Requests fail if coming from within another container

[Hi-ImKyle]

So I've had this issue for a while now and I've only recently needed it fixing so I'm asking here since I think it's semi related to Nginx/PM the most.

To sum it up, I have NPM in a docker container. Everything works. All my proxies work fine from the outside. So if I go to xyz.my-domain.com it brings up whatever it is at xyz. But if I curl that url from within another container, it resolves my domain to my IP address then says "Trying my-ip:443" and eventually just times out.

This unfortunately means I can't setup Authentik's OpenID Connect in services that support it since I can't access my domain from inside a container. And before you ask, yes I can access authentik from within another container if its on the same network but that causes authentik to provide the wrong urls.

This issue isn't just with Authentik. It doesn't matter what a container is hosting, it doesn't work using it's domain when curl'ing said domain from another container.

Is this a Docker issue, Nginx/PM issue or what? I just don't understand what could cause it to time out like this.

For those curious, here is curl -vk https://auth.my-domain.com/ from within Gitea.

7a229214a1a5:/# curl -vk https://auth.my-domain.com/
* Host auth.my-domain.com:443 was resolved.
* IPv6: (none)
* IPv4: 1.2.3.4
*   Trying 1.2.3.4:443...
* connect to 1.2.3.4 port 443 from 192.168.32.3 port 52394 failed: Operation timed out
* Failed to connect to auth.my-domain.com port 443 after 130328 ms: Couldn't connect to server
* Closing connection
curl: (28) Failed to connect to auth.my-domain.com port 443 after 130328 ms: Couldn't connect to server

[JonhyOliveira]

Have you tried looking at NPM access logs?

[Hi-ImKyle]

Again, you are not understanding my problem. I can't make a request to https://auth.example.com, it doesn't get through, it always times out.

I can make that request locally on my desktop, which is a completely different machine. That works fine. But if I make the request on ANY container, it ALWAYS times out. Nginx doesn't log anything about it timing out and Authentik never receives the request in the first place.

To make the point clear. This is NOT an Authentik issue. I am using Authentik as an example of a service that containers cannot access using the domain provided by Nginx/PM.

[JonhyOliveira]

For me connectivity is a much bigger problem than wrongly formatted URLs. In your first post you describe a setup where you had the connectivity problem solved so I don't understand why you're so adamant in staying away from that setup.

If you don't acknowledge the problem I've identified as a problem then I can only wish you good luck in finding the real one.

Cheers

[Hi-ImKyle]

You are correct, connectivity is a bigger problem. Which is the main problem.

The solution I originally had doesn't work for everything. In fact it doesn't really work at all. I'm not going to use that bandaid fix for everything just because it lets containers connect fine. Like cool, that fixed that issue but now theres another issue of containers redirecting users to the completely wrong url and asking people to go "oh right yeah, just change that url there to xyz every time you login" is a hassle and stupid.

I'm sorry you feel the way you do. I'm still not convinced you understand my issue at all.

[JonhyOliveira]

I hope you got something out of giving me attitude but it's definitely not a productive response..

I'll still address the main points you left here anyway for your own sake and in case you want to actually get help.

The solution I originally had doesn't work for everything. In fact it doesn't really work at all.

Just because you got it to work using the configuration you have now doesn't mean it's adequate.

How can you hope to restore connectivity if you are unwilling to touch your network configuration? If you have no connectivity this is also not an NPM issue.

I've explained this to you in this response: #3966 (reply in thread); and the one after.

I'm not going to use that bandaid fix for everything just because it lets containers connect fine.

Having all containers in the same network is NOT a bandaid fix! It's the "Docker approved" way of configuring docker to have containers communicate with each other.

Like cool, that fixed that issue but now theres another issue of containers redirecting users to the completely wrong url and asking people to go "oh right yeah, just change that url there to xyz every time you login" is a hassle and stupid.

That's not at all what I've been suggesting... I'm suggesting that AFTER fixing your network issue you can configure nginx to fix the URL issue.

Some feedback: Your lack of experience is clear so you shouldn't be shunning away people who are trying to assist you just because the solution they give you does not fit with your pre-concived notion of what the solution should be. Try to be more open to suggestions next time you ask for help.

[Hi-ImKyle]

If you feel that anything I said was me giving you attitude, you are looking into it wrongly. But that's ok.

You have tried to help me and it didn't work. Thanks.