right. I have put nginx in place to do the proxy functionality which Apache2 did so far. however, the result is the same. Even though we can serve the static files through nginx in a static context but the assumption that any thing prefixed with "/web/" is satic failed us as /web/webclient seems to be a dynamic context i.e. cannot be found as file.

The question remains: We cannot redirect ^/.* as we have this already assigned to another application. Hence we would like to prefix the virtual path with "/internal/erp". However, this seems difficult if not impossible. We hoped that "static_http_url_prefix" would solve our issue, but that was not the case. openerp-server.conf

[options]
without_demo = False
unaccent = False
db_template = template1
db_password = noneofyourbusiness
xmlrpcs = True
xmlrpcs_interface =
syslog = False
logrotate = True
xmlrpcs_port = 8071
test_report_directory = False
list_db = True
timezone = False
xmlrpc_interface =
test_file = False
smtp_password = False
secure_pkey_file = server.pkey
xmlrpc_port = 8069
workers = 0
log_level = info
xmlrpc = True
admin_passwd = noneofyourbusiness
smtp_port = 25
smtp_server = localhost
static_http_url_prefix = /extern/erp
limit_request = 8192
test_commit = False
proxy_mode = True
demo = {}
dbfilter = .*
login_message = False
import_partial =
pidfile = False
db_maxconn = 64
osv_memory_count_limit = False
reportgz = False
osv_memory_age_limit = 1.0
netrpc_port = 8070
db_port = False
db_name = False
debug_mode = False
netrpc = False
limit_time_real = 120
limit_memory_hard = 805306368
logfile = /var/log/openerp/openerp-server.log
csv_internal_sep = ,
limit_time_cpu = 60
pg_path = None
limit_memory_soft = 671088640
static_http_enable = True
translate_modules = ['all']
smtp_ssl = False
server_wide_modules = None
netrpc_interface = 127.0.0.1
smtp_user = False
log_handler = ["[':INFO']"]
db_user = openerp
db_host = False
test_enable = False
max_cron_threads = 2
static_http_document_root = /usr/lib/pymodules/python2.6/openerp/addons/web
email_from = False
addons_path = /usr/lib/pymodules/python2.6/openerp/addons
secure_cert_file = server.cert

nginx configuration

server {
        listen   443 default;
        ssl     on;
        ssl_certificate /etc/ssl/certs/domain.com.crt;
        ssl_certificate_key /etc/ssl/private/domain.com.key;
        ssl_session_timeout  5m;
        ssl_protocols  SSLv2 SSLv3 TLSv1;
        ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
        ssl_prefer_server_ciphers   on;
        server_name  host.domain.tld;

        access_log  /var/log/nginx/webmail.domain.com.ssl_access.log;

        location ^~ /inter*/wiki/(data|conf|bin|inc) {
                deny all;
        }
        location /web {
                root /usr/share/pyshared/openerp/addons;
        }

        location /intern/erp {
                rewrite ^/intern/erp/(.*) /$1 break;
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8069;
        }

#       location /internal/ {
#               alias   /var/www/;
#               index  index.html index.htm index.php;
#       }

        location /internal/ {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8080;
        }

        location /intern/ {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8080;
        }

        location /internal/erp {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8069;
        }

        location /extern/erp {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8069;
        }
        location /external/erp {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8069;
        }

        location /extern {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:8080;
        }

        location ~ /\.ht {
                deny all;
        }

        # redirect to webmail/Zimbra
        location / {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:81;
        }
        location /zimbra/ {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:81;
        }
        location /service/ {
                proxy_set_header X-Real-IP  $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $host;
                proxy_pass hppt://127.0.0.1:81;
        }

I assume that the files served from /web/ are the static ones. Hence, I tried using the static_http_url_prefix=/external/erp, static_http_enable = True, and static_http_document_root = /usr/lib/pymodules/python2.6/openerp/addons/web This change did not have any impact.

Then I tried Apache2's RedirectMatch and RewriteRule directives but for some reason they did not kick in either.

Back to square one. no change and issue persists. Does anyone have come across this before?

Cheers, Stefan

Hum you might want to really try Virtual Hosting instead of using subdir. Here's why:

Somehow, all links produced by the application (openerp) should be relative (and it's not the case). When I speak of "all links", I mean the CSS links, the first Javascript source links, then all the RPC calls done also. And maybe more hiding here or there. So patching openerp is a long solution. Other solution are not really complete also: they involve rewriting URL in HTTP packets content on the fly. This can be done by your Proxy, but it doesn't work all the time (they must look in CSS also, and what if you build your request in javascript ?) ...

Additionaly, there are issues in Werkzeug itself preventing this to work as-is also. If you want more info: please refer to:

https://github.com/mitsuhiko/werkzeug/issues/540

Note that there's a quick fix for the werkzeug part.

So finaly, this is a no-go. Find a way to make a VirtualHost (aka http://odoo.example.com), and avoid subdir proxying (http://example.com/odoo) unless your app is very simple and won't evolve to much. So this is not for Odoo/OpenERP.

This is a "known issue" since 5.1 marked as "won't fix": https://bugs.launchpad.net/openobject-client-web/+bug/384798 (sorry, need some obscure "karma" to post a direct link, so you have to copy+paste). The use case is common (SSL proxy and EV certificate or single domain policy), so using a subdomain ist not a solution. I cannot understand why nobody addresses this. C'mon, this is a bug. And it is over five years old.