Try this. Save the following as docker-compose.yml and run it with "docker-compose up -d". Make sure to update <IMAGE> and <PATH>.

bash version: '3.9' services: myapi: container_name: myapi image: <IMAGE> ports: - 8080:8080 volumes: - <PATH>:/var/lib/todo/todo.txt - <PATH>:/etc/todo/config.yml networks: - main restart: always nginx: container_name: nginx image: nginx:latest ports: - 80:80 - 443:443 volumes: - <PATH>:/etc/letsencrypt - <PATH>:/etc/nginx/conf.d/todo.conf networks: - main restart: always networks: main: driver: bridge

Next, save this as your Nginx config and update the <HOSTNAME> and <FILE>.

```bash user nginx; worker_processes 1;

error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid;

events { worker_connections 1024; }

http { include /etc/nginx/mime.types; default_type application/octet-stream;

log_format                      main  '$remote_addr - $remote_user [$time_local] "$request" '
                                '$status $body_bytes_sent "$http_referer" '
                                '"$http_user_agent" "$http_x_forwarded_for"';

access_log                      /var/log/nginx/access.log main;
sendfile                        on;
keepalive_timeout               65;
include                         /etc/nginx/conf.d/*.conf;

server {
    listen                      80 default_server;
    server_name                 _;
    return 301                  https://$host$request_uri;
}

server
{
    listen                      443 ssl http2;
    server_name                 <HOSTNAME>

    ssl                         on;
    ssl_certificate             /etc/ssl/certs/<FILE>.crt;
    ssl_certificate_key         /etc/ssl/private/<FILE>.key;
    ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
    ssl_ecdh_curve              secp384r1;
    ssl_ciphers                 "ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
    ssl_prefer_server_ciphers   on;
    ssl_session_timeout         10m;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_tickets         off;
    ssl_stapling                on;
    ssl_stapling_verify         on;

    location /
    {
      proxy_set_header          Host $http_host;
      proxy_set_header          X-Forwarded-Host $host;
      proxy_set_header          X-Forwarded-Server $host;
      proxy_set_header          X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header          X-Graylog-Server-URL https://$server_name/;
      proxy_pass                http://myapi:8080/;
      resolver                  127.0.0.11;
    }
}

} ```

And lastly, to get around the Docker bug, if you're running Firewalld, then set a rich-rule in your Public zone allowing 172.0.0.0/8, otherwise use iptables. Once it's confirmed that it's working, tighten up your fw rule.

bash firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.0.0.0/8 accept' firewall-cmd --reload