gitea in docker behind jwilder/nginx-proxy and jrcs/letsencrypt-nginx-proxy-companion

Question

I am stuck deploying docker image gitea/gitea:1 behind a reverse proxy jwilder/nginx-proxy with jrcs/letsencrypt-nginx-proxy-companion for automatic certificate updates. gitea is running and I can connect by the http adress with port 3000. The proxy is running also, as I have multiple apps and services e.g. sonarqube working well.

This is my docker-compose.yml:

version: "2"

services:
  server:
    image: gitea/gitea:1
    environment:
      - USER_UID=998
      - USER_GID=997
      - DB_TYPE=mysql
      - DB_HOST=172.17.0.1:3306
      - DB_NAME=gitea
      - DB_USER=gitea
      - DB_PASSWD=mysqlpassword
      - ROOT_URL=https://gitea.myhost.de
      - DOMAIN=gitea.myhost.de
      - VIRTUAL_HOST=gitea.myhost.de
      - LETSENCRYPT_HOST=gitea.myhost.de
      - [email protected]
    restart: always
    ports:
      - "3000:3000"
      - "222:22"
    expose:
      - "3000"
      - "22"
    networks:
      - frontproxy_default
    volumes:
      - /mnt/storagespace/gitea_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
networks:
  frontproxy_default:
    external: true
  default:

When i call https://gitea.myhost.de the result is

502 Bad Gateway (nginx/1.17.6)

This is the log entry:

2020/09/13 09:57:30 [error] 14323#14323: *15465 no live upstreams while connecting to upstream, client: 77.20.122.169, server: gitea.myhost.de, request: "GET / HTTP/2.0", upstream: "http://gitea.myhost.de/", host: "gitea.myhost.de"

and this is the relevant entry in nginx/conf/default.conf:

# gitea.myhost.de
upstream gitea.myhost.de {
                ## Can be connected with "frontproxy_default" network
        # gitea_server_1
            server 172.23.0.10 down;
}
server {
    server_name gitea.myhost.de;
    listen 80 ;
    access_log /var/log/nginx/access.log vhost;
    # Do not HTTPS redirect Let'sEncrypt ACME challenge
    location /.well-known/acme-challenge/ {
        auth_basic off;
        allow all;
        root /usr/share/nginx/html;
        try_files $uri =404;
        break;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}
server {
    server_name gitea.myhost.de;
    listen 443 ssl http2 ;
    access_log /var/log/nginx/access.log vhost;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/gitea.myhost.de.crt;
    ssl_certificate_key /etc/nginx/certs/gitea.myhost.de.key;
    ssl_dhparam /etc/nginx/certs/gitea.myhost.de.dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/gitea.myhost.de.chain.pem;
    add_header Strict-Transport-Security "max-age=31536000" always;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://gitea.myhost.de;
    }
}

Maybe it's a problem, I used a gitea backup for this container as suggested in https://docs.gitea.io/en-us/backup-and-restore/

What can I do to get this running? I have read this https://docs.gitea.io/en-us/reverse-proxies/ but maybe I missed something. The main point is to get letsencrypt-nginx-proxy-companion automatically managing the certificates.

Any help and tip is highly appreciated.

Answer 1

I believe all you are missing is your VIRTUAL_PORT setting in your gitea container's environment. This tells the reverse proxy container which port to connect with when routing incoming requests from your VIRTUAL_HOST domain, effectively adding along the lines of ":3000" to your upstream server in the nginx conf. This is also the case when your containers are all on the same host. By default, the reverse proxy container only listens on port 80 on that service, but since gitea docker container uses another default port of 3000, you need to tell that to the reverse proxy container essentially. See below using snippet from your compose file.

services:
  server:
    image: gitea/gitea:1
    environment:
      - USER_UID=998
      - USER_GID=997
      - DB_TYPE=mysql
      - DB_HOST=172.17.0.1:3306
      - DB_NAME=gitea
      - DB_USER=gitea
      - DB_PASSWD=mysqlpassword
      - ROOT_URL=https://gitea.myhost.de
      - DOMAIN=gitea.myhost.de
      - VIRTUAL_HOST=gitea.myhost.de
      - VIRTUAL_PORT=3000 <-------------------***Add this line***
      - LETSENCRYPT_HOST=gitea.myhost.de
      - [email protected]
    restart: always
    ports:
      - "3000:3000"
      - "222:22"
    expose:
      - "3000"
      - "22"
    networks:
      - frontproxy_default
    volumes:
      - /mnt/storagespace/gitea_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
networks:
  frontproxy_default:
    external: true
  default:

P.S.: It is not required to expose the ports if all containers are on the same host and there was no other reason other than attempting to get this to work for it.