What version are you running?

6.0
in docker image 45ada0a9f402

this is a new setup with the nginx+gunicorn setup method and a "API Gateway" on Oracle Cloud in front of the nginx port.
The "API Gateway" is setup to route https://<public server name>/<everything> to http://<private instance ip>:8080/<everything>, where 8080 is the exposed nginx port. This works, as I can login.

What's the URL of the page containing the problem?
https://<public server name>/r/3/

this page shows up, but the "Diff" tab is missing and I am unable to change fields of this request, such as Summary or Description.
Using Debug Console of the browser reveals an error, see below.

What steps will reproduce the problem?

create a new review request, ie. by uploading a patch
browse the request
not the missing Diff tab
inspect browser debug console


What is the expected output? What do you see instead?
the Diff tab would be there
editing Fields such as Summary would work
no errors in browser console

What operating system are you using? What browser?
the instance uses Ubuntu 22.04.3 LTS on ARM processor
however, Reviewboard itself runs as above mentioned Docker image, pulling the ARM sha256.

Please provide any additional information below.

the error on debug console is this:


3rdparty-base.min.js:1 Mixed Content: The page at 'https://<public server name>/r/3/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://<private instance ip>/api/review-requests/3/draft/?api_format=json&force-text-type=html&include-text-types=raw&expand=depends_on%2Ctarget_people%2Ctarget_groups'. This request has been blocked; the content must be served over HTTPS.


this is absolutely correct and can not work, even if the browser would not block it, since <private instance ip> is not routed on the internet.
also note that port 8080 is missing in <private instance ip>; this tells me the API Gateway is not involved as it is setup to always send to this port.
looking at the Network tab in the browser debug tool shows a Request Initiator chain looking like this:


https://<public server name>/r/3/
https://<public server name>/static/lib/js/3rdparty-base.min.js
http://<private instance ip>/api/review-requests/3/draft/?api_format=json&force-text-type=html&include-text-types=raw&expand=depends_on%2Ctarget_people%2Ctarget_groups

the Request call stack for this is rather long and I can't copy-paste it.

the nginx.conf setup follows the Admin Manual, with the essential part being:
    location / {
        proxy_pass http://reviewboard;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl off;
        proxy_set_header X-Real-IP $remote_addr;

        client_max_body_size        10m;
        client_body_buffer_size     128k;
        proxy_connect_timeout       90;
        proxy_send_timeout          90;
        proxy_read_timeout          90;
        proxy_headers_hash_max_size 512;
        proxy_buffer_size           4k;
        proxy_buffers               4 32k;
        proxy_busy_buffers_size     64k;
        proxy_temp_file_write_size  64k;
    }


This handles login/logout and many other things such as configuring, while some (?) /api/ requests dont ever reach this nginx since the browser gets told to send these using the <private instance ip>.
The Server name in General Settings is correctly set to <public server name> - I guess login would not be impossible otherwise.