Nginx 容器502坏网关

Question

I know this has been asked before and I've probably read most of these posts, but I am unable to get a combination working.

I am trying to use Nginx as an HTTPS reverse proxy to front Sonatype Nexus 3. Both Nexus and Nginx are containers running on a Linux (Fedora Server) docker host (192.168.60.204 / svr1.domain.com).

• I can navigate to Nginx ( https://svr1.domain.com ) from another PC (192.168.40.10)
• I can navigate to Nexus ( http://svr1.domain.com:8081 ) from another PC (192.168.40.10)
• I can navigate to Nexus ( http://nexus.domain.com:8081 ) from another PC (192.168.40.10)

However, when I enable proxy_pass I get 502 Bad Gateway Running docker logs --tail 50 --follow --timestamps nginx-nexus from the docker host, I get:

[error] 6#6: *1 connect() failed (113: Host is unreachable) while connecting to upstream, client: 192.168.60.1, server: nexus.domain.com, request: "GET / HTTP/1.1", upstream: "http://192.168.60.204:8081/", host: "nexus.domain.com"

192.168.60.1 is the default gateway for the network the Docker host is on so I have no idea why it appears to be trying to connect to this.

nexus.domain.com is a CNAME pointing to the Docker host.

I can connect to the Nginx container using docker exec -it nginx-nexus sh (Thanks @arik) and successfully ping nexus.domain.com .

I've tried many permutations of nginx.conf as you can see from the commented out code:

client_max_body_size      4G;

server {
  listen *:80;
  location /  {
    return 301 https://$host$request_uri;
  }
}

upstream foo{
  #insert your hosts ip here
  server nexus.domain.com:8081;
}

server {
  listen                  443 ssl;
  server_name             nexus.domain.com;

  ssl_certificate         /etc/nginx/certs/nexus.crt.pem;
  ssl_certificate_key     /etc/nginx/certs/nexus.key.pem;
  ssl_protocols           TLSv1.2;
  ssl_ciphers             HIGH:!aNULL:!MD5;

  location / {
    #resolver              127.0.0.11 valid=5s;
    proxy_pass            http://nexus.domain.com:8081/;
    #proxy_redirect        off;
    #proxy_set_header      Host $http_host;
    #proxy_set_header      Host $host;
    #proxy_set_header      X-Real-IP $remote_addr;
    proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
    #proxy_set_header      X-Forwarded-Host $server_name;
    proxy_set_header      X-Forwarded-Proto $scheme;
  }
}

I'd like to think the Docker networking is correct as I have another working container using nginx is a similar way.

If anyone can shed some light on what I have wrong, I'd be most grateful. TIA

Update 1

As per advise from @Arix in comments, under location / { I added:

resolver 1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;

With the following error:

$ docker logs --tail 50 --follow --timestamps nginx-nexus
2020-06-26T13:14:52.105017039Z 2020/06/26 13:14:52 [error] 6#6: *1 connect() failed (113: Host is unreachable) while connecting to upstream, client: 192.168.60.1, server: nexus.domain.com, request: "GET / HTTP/1.1", upstream: "http://192.168.60.204:8081/", host: "nexus.domain.com"
2020-06-26T13:14:52.105371984Z 192.168.60.1 - - [26/Jun/2020:13:14:52 +0000] "GET / HTTP/1.1" 502 560 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" "-"

Answer 1

It appears it was a DNS issue, which I don't fully understand, but would love to learn what the reason is.

Also, I was too quick on the refresh button. It takes about 15 - 30 seconds on my setup for both Nginx and Nexus to be fully up and running.

TL;DR:

Remove domain, changing: proxy_pass http://nexus.domain.com:8081 to proxy_pass http://nexus:8081

Full story:

Bringing up a shell inside the Nginx container and pinging nexus.domain.com resolves the IP of the Docker host - which is what I thought I would want.

Pinging nexus resolves to the Docker internal IP address for this container.

It seems to be working without the resolver section. For completeness, here is my nginx.conf:

client_max_body_size      4G;

server {
  listen                  80;
  server_name             nexus.domain.com;
  location /  {
    return 301 https://$host$request_uri;
  }
}

#resolver              1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;

server {
  listen                  443 ssl;
  server_name             nexus.domain.com;

  ssl_certificate         /etc/nginx/certs/nexus.crt.pem;
  ssl_certificate_key     /etc/nginx/certs/nexus.key.pem;
  ssl_protocols           TLSv1.2;
  ssl_ciphers             HIGH:!aNULL:!MD5;

  location / {
    proxy_pass            http://nexus:8081/;
    proxy_redirect        off;
    proxy_set_header      Host $http_host;
    #proxy_set_header      X-Real-IP $remote_addr;
    proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for; #Gets CSS working
    #proxy_set_header      X-Forwarded-Host $server_name;
    proxy_set_header      X-Forwarded-Proto $scheme;
  }
}

I'd love to know what's going on with DNS, if anyone has the time to explain...

HTH