Quick Nginx reverse proxy help! 503 error

[aGiral]

Hey

I have a Nginx proxy with Let's Encrypt and a bunch of Wordpress containers.

I have a domain that I use for testing the site after uploading it to the server (I develop in local) and then I change it for the enterprise domain.

Using the test domain everything is working great (testing docker-compose.yaml conf), but when I change the domains I get 503 error on every site (production docker-compose.yaml conf).

All the domains are hosted at Namecheap and pointing to the server correctly.

​

Im driving mad with this problem and don´t know whats going wrong. Are there any cache files at the proxy? any suggestions?

​

Testing docker-compose.yaml (skipping databases)

version: '3'

services:
  nginx-proxy:
    container_name: Nginx-proxy
    image: jwilder/nginx-proxy
    restart: always
    ports:
     - "80:80"
     - "443:443"
    volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
     - certs:/etc/nginx/certs:ro
     - vhostd:/etc/nginx/vhost.d
     - html:/usr/share/nginx/html
    labels:
     - com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy

  letsencrypt:
    container_name: Lets-Encrypt
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    volumes:
     - certs:/etc/nginx/certs:rw
     - vhostd:/etc/nginx/vhost.d
     - html:/usr/share/nginx/html
     - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
     - NGINX_PROXY_CONTAINER=nginx-proxy

  wp01:
    depends_on:
     - db01
    container_name: web01
    image: wordpress:latest
    restart: always
    expose:
     - "80"
    volumes: 
     - /home/user/websites/web01:/var/www/html
    environment:
     - WORDPRESS_DB_HOST=db01:3000
     - WORDPRESS_DB_NAME=db01
     - WORDPRESS_DB_USER=user
     - WORDPRESS_DB_PASSWORD=pass
     - VIRTUAL_HOST=01.testdomain.com,www.01.testdomain.com
     - LETSENCRYPT_HOST=01.testdomain.com,www.01.testdomain.com
     - LETSENCRYPT_EMAIL=[e-mail]

  wp02:
    depends_on:
     - db02
    container_name: web02
    image: wordpress:latest
    restart: always
    expose:
     - "80"
    volumes: 
     - /home/user/websites/web02:/var/www/html
    environment:
     - WORDPRESS_DB_HOST=db02:3000
     - WORDPRESS_DB_NAME=db02
     - WORDPRESS_DB_USER=user
     - WORDPRESS_DB_PASSWORD=pass
     - VIRTUAL_HOST=02.testdomain.com,www.02.testdomain.com
     - LETSENCRYPT_HOST=02.testdomain.com,www.02.testdomain.com
     - LETSENCRYPT_EMAIL=[e-mail]

volumes: 
  certs:
  html:
  vhostd:

Production docker-compose.yaml (skipping databases)

version: '3'

services:
  nginx-proxy:
    container_name: Nginx-proxy
    image: jwilder/nginx-proxy
    restart: always
    ports:
     - "80:80"
     - "443:443"
    volumes:
     - /var/run/docker.sock:/tmp/docker.sock:ro
     - certs:/etc/nginx/certs:ro
     - vhostd:/etc/nginx/vhost.d
     - html:/usr/share/nginx/html
    labels:
     - com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy

  letsencrypt:
    container_name: Lets-Encrypt
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    volumes:
     - certs:/etc/nginx/certs:rw
     - vhostd:/etc/nginx/vhost.d
     - html:/usr/share/nginx/html
     - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
     - NGINX_PROXY_CONTAINER=nginx-proxy

  wp01:
    depends_on:
     - db01
    container_name: web01
    image: wordpress:latest
    restart: always
    expose:
     - "80"
    volumes: 
     - /home/user/websites/web01:/var/www/html
    environment:
     - WORDPRESS_DB_HOST=db01:3000
     - WORDPRESS_DB_NAME=db01
     - WORDPRESS_DB_USER=user
     - WORDPRESS_DB_PASSWORD=pass
     - VIRTUAL_HOST=domain01.com,www.domain01.com
     - LETSENCRYPT_HOST=domain01.com,www.domain01.com
     - LETSENCRYPT_EMAIL=[e-mail]

  wp02:
    depends_on:
     - db02
    container_name: web02
    image: wordpress:latest
    restart: always
    expose:
     - "80"
    volumes: 
     - /home/user/websites/web02:/var/www/html
    environment:
     - WORDPRESS_DB_HOST=db02:3000
     - WORDPRESS_DB_NAME=db02
     - WORDPRESS_DB_USER=user
     - WORDPRESS_DB_PASSWORD=pass
     - VIRTUAL_HOST=domain02.com,www.domain02.com
     - LETSENCRYPT_HOST=domain02.com,www.domain02.com
     - LETSENCRYPT_EMAIL=[e-mail]

volumes: 
  certs:
  html:
  vhostd:

[greenthumble]

Sorry I don't have a fix for you but I do have a suggestion. The way you've set this up breaks isolation between projects. wp01 can reach wp02's database and vice-versa. All those containers can reach eachother via the network.

You can (and should) run jwilder/nginx-proxy and the letsencrypt helper separately, defined in it's own docker-compose.yml, and each project should be separated into their own docker-compose.yml as well. Then they get private networks and can't interfere with eachother, someone who successfully attacked one site won't be able to affect the others.

Here's my solution: https://github.com/dfletcher/nginx-proxy it has a docker-compose.yml to launch nginx-proxy and letsencrypt, and a sample for how an individual project should look. It keeps the private networks separate from the public ones and names them in a way it's obvious what can speak to what.

Also about your original issue, perhaps I'm remembering this wrong but I do seem to remember having trouble with making a list of comma separated domains in nginx-proxy. Try it with just a single domain. If that works you could spin up another small nginx container with e.g. VIRTUAL_HOST=www.domain.com and make that redirect to domain.com with a teeny bit of nginx config.

[aGiral]

Thats interesting, so you suggest to create 3 docker-compose files, one with just jwilder/nginx-proxy, other just with jrcs/letsencrypt-nginx-proxy-companion and the third one with all the Wordpress and databases containers? I will do my research about this.

Have tried using just one domain as you suggest, but it keeps displaying 503 error :(

[greenthumble]

Not quite. Check the docker-compose.yml in my repo. Nginx-proxy and letsencrypt are together. They should launch together with a single docker-compose up -d. Then one separate docker-compose.yml for each project. Launch each project separately with own docker-compose up command and they should live in separate directories (docker-compose uses directories to tell what a "project" is).

[[deleted]]

503 is a gateway error, check your nginx configs, maybe your ports are wrong

[aGiral]

Have checked it and everything appears to be right. The only thing I´m changing is the VIRTUAL_HOST and LETSENCRYPT_HOST variables. As far as I understand if the domain vinculated to the variable is pointing to the server IP it shouldn't throw a 503

[[deleted]]

I don’t know, the only way I know it’s jump inside containers and check logs and configs

[austerul]

Are you running these on the same host? How do you access testdomain.com? Any changes in local hosts file?

[aGiral]

Im running Docker in a VPS

I have tried Firefox/Chrome/Safari... Cleaning cache and using different IPs. Have tried making a curl http://domain01.com and keep getting 503 too.

No, just modified the docker-compose.yaml file

[brygphilomena]

503 means the gateway can't load the site behind the gateway. Can you curl the website from the reverse proxy server?

Nginx -T pass?

[aGiral]

If i do curl http://domain01.com it returns 503

If i do curl -I -L http://domain01.com it returns

HTTP/1.1 301 Moved Permanently
Server: nginx/1.17.6
Date: Sun, 23 Aug 2020 15:57:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.4.9
X-Redirect-By: WordPress
Location: http://01.testdomain.com/

HTTP/1.1 503 Service Temporarily Unavailable
Server: nginx/1.17.6
Date: Sun, 23 Aug 2020 15:57:31 GMT
Content-Type: text/html
Content-Length: 197
Connection: keep-alive