How to check push server and fix problems with it

Update-recommendations-and-troubleshooting.md

@@ -120,7 +120,6 @@ Cache-Control: no-store, no-cache, must-revalidate
 Expires: Thu, 19 Nov 1981 08:52:00 GMT
 Pragma: no-cache
 Location: /egroupware/login.php?phpgw_forward=%252Findex.php
-
 ```
 If you see the above EGroupware containers are running, it is installed and has a working database connection.
 
@@ -136,10 +135,60 @@ Expires: Thu, 19 Nov 1981 08:52:00 GMT
 Pragma: no-cache
 Location: /egroupware/login.php?phpgw_forward=%252Findex.php
 Transfer-Encoding: chunked
-
 ```
 If you can see the correct output of 3., but not the above one, something is wrong with your proxy configuration on the host.
 
+# Check the push server and fix problems with it
+
+Push server container (```egroupware-push```) is new in 20.1 and hold a websocket connections to each connected browser. 
+
+It allows the EGroupware server-side to push updates to every user online.
+
+One way to test it's working is to login with the same account into EGroupware from two different computers, browsers or using an anonymous tab. Go to InfoLog on both and add a new InfoLog on one. It should **instantly** appear on the other one too. 
+
+> Not all apps implement push (with 20.1 release it's Calendar, InfoLog and Timesheet) or need [special configuration like Mail app on the used IMAP server](https://github.com/EGroupware/egroupware/wiki/IMAP-Push-Notifications).
+
+If it does not, open developer tools in your browser, go to the networking tab, reload (F5), search for ```push``` and click on Messages:
+[[https://raw.githubusercontent.com/wiki/EGroupware/egroupware/pics/dev-tools-push.png]]
+The green up arrow you see shows the websocket connection from your browser to the push server. A red down arrow shows messages pushed to the browser by EGroupware server-side, eg. when you add an InfoLog entry in the above test.
+
+If it does NOT show messages or type websocket with status 101, you have a configuration problem on your server, probably on the webserver used as reverse proxy on the host itself (NOT in a container!):
+1. first check with ```docker ps``` that you have a running ```egroupware-push``` container
+2. use ```curl -i https://example.org/egroupware/push``` (replacing example.org with your domain!) it should output something like:
+```
+HTTP/1.1 401 Unauthorized
+Server: nginx/1.18.0
+Date: Wed, 19 Aug 2020 16:05:45 GMT
+Content-Type: text/html
+Content-Length: 21
+Connection: keep-alive
+Www-Authenticate: Basic realm="EGroupware Push Server"
+
+Missing Bearer Token!
+```
+3. if you get ```404 Not Found``` you have not the latest webserver configuration (/etc/egrouwpare-docker/nginx.conf or apache2.conf), eg. because you made some changes and the package update did not overwrite them. In that case look for a .dpkg-dist or .rpmnew file with the same name, add your changes to that file and rename it to just nginx.conf or apache2.conf. Then you need to reload your webserver with ```nginx -s reload``` or ```systemctl restart apache2``` (or httpd on RHEL/CentOS).
+4. if you get the above output, but the not the connection in the browser (green array with ```{"subscribe":...```
+* if you use Apache make sure /etc/egroupware-docker/apache2.conf is included in the used ssl VirtualHost, including it outside the vHost does NOT work for websockets in Apache!
+* if you use eg. your firewall to terminate https or an other proxy, you have to enable websocket support! 
+
+5. if you see the green array, but no red one(s) when you eg. add an InfoLog, run the above curl command inside the ```egroupware``` container to see if you get the same output as above: ```docker exec -it egroupware curl -i https://example.org/egroupware/push```
+* ```curl: (6) Could not resolve host: example.org``` or ```curl: (7) Failed to connect to example.org port 443: Connection refused``` either your (externally) used host-name could not be resolved in the container or your firewall does not allow access from the inside to your external address. Use an [extra_hosts entry in your /etc/egroupware/docker-compose.override](https://github.com/EGroupware/build.opensuse.org/blob/master/server:eGroupWare/egroupware-docker-20.1/egroupware-docker/docker-compose.override.yml#L70) with your docker0 address to which your webserver on the host is also listening:
+```
+service:
+  egroupware:
+    extra_hosts:
+    - "example.org:172.17.0.1"
+```
+* ```curl: (60) SSL: no alternative certificate subject name matches target host name 'example.org'``` you use a self-signed certificate and need to [install your CA via /etc/egroupware-docker/docker-compose.override.yml](https://github.com/EGroupware/build.opensuse.org/blob/master/server:eGroupWare/egroupware-docker-20.1/egroupware-docker/docker-compose.override.yml#L48) in the ```egroupware``` container
+* Collabora and Rocket.Chat also need to be able to access the EGroupware container and therefore need a similar fix see their docker-compose.yml files!
+6. check the log of the push server: ```docker logs -f egroupware-push```
+* if you only see ```server: handshake success with fd****, FAILED with unknown sessionid=**********``` check that ```egroupware``` and ```egroupware-push``` container share the session volume:
+```
+docker exec -it egroupware ls /var/lib/php/sessions
+docker exec -it egroupware-push ls /var/lib/php/sessions
+```
+* both should show exactly the same session files, as they mount the same value
+
 # EGroupware container can not access MariaDB/MySQL
 > This should not happen any more with 20.1, unless you updated from 19.1, as 20.1 runs MariaDB 10.4 in a container for new installations.
 ```
@@ -184,9 +233,7 @@ So it is currently (12.2019) not recommended to run Docker on Btrfs. Otherwise,
 
 If someone has a solution, we ask for feedback in the forum.
 
-
 # How to get help
-
 EGroupware GmbH - the developers of EGroupware - offer the following support options, if you can not figure it out by yourself
 
 a) [payed professional support through EGroupware GmbH](https://www.egroupware.org/en/egroupware-support/)