Problem with setting plantit for reverse proxy

[lockheed]

I am using caddy and the docker-compose for treafik is not clear to me.

Here's my docker-compose with external db.

`version: "3"
name: plant-it
services:
server:
image: msdeluise/plant-it-server:latest
container_name: plant-it
environment:
MYSQL_HOST: mariadb
MYSQL_PORT: 3306
MYSQL_USERNAME: plantiter
MYSQL_PSW: pass
MYSQL_DATABASE: plantit
TZ: Europe/Warsaw
JWT_SECRET: plantpass
JWT_EXP: 1
USERS_LIMIT: -1
UPLOAD_DIR: /upload-dir
API_PORT: 8080
TREFLE_KEY: null
LOG_LEVEL: DEBUG
ALLOWED_ORIGINS: ""
CACHE_TTL: 86400
CACHE_HOST: cache
CACHE_PORT: 6379
SSL_ENABLED: false
CERTIFICATE_PATH: /certificates/
volumes:
- /z/services/plantit/upload:/upload-dir
- /z/services/plantit/certs:/certificates
networks:
- frontend
- db-net
labels:
caddy: plantit.mydomain.com
caddy.reverse_proxy: " {{upstreams 3000}}"
restart: unless-stopped
cache:
image: redis:7.2.1
container_name: plant-it-cache
restart: always
networks:
- db-net
networks:
frontend:
external: true
db-net:
external: true

Then I get to the homepage, but the first step there is to set the URL and it doesn't accept my domain.

Do I need TWO public domains to host PlantIt? One for 3000 and the other one for 8080? Why would API need a separate public domain? Unfortunately, your documentation says nothing about it.

[MDeLuise]

Hi @lockheed, thanks for opening the issue.
I'm seeing that some users have problems with nginx/traefik, I plant to create a local dummy environment to inspect the behavior more closely.

In general, the URL you should insert in the server URL configuration is the same as the one used to access the Swagger UI console. So, if you're able to reach the Swagger UI, the application should theoretically be able to connect to the server.

Could you please confirm whether you're able to connect to Swagger at <url_you_try_to_use>:<port>/api/swagger-ui/index.html? The default port in the docker-compose file is 8080, but if you've changed the port binding, please use that value instead.

If everything works fine, you should see something like this

[szszl0]

i have the same problem while using nginx proxy manager. I can connect to swagger but still when trying to use my https://plant.mydomain.xxx i get the "cannot connect to server error". Any solutions? Everything works in android app and the raw http://adress.xxx:3000...

[lockheed]

The port part is what doesn't make sense to me. Reverse proxy by nature only forward one port, and it is port 443 (HTTPS) and nothing else, so how could it access 8080? It cannot.

This is the only web app I know of that requires more than one port to get into.

[martinbjeldbak]

You can certainly run a reverse proxy fronting multiple ports. For example, here is my working Caddyfile

*.local.martinbjeldbak.com {
	@plantit host plant-it.local.martinbjeldbak.com
	handle @plantit {
		reverse_proxy plant-it:3000
	}

	@plantitapi host plant-it-api.local.martinbjeldbak.com
	handle @plantitapi {
		reverse_proxy plant-it:8080
	}

	# Fallback for otherwise unhandled domains
	handle {
		abort
	}
}

where plant-it is the service name of the container running in the docker network. In your case, it'd be server.

If curious, you can see full implementation in my repository here: https://github.com/martinbjeldbak/self-hosted

[mnfctrdinitaly]

I'm having the same issues... i've deployed behind nginx and using authelia to authenticate. (Although all the troubleshooting has been set to bypass authelia.)

I can access the welcome page using the subdomain "plants.example.tld" but when I try to use that to access the api/backend (using the suggest url host : port /api/swagger-ui/index.html i always get this error:

Error response
Error code: 404

Message: File not found.

Error code explanation: 404 - Nothing matches the given URI.

The nginx conf file has been tried in two configurations:
Config 1

subdomain.example.tld proxy to plant-it:3000
subdomain2.axample.tld proxy to plant-it:8080

Config 2

subdomain.example.tld/ proxy to plant-it:3000
subdomain.example.tld/api proxy to plant-it:8080

Neither configuration works...

Please help?

[jmrplens]

For people who have problems with Nginx, when there are different ports must be configured different upstream, here I leave the configuration that works correctly for a docker installation on the same server as Nginx:

upstream plantitfrontend {
    server localhost:3000 fail_timeout=0; # Change port if you changed in docker.
}

upstream plantitbackend {
    server localhost:8080 fail_timeout=0; # Change port if you changed in docker.
}

# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

server {
    server_name plantit.domain.uri;

    # Listen Unsecure
    listen 80;
    listen [::]:80;
    
    # Redirect to https
    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }

    # Listen Secure Protocols
    listen 443 ssl;
    listen [::]:443 ssl;
    listen 443 quic;
    listen [::]:443 quic;
    http2 on;
    http3 on;
    quic_retry on;
    add_header Alt-Svc 'h3=":443"; ma=86400';
    
    # HSTS settings
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;

    # CERTS
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m; 
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers on;

    # Other Security settings
    add_header Referrer-Policy "no-referrer" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Permitted-Cross-Domain-Policies "none" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Permissions-Policy "interest-cohort=()" always;
    
    proxy_buffering off;
    
    # Redirect to Plant-it REST API
    location  ^~ /api {
        proxy_pass http://plantitbackend; # Don't use https here
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade_keepalive;
        add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
    }

    # Main frontend
    location / {
        proxy_pass http://plantitfrontend; # Don't use https here
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade_keepalive;
        add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
    }

}

I hope it helps ;)

[Dvalin21]

Can you give more explanation please? I'm not sure what Im suppose to do with this