Domain 1 running, additional services like Node-RED, Grafana and InfluxDB not available

[Martin-Wachsmuth]

Hi,

I can´t figure out how to get the VIRTUAL_PORT and VIRTUAL_PATH working for me. On my server I want to use the nginx proxy to serve one website at https://subdomain.domain1.de, which is running fine. Then I also want to build an IoT stack to collect and display sensor data with Node-RED, Influxdb and Grafana and expose those services to a second https://subdomain.domain2.de with paths like subdomain.domain2.de/nodered which forwards the request to the port 1880 of the Node-RED service. Usually you would access the service via the IP of the Server and the specified port 1880 to see the webinterface of Node-RED. I made a simple docker-compose.yaml to test it which looks like this:

version: '2'
services:
  nodered:
    image: nodered/node-red:latest
    environment:
        - TZ=Europe/Berlin
        - VIRTUAL_HOST=subdomain.domain2.de
        - LETSENCRYPT_HOST=subdomain.domain2.de
        - [email protected]
        - VIRTUAL_PATH=/nodered
        - VIRTUAL_PORT=1880
    networks:
        - proxy
    volumes:
        - nodered-storage:/data
    restart: always
volumes:
  nodered-storage:
networks:
  proxy:
    external: true

As a response from my browser I get "Cannot GET /nodered" as Error, when I open https://subdomain.domain2.de/nodered. So it seems the proxy is trying to route the traffic through but can´t reach the container. Is my docker compose file correct or do I need to add/change anything?

Thanks in advance for your tipps.

[evertramos]

@Martin-Wachsmuth please check this dicussion see if it helps:

#375

[Martin-Wachsmuth]

I´ve seen this discussion before and it may be part of the solution, but I couldn´t figure out how I have to edit the docker-compose file for my apps/services and the 'someurl.com_location_override' in the vhost.d folder to get it working. Currently it´s not working correctly and showing some strange behavior.
So far I tried the following docker-compose file for my services:

services:
  nodered:
    image: nodered/node-red:latest
    environment:
        TZ: Europe/Berlin
        VIRTUAL_HOST: subdomain.domain2.de
        LETSENCRYPT_HOST: subdomain.domain2.de
        LETSENCRYPT_EMAIL: [email protected]
        VIRTUAL_PORT: 1880
    networks:
        - proxy
    volumes:
        - nodered-storage:/data
    restart: always
  influxdb:
    image: influxdb:latest
    volumes:
      - influxdb-storage:/var/lib/influxdb
    environment:
      INFLUXDB_DB: db0
      INFLUXDB_ADMIN_USER: ${INFLUXDB_USERNAME}
      INFLUXDB_ADMIN_PASSWORD: ${INFLUXDB_PASSWORD}
      VIRTUAL_HOST: subdomain.domain2.de
      LETSENCRYPT_HOST: subdomain.domain2.de
      LETSENCRYPT_EMAIL: [email protected]
      VIRTUAL_PORT: 8086
    networks:
        - proxy
    restart: always
volumes:
  nodered-storage:
  influxdb-storage:
networks:
  proxy:
    external: true

And in the 'NGINX_FILES_PATH/data/vhost.d' I have a file called subdomain.domain2.de_location_override with following content:

location /nodered {
        proxy_pass http://127.0.0.1:1880;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#        underscores_in_headers on;
#        proxy_set_header proxy_ssl_server_name $host;
}

location /influxdb {
        proxy_pass http://127.0.0.1:8086;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#        underscores_in_headers on;
#        proxy_set_header proxy_ssl_server_name $host;
}

Now my website acts weird. When I open https://subdomain.domain2.de I get an empty website where the title says "Node-RED" and the favicon for InfluxDB, when I open https://subdomain.domain2.de/influxdb I get an empty page with the title "InfluxDB" and the favicon for InfluxDB and when I open https://subdomain.domain2.de/nodered I get to the onboarding website for my InfluxDB instance.

The routing seems to go somewhere, but not as I want to. Do I get something wrong? Is it wrong to set a VIRTUAL_HOST or do I have to set a VIRTUAL_PATH additionally even when I override the location?

[Martin-Wachsmuth]

I also restarted the nginx with docker exec -it ${NGINX_WEB} nginx -s reload and services each time after changing either the _location_override or docker-compose.yaml

[Martin-Wachsmuth]

I´ve tried to dig deeper but couldn´t find a solution yet. It seems like the VIRTUAL_PATH is not working as expected. I used the following docker-compose.yml:

services:
  nodered:
    image: nodered/node-red:latest
    environment:
        TZ: Europe/Berlin
        VIRTUAL_HOST: subdomain.domain2.de
        VIRTUAL_PATH: /nodered
        LETSENCRYPT_HOST: subdomain.domain2.de
        LETSENCRYPT_EMAIL: [email protected]
        VIRTUAL_PORT: 1880
    networks:
        - proxy
    volumes:
        - nodered-storage:/data
    restart: always
  influxdb:
    image: influxdb:latest
    volumes:
      - influxdb-storage:/var/lib/influxdb
    environment:
      INFLUXDB_DB: db0
      INFLUXDB_ADMIN_USER: ${INFLUXDB_USERNAME}
      INFLUXDB_ADMIN_PASSWORD: ${INFLUXDB_PASSWORD}
      VIRTUAL_HOST: subdomain.domain2.de
      VIRTUAL_PATH: /influxdb
      LETSENCRYPT_HOST: subdomain.domain2.de
      LETSENCRYPT_EMAIL: [email protected]
      VIRTUAL_PORT: 8086
    networks:
        - proxy
    restart: always
volumes:
  nodered-storage:
  influxdb-storage:
networks:
  proxy:
    external: true

but removed subdomain.domain2.de_location_override in 'NGINX_FILES_PATH/data/vhost.d' (mainly to reduce further error sources).
After starting my services I checked the configuration file /etc/nginx/conf.d/default.conf inside the container. The content of the config file raised my suspicion:

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
                ssl_protocols TLSv1.2 TLSv1.3;
                ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
                ssl_prefer_server_ciphers off;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
        server_name _; # This is just an invalid value which will never trigger on a real hostname.
        listen 80;
        access_log /var/log/nginx/access.log vhost;
        return 503;
}
server {
        server_name _; # This is just an invalid value which will never trigger on a real hostname.
        listen 443 ssl http2;
        access_log /var/log/nginx/access.log vhost;
        return 503;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/default.crt;
        ssl_certificate_key /etc/nginx/certs/default.key;
}
# subdomain.domain2.de
upstream subdomain.domain2.de{
                                ## Can be connected with "proxy" network
                        # iot-stack-influxdb-1
                        server 172.28.0.7:8086;
                                ## Can be connected with "proxy" network
                        # iot-stack-nodered-1
                        server 172.28.0.6:1880;
}
server {
        server_name subdomain.domain2.de;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        # Do not HTTPS redirect Let'sEncrypt ACME challenge
        location /.well-known/acme-challenge/ {
                auth_basic off;
                allow all;
                root /usr/share/nginx/html;
                try_files $uri =404;
                break;
        }
        location / {
                return 301 https://$host$request_uri;
        }
}
server {
        server_name subdomain.domain2.de;
        listen 443 ssl http2 ;
        access_log /var/log/nginx/access.log vhost;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/ subdomain.domain2.de.crt;
        ssl_certificate_key /etc/nginx/certs/ subdomain.domain2.de.key;
        ssl_dhparam /etc/nginx/certs/ subdomain.domain2.de.dhparam.pem;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/certs/ subdomain.domain2.de.chain.pem;
        add_header Strict-Transport-Security "max-age=31536000" always;
        include /etc/nginx/vhost.d/default;
        location / {
                proxy_pass http:// subdomain.domain2.de;
        }
}
# subdomain.domain1.de
upstream subdomain.domain1.de {
                                ## Can be connected with "proxy" network
                        # boring_wilbur
                        server 172.28.0.5:80;
}
server {
        server_name subdomain.domain1.de;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        # Do not HTTPS redirect Let'sEncrypt ACME challenge
        location /.well-known/acme-challenge/ {
                auth_basic off;
                allow all;
                root /usr/share/nginx/html;
                try_files $uri =404;
                break;
        }
        location / {
                return 301 https://$host$request_uri;
        }
}
server {
        server_name subdomain.domain1.de;
        listen 443 ssl http2 ;
        access_log /var/log/nginx/access.log vhost;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/ subdomain.domain1.de.crt;
        ssl_certificate_key /etc/nginx/certs/ subdomain.domain1.de.key;
        ssl_dhparam /etc/nginx/certs/ subdomain.domain1.de.dhparam.pem;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/certs/ subdomain.domain1.de.chain.pem;
        add_header Strict-Transport-Security "max-age=31536000" always;
        include /etc/nginx/vhost.d/default;
        location / {
                proxy_pass http:// subdomain.domain1.de;
        }
}

As stated in my first post the service of domain1 is running fine and was started using the docker run -dit -e VIRTUAL_HOST=your.domain.com --network=proxy --name app-name app:image as shown in the documentation.

To me it seems strange, that both internal IPs and ports of my containers end up in one upstream definition and that there are no special location blocks for my specified paths. This should look different right?

I also found this issue report: nginx-proxy/nginx-proxy#1647 which lead to the following pull request: nginx-proxy/nginx-proxy#1607. But since the problem was solved there, it should be solved for this repository as well, since the fresh-start.sh gets it´s nginx.tmpl template from there.

Am I overlooking something? I really can´t find the root of my problem.

[Martin-Wachsmuth]

I finally got it running and it seems there were multiple problems.
First I ran the update-nginx-template.sh from the /nginx-proxy-automation/bin/ folder. This solved my problem regarding individual URL paths and the according upstream blocks in the nginx configuration. Maybe the update didn´t work when I used the fresh-start.sh script. However the nginx template update helped.

To get the services running was a separate task, which wasn´t necessarily problematic from the proxy automation, but from the different apps themselves.

InfluxDB (currently) won’t run under a path and is expecting to run under its own domain and in the root path. The easiest way to work around for me was to create its own subdomain influxdb.domain2.de. I wanted to avoid this, but the following discussion indicated, that there seems to be no other easy way: influxdata/influxdb#15721.

For grafana it was quite easy. Additionally to the usual configuration in the docker-compose file I had to change some configs for grafana itself following this tutorial: https://grafana.com/tutorials/run-grafana-behind-a-proxy/.

Node-RED is still a bit tricky. After starting the service I still get the Cannot GET /nodered/ Error in my browser. To get it running, I need to change the nginx configuration under ~/proxy/data/conf.d/default.conf manually from

location /nodered/ {
       proxy_pass http://subdomain.domain2.de-730caeaba6828d3abd7bc9fabf17eb162b79b478;
       set $upstream_keepalive false;
   } 

to

location /nodered/ {
        proxy_pass http://subdomain.domain2.de-730caeaba6828d3abd7bc9fabf17eb162b79b478/;
        set $upstream_keepalive false;
    }

So the difference is just the slash in the proxy_pass line. I don´t know if there is a way to include the slash automatically. On the other hand it isn´t a big deal to do it. The only thing which is a bit annoying is, to keep that in mind if I add additional websites/services, which would change my default.conf file.

I hope this helps others, which might struggle as I did.