Lost connection to https://... on production setup with grails backend

I trying to enable websocket on production environment without success. In dev, locally everything start working after 5 minutes, but on prod with nginx+tomcat+CF I have a problem Connection closed in a second

Chrome

FireFox

I see problems during connection, but can't fix it.

The setup is:

• cloudflare with certificate termination (Tested without proxifying, same result)
• nginx on app server
• tomcat 8.5

Grails 4.0.13

The setup is very basic:

$(function() {

   var socket = new SockJS("/stomp");
   var client = webstomp.over(socket);
    
   client.connect({}, function() {
   client.subscribe("/topic/hello", function(message) {
   $("#helloDiv").append("ALL:"+message.body);
   });
    
   $("#helloButton").click(function() {
   client.send("/app/hello", JSON.stringify("world"));
   });
   });

java config with one custom line:

@CompileStatic
@Configuration
@EnableWebSocketMessageBroker
class WebSocketConfig implements WebSocketMessageBrokerConfigurer {

  @Override
  void configureMessageBroker(MessageBrokerRegistry messageBrokerRegistry) {
    messageBrokerRegistry.enableSimpleBroker "/queue", "/topic"
    messageBrokerRegistry.setApplicationDestinationPrefixes "/app"
  }

  @Override
  void registerStompEndpoints(StompEndpointRegistry stompEndpointRegistry) {
// ######custom code, to avoid 403 with https
    stompEndpointRegistry.addEndpoint("/stomp").setAllowedOrigins("*")  
    stompEndpointRegistry.addEndpoint("/stomp").setAllowedOrigins("*").withSockJS()
  }

  @Bean
  GrailsSimpAnnotationMethodMessageHandler grailsSimpAnnotationMethodMessageHandler(
      SubscribableChannel clientInboundChannel,
      MessageChannel clientOutboundChannel,
      SimpMessageSendingOperations brokerMessagingTemplate
  ) {
    def handler = new GrailsSimpAnnotationMethodMessageHandler(clientInboundChannel, clientOutboundChannel, brokerMessagingTemplate)
    handler.destinationPrefixes = ["/app"]
    return handler
  }

  @Bean
  GrailsWebSocketAnnotationMethodMessageHandler grailsWebSocketAnnotationMethodMessageHandler(
      SubscribableChannel clientInboundChannel,
      MessageChannel clientOutboundChannel,
      SimpMessageSendingOperations brokerMessagingTemplate
  ) {
    def handler = new GrailsWebSocketAnnotationMethodMessageHandler(clientInboundChannel, clientOutboundChannel, brokerMessagingTemplate)
    handler.destinationPrefixes = ["/app"]
    return handler
  }

build.gradle

  implementation "org.grails.plugins:grails-spring-websocket:2.5.0.RC1"
  implementation platform("io.netty:netty-bom:4.1.79.Final")
  implementation platform("io.projectreactor:reactor-bom:Californium-SR6")
  implementation "io.netty:netty-all"
  implementation "io.projectreactor.netty:reactor-netty"

nginx-app

map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

....
  location /stomp/ {
    proxy_pass http://upstr;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 86400;
  }

Any ideas in what direction should I dig?

UPDATE Same thing without https-wss