Different http ports in Dockerfile and container

[madmpro]

Hi!

Why in Dockerfile the exposed port is 8000 but in public container is 443?
And, why is SSL forced in nginx config? How to setup a HA proxy (Traefik by example) in this case?

[alexdelprete]

Why in Dockerfile the exposed port is 8000 but in public container is 443?

which dockerfile? the one in the repo?

And, why is SSL forced in nginx config?

Because of issue #34 (mixed-content http/https in the browser). So dev. decided to adopt SSL_MODE=full (it means nginx only listens on https/443).

I advised @alexjustesen here to use SSL_MODE=mixed as default, so NGINX accepts both http/80 and https/443 and it's up to the user choosing which one, based on his specific use-case.

How to setup a HA proxy (Traefik by example) in this case?

In the docker-compose just configure an env. variable SSL_MODE=mixed, then use traefik as with any other standard webapp/service. Do you use dynamic config files or tags in docker-compose?

I can show you my dynamic config, but it's very basic stuff...nothing really specific.

[karan]

I set SSL_MODE=mixed, and map container's port 80 to 9876. Then I configured Traefik to route requests to 9876. When I open the tracker with https, no assets load. Console shows lots of these errors:

Mixed Content: The page at 'https://domain.com/admin' was loaded over HTTPS, but requested an insecure stylesheet 'http://domain.com/filament/assets/invaders-filament-jsoneditor.css'. This request has been blocked; the content must be served over HTTPS.

Even with SSL_MODE=off, I get the same issue.

[alexdelprete]

I set SSL_MODE=mixed, and map container's port 80 to 9876. Then I configured Traefik to route requests to 9876. When I open the tracker with https, no assets load. Console shows lots of these errors:

You have mixed content because you're accessing via https on the http port. :)

If you mapped port 80, you need to use http in traefik service url, not https.
If you want to use https in traefik-speedtest combination, use port 443.

That's why I advise using SSL_MODE=mixed, so the user can choose which protocol to use http/https, but you need to map the correct port for each protocol.

[karan]

I set SSL_MODE=mixed, and map container's port 80 to 9876. Then I configured Traefik to route requests to 9876. When I open the tracker with https, no assets load. Console shows lots of these errors:

You have mixed content because you're accessing via https on the http port. :)

If you mapped port 80, you need to use http in traefik service url, not https. If you want to use https in traefik-speedtest combination, use port 443.

That's why I advise using SSL_MODE=mixed, so the user can choose which protocol to use http/https, but you need to map the correct port for each protocol.

I tried that but it wasn't working (something about https request sent over http or something like that). I'll try it again over the weekend and report back.

[alexdelprete]

I tried that but it wasn't working (something about https request sent over http or something like that). I'll try it again over the weekend and report back.

Show me your docker-compose and traefik config for speedtest-tracker, we'll find the problem.

Anyway: if in docker-compose you mapped port 80 inside the container to 9876 outside, you need to use http://docker:9876 in traefik, not https://docker:9876, because you are requesting https from an http port.

You can also map both 80 and 443 (since you used SSL_MODE=mixed) and then try with both.

[karan]

Yeah that's what I thought. After some trial and error here's what worked for me.

I'm using unraid and here's the set up:

And traefik config (traefik is running on a different machine):

http:

  middlewares:
    compression:
      compress:
        excludedContentTypes: [text/event-stream]
    crowdsec-bouncer:
      forwardauth: {address: 'http://bouncer:7875/api/v1/forwardAuth', trustForwardHeader: true}
    security:
      headers:
        accessControlAllowOriginList: [origin-list-or-null]
        accessControlMaxAge: 120
        addVaryHeader: true
        browserXssFilter: true
        contentTypeNosniff: true
        customFrameOptionsValue: SAMEORIGIN
        forceSTSHeader: true
        permissionsPolicy: camera 'none'; microphone 'none'
        referrerPolicy: same-origin
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 63072000

  routers:
    speedtest:
      service: speedtest
      rule: "Host(`speed.$DOMAIN`)"
      middlewares:
        - compression
        - crowdsec-bouncer
        - security
      tls:
        certResolver: cloudflare

  services:
    speedtest:
      loadBalancer:
        servers:
          - url: "http://$IP:9876"

Opening http://$IP:9876 directly (http) works fine. However, https://speed.$DOMAIN results in assets not loading.

Opening https://$IP:9876 results in cert error (expected) but the dashboard works fine after bypassing it. However, https://speed.$DOMAIN results in assets not loading.

In the traefik config, I had to change the url to url: "https://$IP:9877. https://speed.$DOMAIN works fine now.

[alexdelprete]

I'm using this (dynamic config), and it works both in http and https. Speedtest-Tracker is simply a standard NGINX http server with php, nothing fancy to setup.

  routers:

    speedtest:
      entryPoints:
        - websecure
      rule: Host(`speedtest.domain.net`)
      middlewares:
        - secured-auth
      tls: {}
      service: speedtest


  services:

    speedtest:
      loadBalancer:
        servers:
          - url: "https://docker2.internal.dom:8008"
        passHostHeader: true

If you want to use self-signed certs for internal services, you need this in the static config:

serversTransport:
  # Accept self-signed certificates for backend services
  insecureSkipVerify: true

[alexjustesen]

@alexdelprete there is going to be an update to the docs around handling SSL with Traefik. @bdowden has proposed the following doc change any chance you can put a 2nd set of eyes on it as I don't use Traefik in my stack?

alexjustesen/speedtest-tracker-docs#2

[alexdelprete]

any chance you can put a 2nd set of eyes on it as I don't use Traefik in my stack?

Done. Commented in the PR.

[alexjustesen]

#189