Lost connection to https://... on production setup with grails backend - nginx

Question

I trying to enable websocket on production environment without success.
In dev, locally everything start working after 5 minutes, but on prod with nginx+tomcat+CF I have a problem
Connection closed in a second
Chrome
FireFox
I see problems during connection, but can't fix it.
The setup is:
cloudflare with certificate termination (Tested without proxifying, same result)
nginx on app server
tomcat 8.5
Grails 4.0.13
The setup is very basic:
$(function() {
  var socket = new SockJS("/stomp");
  var client = webstomp.over(socket);
   
  client.connect({}, function() {
  client.subscribe("/topic/hello", function(message) {
  $("#helloDiv").append("ALL:"+message.body);
  });
   
  $("#helloButton").click(function() {
  client.send("/app/hello", JSON.stringify("world"));
  });
  });
java config with one custom line:
#CompileStatic
#Configuration
#EnableWebSocketMessageBroker
class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
#Override
void configureMessageBroker(MessageBrokerRegistry messageBrokerRegistry) {
messageBrokerRegistry.enableSimpleBroker "/queue", "/topic"
messageBrokerRegistry.setApplicationDestinationPrefixes "/app"
}
#Override
void registerStompEndpoints(StompEndpointRegistry stompEndpointRegistry) {
// ######custom code, to avoid 403 with https
stompEndpointRegistry.addEndpoint("/stomp").setAllowedOrigins("*")
stompEndpointRegistry.addEndpoint("/stomp").setAllowedOrigins("*").withSockJS()
}
#Bean
GrailsSimpAnnotationMethodMessageHandler grailsSimpAnnotationMethodMessageHandler(
SubscribableChannel clientInboundChannel,
MessageChannel clientOutboundChannel,
SimpMessageSendingOperations brokerMessagingTemplate
) {
def handler = new GrailsSimpAnnotationMethodMessageHandler(clientInboundChannel, clientOutboundChannel, brokerMessagingTemplate)
handler.destinationPrefixes = ["/app"]
return handler
}
#Bean
GrailsWebSocketAnnotationMethodMessageHandler grailsWebSocketAnnotationMethodMessageHandler(
SubscribableChannel clientInboundChannel,
MessageChannel clientOutboundChannel,
SimpMessageSendingOperations brokerMessagingTemplate
) {
def handler = new GrailsWebSocketAnnotationMethodMessageHandler(clientInboundChannel, clientOutboundChannel, brokerMessagingTemplate)
handler.destinationPrefixes = ["/app"]
return handler
}
build.gradle
implementation "org.grails.plugins:grails-spring-websocket:2.5.0.RC1"
implementation platform("io.netty:netty-bom:4.1.79.Final")
implementation platform("io.projectreactor:reactor-bom:Californium-SR6")
implementation "io.netty:netty-all"
implementation "io.projectreactor.netty:reactor-netty"
nginx-app
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
....
location /stomp/ {
proxy_pass http://upstr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 86400;
}
Any ideas in what direction should I dig?
UPDATE
Same thing without https-wss