5
      start_period: 60s
    volumes:
      - mercure_data:/data
      - mercure_config:/config
###< symfony/mercure-bundle ###

# compose.override.yaml

[...]

###> symfony/mercure-bundle ###
  mercure:
    ports:
      - "80"
###< symfony/mercure-bundle ###

Thanks!

[maxhelias]

The MERCURE_URL variable can be set to HTTP when the application and the Mercure hub share the same network (e.g., Docker), allowing you to disable unnecessary SSL verification in a trusted environment.

[seb-jean]

Hello @maxhelias, how do you do this?
The only file where MERCURE_URL is set is in the .env file
MERCURE_URL=https://example.com/.well-known/mercure

[maxhelias]

You can see an example here : https://github.com/dunglas/symfony-docker/blob/main/compose.yaml#L12-L13

[maxhelias]

And if you want to expose https on your mercure hub, simply expose port “443” in addition to port “80”. But your symfony http-client, or any other client, will need to know the certificate (something like this : dunglas/symfony-docker#604 (comment))

[seb-jean]

I'll add more context for better understanding :).

1. I'm in a local environment, with Docker, Symfony 7.2.5, Mercure, and Symfony CLI.
2. I ran the command symfony server:ca:install to use HTTPS locally.
3. I accessed my website with the URL https://127.0.0.1:8000
4. I got an error: Access to resource at 'http://127.0.0.1:58290/.well-known/mercure?topic=notifications_1CNJAXZK51rBs7Cp6tLrrJ' from origin 'https://127.0.0.1:8000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I then changed the value of cors_origins and uncommented SERVER_NAME in compose.yaml:

# compose.yaml

services:
  mercure:
    environment:
      #SERVER_NAME: ':80'
      MERCURE_EXTRA_DIRECTIVES: |
        cors_origins http://127.0.0.1:8000

to

# compose.yaml
  mercure:
    environment:
      SERVER_NAME: ':80'
      MERCURE_EXTRA_DIRECTIVES: |
        cors_origins https://127.0.0.1:8000

5. The error regarding CORS policy is no longer present.
6. I'm using turbo_stream_listen("topics", "default", { subscribe: 'topics', withCredentials: true }} which calls mercure() Twig function.
7. The mercureAuthorization cookie is created correctly.
8. The publish is done correctly; I can see it in the Mercure tab of the Symfony profiler.
9. I launch another browser to view the subscription. The subscription is not successful; I don't receive anything.
10. I think the problem is that I'm on https://127.0.0.1:8000 (HTTPS) and Mercure is listening on http://127.0.0.1:58290/.well-known/mercure?topic=notifications_1CNJAXZK51rBs7Cp6tLrrJ (HTTP).
11. I tried modifying MERCURE_URL, but that doesn't work either.

Is there a configuration I did wrong? Is this normal?
I have no interest in having the Mercure URL in HTTPS on a development environment.

Thanks :).

[OskarStark]

@dunglas maybe you can support us here? Many thanks 🙋‍♂️