Connecting to a remote server doesn't work for self hosted server

[Frits1980]

To Reproduce

Test A:

1. Create a SSH-key (both id25519 and idRSA tested) in Dokploy by pushing the generate button
2. Put pub key in authorized_keys file of the root user on my docker server
3. Add remote server to Dokploy
4. Test by starting terminal

Test B:

1. Create an SSH-key from the command line on the server which hosts Dokploy
2. Put pub key in authorized_keys file of the root user on my docker server
3. Put both pub key and private key in Dokploy instead of hitting the generate button
4. Add remote server to Dokploy
5. Test by starting terminal

Current vs. Expected behavior

Both tests end in:
Connecting...
SSH connection error: connect EHOSTUNREACH 10.0.1.112:22 ❌

Expected behaviour:
Connecting...
root@docker-server:

From the command line on my Dokploy server I can run ssh root@10.0.1.112 and it will login without problem.

Provide environment information

I run both servers on the same Mac M4 OS 15.5
Both in UTM version 4.6.5
In both servers I run Ubuntu 24.04.2 LTS
Dokploy version 0.24.12

Which area(s) are affected? (Select all that apply)

Remote server

Are you deploying the applications where Dokploy is installed or on a remote server?

Remote server

Additional context

My sshd_config file on the docker server

Port 22
ListenAddress 0.0.0.0
SyslogFacility AUTH
LogLevel DEBUG
PermitRootLogin without-password
# Tested PermitRootLogin also with "yes" and instead of "without-password"
PubkeyAuthentication yes
# Tested PubkeyAuthentication also with "no" instead of "yes"
AuthorizedKeysFile	.ssh/authorized_keys .ssh/authorized_keys2 /root/.ssh/authorized_keys
PasswordAuthentication yes
# Tested PasswordAuthentication also with "no" instead of "yes"
KbdInteractiveAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem	sftp	/usr/lib/openssh/sftp-server

Will you send a PR to fix it?

No

[djsisson]

@Frits1980 if you're running dokploy in swarm mode, have you altered the default address pools to be outside the range of your lan subnet?

check docker system info

[Frits1980]

Hi @djsisson, thank you for the reply. I don't run Dokploy in swarm mode. I just want one Dokploy server and 1 server per app that I deploy on it. At the moment my first and only remote server doesn't even have docker installed yet, because that is part of the deployment step (tab 2) in the remote server, I'm already stuck at the connection step (tab 1) of the remote server.

[djsisson]

Still run docker system info on the server running dokploy and check the address pools or check ip of dokploy container.

Since lan is 10.0.1.x you need to make sure this is outside any address pools currently used by docker otherwise any commands to private addresses from inside docker can't get routed outside of docker to your lan.

Also note some hosting providers like Oracle have a default setup blocking containers from accessing the host

[Frits1980]

That I can do:

Client: Docker Engine - Community
 Version:    28.3.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.26.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.39.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  model: Docker Model Runner (EXPERIMENTAL) (Docker Inc.)
    Version:  v0.1.36
    Path:     /usr/libexec/docker/cli-plugins/docker-model

Server:
 Containers: 4
  Running: 4
  Paused: 0
  Stopped: 0
 Images: 4
 Server Version: 28.3.3
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: active
  NodeID: mfuj5tbrujngar3e2j91uoxt7
  Is Manager: true
  ClusterID: weleu2u9spimw6yehnhx12wi8
  Managers: 1
  Nodes: 1
  Default Address Pool: 10.0.0.0/8  
  SubnetSize: 24
  Data Path Port: 4789
  Orchestration:
   Task History Retention Limit: 5
  Raft:
   Snapshot Interval: 10000
   Number of Old Snapshots to Retain: 0
   Heartbeat Tick: 1
   Election Tick: 10
  Dispatcher:
   Heartbeat Period: 5 seconds
  CA Configuration:
   Expiry Duration: 3 months
   Force Rotate: 0
  Autolock Managers: false
  Root Rotation In Progress: false
  Node Address: 10.0.1.100
  Manager Addresses:
   10.0.1.100:2377
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
 runc version: v1.2.5-0-g59923ef
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.8.0-78-generic
 Operating System: Ubuntu 24.04.3 LTS
 OSType: linux
 Architecture: aarch64
 CPUs: 4
 Total Memory: 3.814GiB
 Name: dokploy-orchastrator
 ID: 0b6aba1f-c815-49dc-92b4-53c7c21d30df
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false

[Frits1980]

Ok, so you where right. It was the address pool. So I had to manually change the install.sh and run it to change it. I couldn't think of any other way. Now I can access the remote server from withing Dokploy.
Thank you!

[Frits1980]

Ok, sorry for reopening it. But this setup is either bad documented or badly coded. Because it feels like a rabbithole of issues I'm running into.
So now that I got the server SSH connection up and running. 2 issues arise:

1. My DNS certificate resolving doesn't work anymore. My previous setup had Cloudflare as resolver with the API token in the Traefik env. But when I do that in this setup I get this:

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [dokploy.mydomain.nl]: error: one or more domains had a problem:\n[dokploy.mydomain.nl] [dokploy.mydomain.nl] acme: error presenting token: cloudflare: failed to create TXT record: An identical record already exists. (81058)\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["dokploy.mydomain.nl"] providerName=letsencrypt.acme routerName=dokploy-router-app-secure@file rule=Host(`dokploy.mydomain.nl`)

So I thought maybe it's because I have to add the origin certificate of Cloudflare, which wasn't in my previous setup, but I'll try anyway. After adding that, this error went away. But Traefik never created the DNS record or did the ACME request. It just does nothing. No errors in the logs, nothing. Even after fully restarting the whole Ubuntu server it kept on doing nothing.

2. Now that I have SSH access to my remote server I move on to the next tab Setup server, so I look at the script which looks good nothing special there, all things will be installed. But I run the script and no errors are given. Succes, but then it hits me, the next tab called Validation says otherwise.

Docker Installed Installed: 28.3.3
RClone Installed Installed: 1.71.0
Nixpacks Installed Not Installed
Buildpacks Installed Not Installed
Docker Swarm Initialized Not Initialized
Dokploy Network Created Not Created
Main Directory Created Not Created
Railpack Installed Not Installed

Now what? I've tried to run the script again, but with no other result.

So maybe you can help me figure these 2 issues out? Thank you in advance

[Frits1980]

@Frits1980 if you're running dokploy in swarm mode, have you altered the default address pools to be outside the range of your lan subnet?

check docker system info

Ok, in my last reply I said I changed the install.sh (what I did was this docker swarm init --advertise-addr 10.0.1.110 --default-addr-pool 172.17.0.0/12). Was that the right way to change the default address pool? Or is this the reason for my problems?
Or should I have done this: docker swarm init --advertise-addr $advertise_addr --default-addr-pool 172.17.0.0/12

[djsisson]

the issues above

1. the error states the txt record already exists... so just login to cloudflare and remove the old txt record, also please note traefik does not create dns records, only a txt record used to auth let's encrypt to generate a certificate.

2. installation failure.... is the user root?

[Frits1980]

Ok, thank you again. I started a new fresh install of Ubuntu to test again for the Dokploy manager. You send me on the correct path. So I deleted all TXT records in Cloudflare, and it still din't work. But then I thought of the old server I had, where it did work but without the origin certificate of cloudflare in the Dokploy installation. So I removed the certificate and got an invalid certificate. Something I did have before. But no I thought of something I should have thought of before. Test in another browser. Man sometimes I hate Chrome for caching. The certificate was correct only Chrome thought otherwise.

That was problem 1. Now problem 2. When I ran the setup of the remote server again my eye caught a little line in the result saying docker.sock was not reachable. So went to the server and reinstalled docker and it all worked. Which is odd, because the server setup script should take care of that, right?

Anyway, I can move on again. Thank you again.