Can't reach my Portainer-docker using Swag, other dockers do work reddit / selfhosted ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 07:13 I'm running into an issue on my server at home. Used to run everything on Windows 10 with port-forwarding on my router, decided to redo my complete setup based on Ubuntu with dockers running all services separately. So I can reach my Swag welcome page by browsing to [https://mydomain.xxx](https://mydomain.xxx) and I can reach my Unifi controller by browsing to [https://unifi.mydomain.xxx](https://unifi.mydomain.xxx) and both show valid certificates and everything. **HOWEVER,** when I browse to [https://portainer.mydomain.xxx](https://portainer.mydomain.xxx) , all I get is my default Swag-homepage, not the portainer docker's homepage which I'd expect. I have an old domain forward set up with port forwarding as well, like [http://olddomain.xxx:9000](http://olddomain.xxx:9000) that points to the fixed IP of that Ubuntu-server, and that one does work, however, without a valid certificate as that domain passes by the whole Swag- system... Can anyone point me to what I might be doing wrong here? I'm kinda self-taught, not an expert by any means, but I think I do grasp most concepts of what should be going on here... Current setup: * Ubuntu-server running on a fixed IP inside my network, ports forwarded from my router's external IP to this server are (for now): 80,443,8443,9000 * A-name record for \*.mydomain.xxx to my (fixed) IP, no AAAA-name record because my ISP does not hand out IPV6-addresses * **Swag:** container in network *lsio* with the following `docker- compose.yml`. ​ --- version: "2.1" services: swag: image: lscr.io/linuxserver/swag container_name: swag cap_add: - NET_ADMIN environment: - PUID=1000 - PGID=1000 - TZ=Europe/Brussels - URL=mydomain.xxx - SUBDOMAINS=portainer,sonarr,radarr,unifi,bazarr,torrent,sabnzbd - VALIDATION=http - CERTPROVIDER= #optional - DNSPLUGIN=cloudflare #optional - DUCKDNSTOKEN= #optional - EMAIL=xxx@mydomain.xxx #optional - ONLY_SUBDOMAINS=false #optional - EXTRA_DOMAINS= #optional - STAGING=false #optional volumes: - /home/xxx/swag-docker/config:/config ports: - 443:443 - 80:80 #optional restart: unless-stopped networks: - lsio networks: lsio: external: true * **Unifi-controller:** container in the same network *lsio* with the following `docker-compose.yml`: ​ --- version: "2.1" services: unifi-controller: image: lscr.io/linuxserver/unifi-controller:latest container_name: unifi-controller environment: - PUID=1000 - PGID=1000 - MEM_LIMIT=1024 #optional - MEM_STARTUP=1024 #optional volumes: - /unifi_data/config:/config ports: - 8443:8443 - 3478:3478/udp - 10001:10001/udp - 8080:8080 - 1900:1900/udp #optional - 8843:8843 #optional - 8880:8880 #optional - 6789:6789 #optional - 5514:5514/udp #optional restart: unless-stopped networks: - lsio networks: lsio: external: true The following config file is loaded in Swag using `config/nginx/proxy- confs/unifi-controller.subdomain.conf` ## Version 2023/05/31 # make sure that your unifi-controller container is named unifi- controller # make sure that your dns has a cname set for unifi # NOTE: If you use the proxy_cookie_path setting in proxy.conf you need to remove HTTPOnly; # ex: proxy_cookie_path / "/; Secure"; server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name unifi.*; include /config/nginx/ssl.conf; client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app unifi-controller; set $upstream_port 8443; set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_buffering off; } } The folder where my unifi-controller's `docker-compose.yml` is located is the **only** one that also contains a file named `run-nginx- docker`, containing the following: docker run -d -it \ --name nginx-proxy \ --restart unless-stopped \ \ -v /var/run/docker.sock:/tmp/docker.sock:ro \ -v /var/docker/nginx-proxy/certs:/etc/nginx/certs:ro \ -v /var/docker/nginx-proxy/conf.d:/etc/nginx/conf.d \ -v /var/docker/nginx-proxy/vhost.d:/etc/nginx/vhost.d \ -v /usr/share/nginx/html \ -p 192.168.0.11:80:80 \ -p 192.168.0.11:443:443 \ --label com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy \ \ jwilder/nginx-proxy:alpine * **Portainer** container in the same network *lsio* using the following docker-compose.yml ​ version: "3" services: portainer: image: portainer/portainer-ce:latest container_name: portainer ports: - 9000:9000 volumes: - /portainer_data:/data - /var/run/docker.sock:/var/run/docker.sock restart: unless-stopped networks: - lsio volumes: data: networks: lsio: external: true The following config file is loaded in Swag using `config/nginx/proxy- confs/portainer.subdomain.conf` ## Version 2023/05/31 # make sure that your portainer container is named portainer # make sure that your dns has a cname set for portainer server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name portainer.*; include /config/nginx/ssl.conf; client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app portainer; set $upstream_port 9000; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_hide_header X-Frame-Options; # Possibly not needed after Portainer 1.20.0 } location ~ (/portainer)?/api { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app portainer; set $upstream_port 9000; set $upstream_proto https; proxy_pass $upstream_proto://$upstream_app:$upstream_port; proxy_hide_header X-Frame-Options; # Possibly not needed after Portainer 1.20.0 } } ​ ---------------------------------------------------------------------- Sir_Squish · 2023-10-05 08:10 have you docker `exec -it /bin/sh` 'd into your containers to try pinging others? ---------------------------------------------------------------------- thekrautboy · 2023-10-05 08:27 https://www.linuxserver.io/support ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 08:29 Yes, I just did. Exec'd into the swag container and could ping both other containers at the respective IP's shown in Portainer. Ping result: [https://i.imgur.com/gS5FBhS.png](https://i.imgur.com/gS5FBhS.png) Portainer configs (with IP-addresses): [https://i.imgur.com/FoW1bEl.png](https://i.imgur.com/FoW1bEl.png) ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 08:38 Yeah, the documentation wasn't really clear, but I **will** try and join their Discord to see if I can ask the question there. ---------------------------------------------------------------------- Sir_Squish · 2023-10-05 08:48 server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name [subdomain].*; include /config/nginx/ssl.conf; client_max_body_size 0; location / { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app MyRadApp; set $upstream_port 8080; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; # Disable proxy buffering proxy_buffering off; } } This is working to pass connections through swag to another app inside its own container, but in the same network as the swag, which sounds similar to what you're doing. `[subdomain]` **doesn**'t need to be in \[\]brackets. ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 08:49 **SOLVED!** Alright everyone, I solved it myself. I looked further into the logs of the Portainer-docker, and it seems that it only exposes the 9000-port (as we can see in the config file I included) but the HTTPS listens on port 9443. So I added that port to the `docker- compose.yml`, restarted the docker and all is A-OK! Thanks for the help! ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 09:02 Thanks. I fixed it already, it was the docker-config only exposing port 9000 while Portainer listens for HTTPS on port 9443. Big oopsie on my part :) ---------------------------------------------------------------------- selfh-sted · 2023-10-05 11:59 FYI - the general consensus is to not expose something like Portainer to the internet given the management access it requires to function. If you're going to, I'd recommend adding an additional authentication layer like Authelia, Authentik, Fail2Ban, CrowdSec, etc., to ensure no one can brute-force their way in. ---------------------------------------------------------------------- jantograaf_v2 · 2023-10-05 12:19 Alright, I'll look into it. Might be better to only use the Portainer- UI over a VPN... Thanks for the advice!