Cannot access dockerized Web UI from nginx proxy

[whytf]

I have migrated yet again, no errors in the log.

However according to documentation, firezone still uses IP:443 as web ui port, therefore my nginx reverse proxy would proxy it, like before.
Neither does https://IP work, ERR_CONNECTION_REFUSED.

My .env has everything filled including EXTERNAL_URL. (Tried changing that to IP as well.)

Nginx does get request from internet but doesn't get reply from firezone. (Either external_url config)

[jamilbk]

Hi @whytf, thanks for the report! Could you post the docker-compose.yml file you're using and the platform this is for?

[whytf]

Hi @whytf, thanks for the report! Could you post the docker-compose.yml file you're using and the platform this is for?

I read the migration script and it uses https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.prod.yml.
I haven't modified said file.

[jamilbk]

• Is this on Linux with Docker Engine/Server (not Docker Desktop)?
• Is the caddy container healthy?
• What does netstat -pant | grep 443 show?

[jamilbk]

caddy should be listening in host mode on 80 and 443, so perhaps it's bound to the wrong IP, there's a firewall issue, or the caddy service isn't healthy.

[whytf]

So I did upgrade to latest firezone before migration, 0.7.4

By saying no to automatic ssl I am able to access it by https://IP.

• This runs on debian 11 VM per docker installation instructions, not desktop.
• Logs are below, container is okay (uptime, created)
• netstat:

tcp6       0      0 :::443                  :::*                    LISTEN      9732/caddy
tcp6       0      0 192.168.0.20:443        192.168.0.15:33728      TIME_WAIT   -
tcp6       0      0 192.168.0.20:443        192.168.0.15:55844      TIME_WAIT   -
tcp6       0      0 192.168.0.20:443        192.168.0.15:33722      TIME_WAIT   -
tcp6       0      0 192.168.0.20:443        192.168.0.15:55838      TIME_WAIT   -

However my nginx deployment works even if there is no valid certificate/none at all, but here it doesn't so here's log from caddy: (note that my WAN IP has been replaced by x.x.x.x and my domain with xxx.com and my nginx proxy is at 192.168.0.15)

{"level":"info","ts":1674324296.7386596,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.168.0.15","remote_port":"34920","proto":"HTTP/1.1","method":"GET","host":"xxx.com","uri":"/","headers":{"Cf-Visitor":["{\"scheme\":\"https\"}"],"Upgrade-Insecure-Requests":["1"],"Connection":["close"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"],"Sec-Fetch-Site":["cross-site"],"X-Forwarded-Host":["xxxx.com"],"Cf-Connecting-Ip":["x.x.x.x"],"X-Forwarded-For":["x.x.x.x, 172.68.50.169"],"X-Forwarded-Port":["443"],"Dnt":["1"],"Sec-Ch-Ua":["\"Not_A Brand\";v=\"99\", \"Google Chrome\";v=\"109\", \"Chromium\";v=\"109\""],"Forwarded":["for=172.68.50.169"],"Cf-Ray":["78d1f9a67e30c26a-VIE"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua-Mobile":["?0"],"Priority":["u=0"],"Cf-Ipcountry":["SK"],"X-Forwarded-Proto":["https"],"Cdn-Loop":["cloudflare"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Accept-Language":["sk-SK,sk;q=0.9,en-US;q=0.8,en;q=0.7,cs;q=0.6"],"Accept-Encoding":["gzip"],"Pragma":["no-cache"],"X-Real-Ip":["172.68.50.169"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Cookie":[],"Cache-Control":["no-cache"]},"tls":{"resumed":true,"version":771,"cipher_suite":49195,"proto":"","server_name":""}},"user_id":"","duration":0.002237213,"size":67,"status":302,"resp_headers":{"Date":["Sat, 21 Jan 2023 18:04:56 GMT"],"X-Frame-Options":["SAMEORIGIN"],"X-Permitted-Cross-Domain-Policies":["none"],"Cache-Control":["max-age=0, private, must-revalidate"],"Referrer-Policy":["strict-origin-when-cross-origin"],"X-Download-Options":["noopen"],"Server":["Caddy","Cowboy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Request-Id":["FzxlE7HPgdoQpoUAAAhj"],"Location":["/"],"X-Content-Type-Options":["nosniff"],"Content-Length":["67"],"Content-Type":["text/html; charset=utf-8"]}}

Log from postgres:

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting dynamic shared memory implementation ... posix
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting default time zone ... Etc/UTC
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok


initdb: warning: enabling "trust" authentication for local connections
initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb.
Success. You can now start the database server using:

    pg_ctl -D /var/lib/postgresql/data -l logfile start

waiting for server to start....2023-01-21 18:03:36.843 UTC [48] LOG:  starting PostgreSQL 15.1 (Debian 15.1-1.pgdg110+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 10.2.1-6) 10.2.1 20210110, 64-bit
2023-01-21 18:03:36.845 UTC [48] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2023-01-21 18:03:36.850 UTC [51] LOG:  database system was shut down at 2023-01-21 18:03:36 UTC
2023-01-21 18:03:36.855 UTC [48] LOG:  database system is ready to accept connections
 done
server started
CREATE DATABASE


/usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*

waiting for server to shut down...2023-01-21 18:03:37.042 UTC [48] LOG:  received fast shutdown request
.2023-01-21 18:03:37.043 UTC [48] LOG:  aborting any active transactions
2023-01-21 18:03:37.045 UTC [48] LOG:  background worker "logical replication launcher" (PID 54) exited with exit code 1
2023-01-21 18:03:37.045 UTC [49] LOG:  shutting down
2023-01-21 18:03:37.047 UTC [49] LOG:  checkpoint starting: shutdown immediate
2023-01-21 18:03:37.112 UTC [49] LOG:  checkpoint complete: wrote 918 buffers (5.6%); 0 WAL file(s) added, 0 removed, 0 recycled; write=0.054 s, sync=0.007 s, total=0.068 s; sync files=250, longest=0.005 s, average=0.001 s; distance=4217 kB, estimate=4217 kB
2023-01-21 18:03:37.117 UTC [48] LOG:  database system is shut down
 done
server stopped

PostgreSQL init process complete; ready for start up.

2023-01-21 18:03:37.165 UTC [1] LOG:  starting PostgreSQL 15.1 (Debian 15.1-1.pgdg110+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 10.2.1-6) 10.2.1 20210110, 64-bit
2023-01-21 18:03:37.165 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2023-01-21 18:03:37.165 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2023-01-21 18:03:37.169 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2023-01-21 18:03:37.175 UTC [64] LOG:  database system was shut down at 2023-01-21 18:03:37 UTC
2023-01-21 18:03:37.179 UTC [1] LOG:  database system is ready to accept connections

Log from 'firezone' container:

18:03:36.977 [error] Postgrex.Protocol (#PID<0.164.0>) failed to connect: ** (DBConnection.ConnectionError) tcp connect (postgres:5432): connection refused - :econnrefused
18:03:36.977 [error] Postgrex.Protocol (#PID<0.163.0>) failed to connect: ** (DBConnection.ConnectionError) tcp connect (postgres:5432): connection refused - :econnrefused
18:03:39.191 [info] == Running 20200225005454 FzHttp.Repo.Migrations.CreateUsers.change/0 forward
18:03:39.191 [info] create table users
18:03:39.201 [info] create index users_email_index
18:03:39.204 [info] create index users_sign_in_token_sign_in_token_created_at_index
18:03:39.210 [info] == Migrated 20200225005454 in 0.0s
18:03:39.235 [info] == Running 20200228145810 FzHttp.Repo.Migrations.CreateDevices.change/0 forward
18:03:39.236 [info] create table devices
18:03:39.243 [info] execute "CREATE SEQUENCE       address_sequence       AS SMALLINT       MINVALUE 2       MAXVALUE 254       START 2       CYCLE       OWNED BY devices.address     "
18:03:39.244 [info] execute "ALTER TABLE devices ALTER COLUMN address SET DEFAULT NEXTVAL('address_sequence')"
18:03:39.245 [info] create index devices_user_id_index
18:03:39.248 [info] create index devices_public_key_index
18:03:39.250 [info] create index devices_private_key_index
18:03:39.253 [info] create index devices_user_id_name_index
18:03:39.256 [info] create index devices_address_index
18:03:39.259 [info] == Migrated 20200228145810 in 0.0s
18:03:39.261 [info] == Running 20200228154815 FzHttp.Repo.Migrations.CreateRules.change/0 forward
18:03:39.262 [info] execute "CREATE TYPE action_enum AS ENUM ('drop', 'accept')"
18:03:39.263 [info] create table rules
18:03:39.268 [info] create index rules_destination_action_index
18:03:39.271 [info] == Migrated 20200228154815 in 0.0s
18:03:39.274 [info] == Running 20210929172417 FzHttp.Repo.Migrations.AddDnsServersToDevices.change/0 forward
18:03:39.274 [info] alter table devices
18:03:39.275 [info] == Migrated 20210929172417 in 0.0s
18:03:39.277 [info] == Running 20211116172808 FzHttp.Repo.Migrations.CreateConnectivityChecks.change/0 forward
18:03:39.277 [info] create table connectivity_checks
18:03:39.283 [info] create index connectivity_checks_inserted_at_index
18:03:39.286 [info] == Migrated 20211116172808 in 0.0s
18:03:39.288 [info] == Running 20211116173236 FzHttp.Repo.Migrations.CreateSettings.change/0 forward
18:03:39.288 [info] create table settings
18:03:39.294 [info] create index settings_key_index
18:03:39.297 [info] execute "INSERT INTO settings (key, value, inserted_at, updated_at) VALUES ('default.device.dns_servers', null, '2023-01-21 18:03:39.296173Z', '2023-01-21 18:03:39.296173Z'),\n('default.device.allowed_ips', null, '2023-01-21 18:03:39.296173Z', '2023-01-21 18:03:39.296173Z'),\n('default.device.endpoint', null, '2023-01-21 18:03:39.296173Z', '2023-01-21 18:03:39.296173Z')\n"
18:03:39.298 [info] == Migrated 20211116173236 in 0.0s
18:03:39.300 [info] == Running 20211203012238 FzHttp.Repo.Migrations.ChangeDeviceColumnDefaults.change/0 forward
18:03:39.300 [info] alter table devices
18:03:39.302 [info] == Migrated 20211203012238 in 0.0s
18:03:39.304 [info] == Running 20211216155557 FzHttp.Repo.Migrations.AddConfigTokenToDevices.change/0 forward
18:03:39.304 [info] alter table devices
18:03:39.305 [info] create index devices_config_token_index
18:03:39.309 [info] == Migrated 20211216155557 in 0.0s
18:03:39.312 [info] == Running 20211217003247 FzHttp.Repo.Migrations.AddPersistentKeepalives.change/0 forward
18:03:39.312 [info] alter table devices
18:03:39.313 [info] execute "INSERT INTO settings (key, value, inserted_at, updated_at) VALUES ('default.device.persistent_keepalives', null, '2023-01-21 18:03:39.312140Z', '2023-01-21 18:03:39.312140Z')\n"
18:03:39.313 [info] == Migrated 20211217003247 in 0.0s
18:03:39.315 [info] == Running 20211221183311 FzHttp.Repo.Migrations.AddRoleToUsers.change/0 forward
18:03:39.316 [info] execute "CREATE TYPE role_enum AS ENUM ('unprivileged', 'admin')"
18:03:39.316 [info] alter table users
18:03:39.317 [info] execute "UPDATE users SET role = 'admin' WHERE email = 'firezone@localhost'"
18:03:39.318 [info] == Migrated 20211221183311 in 0.0s
18:03:39.320 [info] == Running 20211223161545 FzHttp.Repo.Migrations.AddRequireAuthForVpnSetting.change/0 forward
18:03:39.320 [info] execute "INSERT INTO settings (key, value, inserted_at, updated_at) VALUES ('security.require_auth_for_vpn_frequency', '0', '2023-01-21 18:03:39.320267Z', '2023-01-21 18:03:39.320267Z')\n"
18:03:39.320 [info] == Migrated 20211223161545 in 0.0s
18:03:39.322 [info] == Running 20220103175026 FzHttp.Repo.Migrations.AddInetsToDevices.change/0 forward
18:03:39.323 [info] alter table devices
18:03:39.323 [info] create index devices_ipv4_index
18:03:39.326 [info] create index devices_ipv6_index
18:03:39.328 [info] execute "UPDATE devices\nSET ipv4 = ('10.3.2.' || address)::INET, ipv6 = ('fd00::3:2:' || address)::INET;\n"
18:03:39.329 [info] alter table devices
18:03:39.330 [info] == Migrated 20220103175026 in 0.0s
18:03:39.332 [info] == Running 20220111004847 FzHttp.Repo.Migrations.AddMtuToDevices.change/0 forward
18:03:39.333 [info] alter table devices
18:03:39.333 [info] execute "INSERT INTO settings (key, value, inserted_at, updated_at) VALUES ('default.device.mtu', null, '2023-01-21 18:03:39.333057Z', '2023-01-21 18:03:39.333057Z')\n"
18:03:39.334 [info] == Migrated 20220111004847 in 0.0s
18:03:39.336 [info] == Running 20220124162404 FzHttp.Repo.Migrations.AddUuids.change/0 forward
18:03:39.336 [info] execute "CREATE EXTENSION IF NOT EXISTS pgcrypto"
18:03:39.340 [info] execute "ALTER TABLE rules ADD COLUMN uuid uuid DEFAULT gen_random_uuid() NOT NULL"
18:03:39.347 [info] execute "ALTER TABLE devices ADD COLUMN uuid uuid DEFAULT gen_random_uuid() NOT NULL"
18:03:39.363 [info] execute "ALTER TABLE users ADD COLUMN uuid uuid DEFAULT gen_random_uuid() NOT NULL"
18:03:39.371 [info] create index rules_uuid_index
18:03:39.373 [info] create index devices_uuid_index
18:03:39.375 [info] create index users_uuid_index
18:03:39.377 [info] == Migrated 20220124162404 in 0.0s
18:03:39.381 [info] == Running 20220127021835 FzHttp.Repo.Migrations.RenamePersistentKeepalives.change/0 forward
18:03:39.381 [info] execute "UPDATE settings\nSET key = 'default.device.persistent_keepalive'\nWHERE key = 'default.device.persistent_keepalives'\n"
18:03:39.382 [info] rename column persistent_keepalives to persistent_keepalive on table devices
18:03:39.382 [info] rename column use_default_persistent_keepalives to use_default_persistent_keepalive on table devices
18:03:39.383 [info] == Migrated 20220127021835 in 0.0s
18:03:39.384 [info] == Running 20220127191440 FzHttp.Repo.Migrations.RenameDnsServersToDns.change/0 forward
18:03:39.385 [info] execute "UPDATE settings\nSET key = 'default.device.dns'\nWHERE key = 'default.device.dns_servers'\n"
18:03:39.385 [info] rename column dns_servers to dns on table devices
18:03:39.386 [info] rename column use_default_dns_servers to use_default_dns on table devices
18:03:39.386 [info] == Migrated 20220127191440 in 0.0s
18:03:39.388 [info] == Running 20220208184257 FzHttp.Repo.Migrations.SettingsToSites.change/0 forward
18:03:39.388 [info] create table sites
18:03:39.392 [info] execute "INSERT INTO sites (id, name, inserted_at, updated_at)\nVALUES (gen_random_uuid(), 'default', '2023-01-21 18:03:39.388605Z', '2023-01-21 18:03:39.388605Z')\n"
18:03:39.393 [info] execute "  UPDATE sites\n  SET dns = (\n    SELECT value\n    FROM settings\n    WHERE key = 'default.device.dns'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.394 [info] execute "  UPDATE sites\n  SET allowed_ips = (\n    SELECT value\n    FROM settings\n    WHERE key = 'default.device.allowed_ips'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.394 [info] execute "  UPDATE sites\n  SET endpoint = (\n    SELECT value\n    FROM settings\n    WHERE key = 'default.device.endpoint'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.395 [info] execute "  UPDATE sites\n  SET persistent_keepalive = (\n    SELECT value::INTEGER\n    FROM settings\n    WHERE key = 'default.device.persistent_keepalive'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.395 [info] execute "  UPDATE sites\n  SET mtu = (\n    SELECT value::INTEGER\n    FROM settings\n    WHERE key = 'default.device.mtu'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.395 [info] execute "  UPDATE sites\n  SET vpn_session_duration = (\n    SELECT value::INTEGER\n    FROM settings\n    WHERE key = 'security.require_auth_for_vpn_frequency'\n  )\n  WHERE sites.name = 'default'\n"
18:03:39.396 [info] drop table settings
18:03:39.397 [info] create index sites_name_index
18:03:39.399 [info] == Migrated 20220208184257 in 0.0s
18:03:39.401 [info] == Running 20220209005201 FzHttp.Repo.Migrations.RenameUseDefaultToUseSite.change/0 forward
18:03:39.401 [info] rename column use_default_allowed_ips to use_site_allowed_ips on table devices
18:03:39.402 [info] rename column use_default_dns to use_site_dns on table devices
18:03:39.402 [info] rename column use_default_endpoint to use_site_endpoint on table devices
18:03:39.403 [info] rename column use_default_persistent_keepalive to use_site_persistent_keepalive on table devices
18:03:39.403 [info] rename column use_default_mtu to use_site_mtu on table devices
18:03:39.403 [info] == Migrated 20220209005201 in 0.0s
18:03:39.405 [info] == Running 20220211201727 FzHttp.Repo.Migrations.RemovePrivateKeys.change/0 forward
18:03:39.405 [info] alter table devices
18:03:39.406 [info] == Migrated 20220211201727 in 0.0s
18:03:39.408 [info] == Running 20220219165023 FzHttp.Repo.Migrations.AddKeyRegeneratedAt.change/0 forward
18:03:39.408 [info] alter table devices
18:03:39.409 [info] == Migrated 20220219165023 in 0.0s
18:03:39.411 [info] == Running 20220227215313 FzHttp.Repo.Migrations.AddLastSignedInMethodToUser.change/0 forward
18:03:39.411 [info] alter table users
18:03:39.411 [info] == Migrated 20220227215313 in 0.0s
18:03:39.413 [info] == Running 20220412144151 FzHttp.Repo.Migrations.AddPskToDevices.change/0 forward
18:03:39.413 [info] alter table devices
18:03:39.414 [info] == Migrated 20220412144151 in 0.0s
18:03:39.415 [info] == Running 20220419172036 FzHttp.Repo.Migrations.AddStatsToDevices.change/0 forward
18:03:39.415 [info] alter table devices
18:03:39.416 [info] rename column last_seen_at to latest_handshake on table devices
18:03:39.416 [info] == Migrated 20220419172036 in 0.0s
18:03:39.418 [info] == Running 20220427140943 FzHttp.Repo.Migrations.AddDescriptionToDevices.change/0 forward
18:03:39.418 [info] alter table devices
18:03:39.418 [info] == Migrated 20220427140943 in 0.0s
18:03:39.420 [info] == Running 20220516063916 FzHttp.Repo.Migrations.ChangeAllowedIpsToText.up/0 forward
18:03:39.420 [info] alter table devices
18:03:39.421 [info] alter table sites
18:03:39.421 [info] == Migrated 20220516063916 in 0.0s
18:03:39.423 [info] == Running 20220519034545 FzHttp.Repo.Migrations.CreateOidcConnections.change/0 forward
18:03:39.423 [info] create table oidc_connections
18:03:39.428 [info] create index oidc_connections_user_id_provider_index
18:03:39.430 [info] == Migrated 20220519034545 in 0.0s
18:03:39.433 [info] == Running 20220520072323 FzHttp.Repo.Migrations.AddDisabledAtToUser.change/0 forward
18:03:39.433 [info] alter table users
18:03:39.433 [info] == Migrated 20220520072323 in 0.0s
18:03:39.435 [info] == Running 20220530073152 FzHttp.Repo.Migrations.CreateMfaMethods.change/0 forward
18:03:39.435 [info] execute "CREATE TYPE mfa_type_enum AS ENUM ('totp', 'native', 'portable')"
18:03:39.436 [info] create table mfa_methods
18:03:39.441 [info] create index mfa_methods_user_id_index
18:03:39.443 [info] create index mfa_methods_credential_id_index
18:03:39.446 [info] == Migrated 20220530073152 in 0.0s
18:03:39.448 [info] == Running 20220609232854 FzHttp.Repo.Migrations.ChangeRefreshTokenToText.change/0 forward
18:03:39.448 [info] alter table oidc_connections
18:03:39.449 [info] == Migrated 20220609232854 in 0.0s
18:03:39.451 [info] == Running 20220614192937 FzHttp.Repo.Migrations.AddUserIdToRules.change/0 forward
18:03:39.451 [info] drop index rules_destination_action_index
18:03:39.452 [info] alter table rules
18:03:39.453 [info] execute "\n      DELETE FROM rules r1\n      USING rules r2\n      WHERE r2.destination >> r1.destination\n      AND r2.action = r1.action\n      AND r1.user_id IS NULL\n      AND r2.user_id IS NULL\n    "
18:03:39.455 [info] execute "\n      DELETE FROM rules r1\n      USING rules r2\n      WHERE r2.destination >> r1.destination\n      AND r2.action = r1.action\n      AND r2.user_id = r1.user_id\n    "
18:03:39.455 [info] execute "CREATE EXTENSION IF NOT EXISTS btree_gist"
18:03:39.480 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl_usr_rule EXCLUDE USING gist (destination inet_ops WITH &&, user_id WITH =, action WITH =) WHERE (user_id IS NOT NULL)"
18:03:39.481 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl EXCLUDE USING gist (destination inet_ops WITH &&, action WITH =) WHERE (user_id IS NULL)"
18:03:39.482 [info] == Migrated 20220614192937 in 0.0s
18:03:39.488 [info] == Running 20220713050742 FzHttp.Repo.Migrations.CreateConfigurations.change/0 forward
18:03:39.488 [info] create table configurations
18:03:39.495 [info] execute "INSERT INTO configurations (id, inserted_at, updated_at)\nVALUES (gen_random_uuid(), '2023-01-21 18:03:39.488747Z', '2023-01-21 18:03:39.488747Z')\n"
18:03:39.496 [info] == Migrated 20220713050742 in 0.0s
18:03:39.499 [info] == Running 20220719014442 FzHttp.Repo.Migrations.AddAuthConfigs.change/0 forward
18:03:39.499 [info] alter table configurations
18:03:39.500 [info] == Migrated 20220719014442 in 0.0s
18:03:39.502 [info] == Running 20220721164925 FzHttp.Repo.Migrations.AddDeviceRuleUserNotifyTriggers.change/0 forward
18:03:39.502 [info] execute "CREATE OR REPLACE FUNCTION notify_device_changes()\nRETURNS trigger AS $$\nDECLARE\n  row record;\nBEGIN\n  row := NEW;\n\n  IF (TG_OP = 'DELETE') THEN\n    row := OLD;\n  END IF;\n\n  PERFORM pg_notify(\n    'devices_changed',\n    json_build_object(\n      'op', TG_OP,\n      'row', row_to_json(row)\n    )::text\n  );\n\n  RETURN row;\nEND;\n$$ LANGUAGE plpgsql;\n"
18:03:39.503 [info] execute "CREATE CONSTRAINT TRIGGER devices_changed\nAFTER INSERT OR DELETE ON devices\nDEFERRABLE\nFOR EACH ROW EXECUTE PROCEDURE notify_device_changes()\n"
18:03:39.504 [info] execute "CREATE OR REPLACE FUNCTION notify_rule_changes()\nRETURNS trigger AS $$\nDECLARE\n  row record;\nBEGIN\n  row := NEW;\n\n  IF (TG_OP = 'DELETE') THEN\n    row := OLD;\n  END IF;\n\n  PERFORM pg_notify(\n    'rules_changed',\n    json_build_object(\n      'op', TG_OP,\n      'row', row_to_json(row)\n    )::text\n  );\n\n  RETURN row;\nEND;\n$$ LANGUAGE plpgsql;\n"
18:03:39.504 [info] execute "CREATE CONSTRAINT TRIGGER rules_changed\nAFTER INSERT OR DELETE ON rules\nDEFERRABLE\nFOR EACH ROW EXECUTE PROCEDURE notify_rule_changes()\n"
18:03:39.505 [info] execute "CREATE OR REPLACE FUNCTION notify_user_changes()\nRETURNS trigger AS $$\nDECLARE\n  row record;\nBEGIN\n  row := NEW;\n\n  IF (TG_OP = 'DELETE') THEN\n    row := OLD;\n  END IF;\n\n  PERFORM pg_notify(\n    'users_changed',\n    json_build_object(\n      'op', TG_OP,\n      'row', row_to_json(row)\n    )::text\n  );\n\n  RETURN row;\nEND;\n$$ LANGUAGE plpgsql;\n"
18:03:39.506 [info] execute "CREATE CONSTRAINT TRIGGER users_changed\nAFTER INSERT OR DELETE ON users\nDEFERRABLE\nFOR EACH ROW EXECUTE PROCEDURE notify_user_changes()\n"
18:03:39.506 [info] == Migrated 20220721164925 in 0.0s
18:03:39.509 [info] == Running 20220726205646 FzHttp.Repo.Migrations.AddRulePortRange.change/0 forward
18:03:39.509 [info] execute "ALTER TABLE rules DROP CONSTRAINT destination_overlap_excl_usr_rule"
18:03:39.510 [info] execute "ALTER TABLE rules DROP CONSTRAINT destination_overlap_excl"
18:03:39.510 [info] execute "CREATE TYPE port_type_enum AS ENUM ('tcp', 'udp')"
18:03:39.511 [info] alter table rules
18:03:39.511 [info] create check constraint port_range_needs_type on table rules
18:03:39.512 [info] create check constraint port_range_is_within_valid_values on table rules
18:03:39.513 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl EXCLUDE USING gist (destination inet_ops WITH &&, action WITH =) WHERE (user_id IS NULL AND port_range IS NULL)"
18:03:39.514 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl_usr_rule EXCLUDE USING gist (destination inet_ops WITH &&, user_id WITH =, action WITH =) WHERE (user_id IS NOT NULL AND port_range IS NULL)"
18:03:39.515 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl_port EXCLUDE USING gist (destination inet_ops WITH &&, action WITH =, port_range WITH &&, port_type WITH =) WHERE (user_id IS NULL AND port_range IS NOT NULL)"
18:03:39.516 [info] execute "ALTER TABLE rules\n        ADD CONSTRAINT destination_overlap_excl_usr_rule_port EXCLUDE USING gist (destination inet_ops WITH &&, user_id WITH =, action WITH =, port_range WITH &&, port_type WITH =) WHERE (user_id IS NOT NULL AND port_range IS NOT NULL)"
18:03:39.517 [info] == Migrated 20220726205646 in 0.0s
18:03:39.519 [info] == Running 20220810002432 FzHttp.Repo.Migrations.AddUnprivilegedDeviceConfiguration.change/0 forward
18:03:39.519 [info] alter table configurations
18:03:39.520 [info] == Migrated 20220810002432 in 0.0s
18:03:39.521 [info] == Running 20220831060724 FzHttp.Repo.Migrations.AddSamlIdentityProvidersToConfiguration.change/0 forward
18:03:39.522 [info] alter table configurations
18:03:39.522 [info] == Migrated 20220831060724 in 0.0s
18:03:39.523 [info] == Running 20221012123308 FzHttp.Repo.Migrations.MoveAutoCreateUsersToProviders.change/0 forward
18:03:39.526 [info] alter table configurations
18:03:39.527 [info] == Migrated 20221012123308 in 0.0s
18:03:39.528 [info] == Running 20221129002233 FzHttp.Repo.Migrations.UpdateOnDeleteBehavior.change/0 forward
18:03:39.529 [info] drop constraint oidc_connections_user_id_fkey from table oidc_connections
18:03:39.529 [info] alter table oidc_connections
18:03:39.531 [info] drop constraint mfa_methods_user_id_fkey from table mfa_methods
18:03:39.532 [info] alter table mfa_methods
18:03:39.533 [info] == Migrated 20221129002233 in 0.0s
18:03:39.535 [info] == Running 20221223190406 FzHttp.Repo.Migrations.MigratePksToUuid.change/0 forward
18:03:39.536 [info] alter table connectivity_checks
18:03:39.543 [info] execute "DROP INDEX devices_uuid_index"
18:03:39.544 [info] rename column id to id_tmp on table devices
18:03:39.545 [info] rename column uuid to id on table devices
18:03:39.545 [info] alter table devices
18:03:39.549 [info] execute "DROP INDEX rules_uuid_index"
18:03:39.550 [info] rename column id to id_tmp on table rules
18:03:39.550 [info] rename column uuid to id on table rules
18:03:39.551 [info] alter table rules
18:03:39.553 [info] alter table oidc_connections
18:03:39.561 [info] rename column id to id_tmp on table users
18:03:39.561 [info] rename column uuid to id on table users
18:03:39.562 [info] rename column user_id to user_id_tmp on table devices
18:03:39.562 [info] execute "ALTER TABLE devices RENAME CONSTRAINT devices_user_id_fkey TO devices_user_id_tmp_fkey"
18:03:39.563 [info] alter table devices
18:03:39.564 [info] execute "UPDATE devices SET user_id = (SELECT users.id FROM users WHERE users.id_tmp = devices.user_id_tmp)"
18:03:39.565 [info] execute "ALTER TABLE devices ALTER COLUMN user_id SET NOT NULL"
18:03:39.566 [info] alter table devices
18:03:39.567 [info] create index devices_user_id_index
18:03:39.569 [info] create index devices_user_id_name_index
18:03:39.571 [info] rename column user_id to user_id_tmp on table rules
18:03:39.572 [info] execute "ALTER TABLE rules RENAME CONSTRAINT rules_user_id_fkey TO rules_user_id_tmp_fkey"
18:03:39.572 [info] alter table rules
18:03:39.573 [info] execute "UPDATE rules SET user_id = (SELECT users.id FROM users WHERE users.id_tmp = rules.user_id_tmp)"
18:03:39.574 [info] execute "ALTER TABLE rules\nDROP CONSTRAINT destination_overlap_excl\n"
18:03:39.574 [info] execute "ALTER TABLE rules\nADD CONSTRAINT destination_overlap_excl\nEXCLUDE USING gist (destination inet_ops WITH &&, action WITH =)\nWHERE (user_id IS NULL AND port_range IS NULL)\n"
18:03:39.576 [info] execute "ALTER TABLE rules\nDROP CONSTRAINT destination_overlap_excl_port\n"
18:03:39.577 [info] execute "ALTER TABLE rules\nADD CONSTRAINT destination_overlap_excl_port\nEXCLUDE USING gist (destination inet_ops WITH &&, action WITH =, port_range WITH &&, port_type WITH =)\nWHERE (user_id IS NULL AND port_range IS NOT NULL)\n"
18:03:39.578 [info] execute "ALTER TABLE rules\nDROP CONSTRAINT destination_overlap_excl_usr_rule\n"
18:03:39.578 [info] execute "ALTER TABLE rules\nADD CONSTRAINT destination_overlap_excl_usr_rule\nEXCLUDE USING gist (destination inet_ops WITH &&, user_id WITH =, action WITH =)\nWHERE (user_id IS NOT NULL AND port_range IS NULL)\n"
18:03:39.579 [info] execute "ALTER TABLE rules\nDROP CONSTRAINT destination_overlap_excl_usr_rule_port\n"
18:03:39.580 [info] execute "ALTER TABLE rules\nADD CONSTRAINT destination_overlap_excl_usr_rule_port\nEXCLUDE USING gist (destination inet_ops WITH &&, user_id WITH =, action WITH =, port_range WITH &&, port_type WITH =)\nWHERE (user_id IS NOT NULL AND port_range IS NOT NULL)\n"
18:03:39.581 [info] alter table rules
18:03:39.582 [info] rename column user_id to user_id_tmp on table oidc_connections
18:03:39.582 [info] execute "ALTER TABLE oidc_connections RENAME CONSTRAINT oidc_connections_user_id_fkey TO oidc_connections_user_id_tmp_fkey"
18:03:39.583 [info] alter table oidc_connections
18:03:39.584 [info] execute "UPDATE oidc_connections SET user_id = (SELECT users.id FROM users WHERE users.id_tmp = oidc_connections.user_id_tmp)"
18:03:39.584 [info] execute "ALTER TABLE oidc_connections ALTER COLUMN user_id SET NOT NULL"
18:03:39.585 [info] alter table oidc_connections
18:03:39.586 [info] create index oidc_connections_user_id_provider_index
18:03:39.588 [info] rename column user_id to user_id_tmp on table mfa_methods
18:03:39.589 [info] execute "ALTER TABLE mfa_methods RENAME CONSTRAINT mfa_methods_user_id_fkey TO mfa_methods_user_id_tmp_fkey"
18:03:39.589 [info] alter table mfa_methods
18:03:39.591 [info] execute "UPDATE mfa_methods SET user_id = (SELECT users.id FROM users WHERE users.id_tmp = mfa_methods.user_id_tmp)"
18:03:39.591 [info] execute "ALTER TABLE mfa_methods ALTER COLUMN user_id SET NOT NULL"
18:03:39.592 [info] alter table mfa_methods
18:03:39.592 [info] create index mfa_methods_user_id_index
18:03:39.595 [info] alter table users
18:03:39.595 [info] execute "ALTER INDEX users_uuid_index RENAME TO users_pkey"
18:03:39.596 [info] alter table users
18:03:39.602 [info] == Migrated 20221223190406 in 0.0s
18:03:39.605 [info] == Running 20221223223357 FzHttp.Repo.Migrations.MigrateDatetimesToTimestamptz.change/0 forward
18:03:39.606 [info] alter table configurations
18:03:39.606 [info] alter table sites
18:03:39.607 [info] alter table mfa_methods
18:03:39.607 [info] alter table devices
18:03:39.608 [info] alter table oidc_connections
18:03:39.609 [info] alter table connectivity_checks
18:03:39.612 [info] alter table users
18:03:39.615 [info] == Migrated 20221223223357 in 0.0s
18:03:39.618 [info] == Running 20221223223931 FzHttp.Repo.Migrations.OrderConnectivityChecksInsertedAtIndex.change/0 forward
18:03:39.618 [info] drop index connectivity_checks_inserted_at_index
18:03:39.618 [info] execute "CREATE INDEX connectivity_checks_inserted_at_index ON connectivity_checks (inserted_at DESC)"
18:03:39.621 [info] == Migrated 20221223223931 in 0.0s
18:03:39.623 [info] == Running 20221224210654 FzHttp.Repo.Migrations.FixSitesNullableFields.change/0 forward
18:03:39.623 [info] execute "  UPDATE sites\n  SET dns = '1.1.1.1, 1.0.0.1'\n  WHERE dns IS NULL\n"
18:03:39.624 [info] execute "  UPDATE sites\n  SET mtu = 1280\n  WHERE mtu IS NULL\n"
18:03:39.624 [info] execute "  UPDATE sites\n  SET allowed_ips = '0.0.0.0/0, ::/0'\n  WHERE allowed_ips IS NULL\n"
18:03:39.625 [info] execute "  UPDATE sites\n  SET persistent_keepalive = 0\n  WHERE persistent_keepalive IS NULL\n"
18:03:39.625 [info] execute "  UPDATE sites\n  SET endpoint = 'x.x.x.x:51820'\n  WHERE endpoint IS NULL\n"
18:03:39.625 [info] == Migrated 20221224210654 in 0.0s
18:03:39.627 [info] == Running 20221226044850 FzHttp.Repo.Migrations.CreateApiTokens.change/0 forward
18:03:39.627 [info] create table api_tokens
18:03:39.630 [info] create index api_tokens_expires_at_index
18:03:39.633 [info] create index api_tokens_user_id_index
18:03:39.635 [info] == Migrated 20221226044850 in 0.0s
18:03:39.638 [info] == Running 20221226143651 FzHttp.Repo.Migrations.MoveSitesFieldsToConfigurations.change/0 forward
18:03:39.638 [info] alter table configurations
18:03:39.639 [info] execute "  UPDATE configurations\n  SET default_client_persistent_keepalive = (\n    SELECT persistent_keepalive\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.640 [info] execute "  UPDATE configurations\n  SET default_client_endpoint = (\n    SELECT endpoint\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.640 [info] execute "  UPDATE configurations\n  SET default_client_dns = (\n    SELECT dns\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.641 [info] execute "  UPDATE configurations\n  SET default_client_allowed_ips = (\n    SELECT allowed_ips\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.641 [info] execute "  UPDATE configurations\n  SET default_client_mtu = (\n    SELECT mtu\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.642 [info] execute "  UPDATE configurations\n  SET vpn_session_duration = (\n    SELECT vpn_session_duration\n    FROM sites\n    WHERE sites.name = 'default'\n  )\n"
18:03:39.642 [info] == Migrated 20221226143651 in 0.0s
18:03:39.644 [info] == Running 20221226171558 FzHttp.Repo.Migrations.RenameUseSiteToUseDefault.change/0 forward
18:03:39.644 [info] rename column use_site_allowed_ips to use_default_allowed_ips on table devices
18:03:39.645 [info] rename column use_site_dns to use_default_dns on table devices
18:03:39.645 [info] rename column use_site_endpoint to use_default_endpoint on table devices
18:03:39.646 [info] rename column use_site_mtu to use_default_mtu on table devices
18:03:39.646 [info] rename column use_site_persistent_keepalive to use_default_persistent_keepalive on table devices
18:03:39.647 [info] == Migrated 20221226171558 in 0.0s
18:03:39.648 [info] == Running 20221226193228 FzHttp.Repo.Migrations.DropSites.change/0 forward
18:03:39.648 [info] drop table sites
18:03:39.649 [info] == Migrated 20221226193228 in 0.0s
18:03:39.651 [info] == Running 20221227181727 FzHttp.Repo.Migrations.MoveCacheFallbacksToConfigurations.change/0 forward
18:03:39.652 [info] execute "  UPDATE configurations\n  SET local_auth_enabled = 'true' WHERE configurations.local_auth_enabled IS NULL\n"
18:03:39.652 [info] execute "  UPDATE configurations\n  SET disable_vpn_on_oidc_error = 'false' WHERE configurations.disable_vpn_on_oidc_error IS NULL\n"
18:03:39.653 [info] execute "  UPDATE configurations\n  SET allow_unprivileged_device_management = 'true' WHERE configurations.allow_unprivileged_device_management IS NULL\n"
18:03:39.653 [info] execute "  UPDATE configurations\n  SET allow_unprivileged_device_configuration = 'true' WHERE configurations.allow_unprivileged_device_configuration IS NULL\n"
18:03:39.653 [info] execute "  UPDATE configurations\n  SET openid_connect_providers = '{}'::json\n  WHERE openid_connect_providers IS NULL\n"
18:03:39.654 [info] execute "  UPDATE configurations\n  SET saml_identity_providers = '{}'::json\n  WHERE saml_identity_providers IS NULL\n"
18:03:39.654 [info] alter table configurations
18:03:39.659 [info] == Migrated 20221227181727 in 0.0s
18:03:39.662 [info] == Running 20221229154115 FzHttp.Repo.Migrations.MigrateProvidersConfigs.change/0 forward
18:03:39.662 [info] execute "UPDATE configurations\nSET openid_connect_providers = COALESCE((select jsonb_agg(o.item::jsonb || jsonb_build_object('id', key)) from jsonb_each(openid_connect_providers) as o(key, item)), '[]'::jsonb),\n    saml_identity_providers = COALESCE((select jsonb_agg(s.item::jsonb || jsonb_build_object('id', key)) from jsonb_each(saml_identity_providers) as s(key, item)), '[]'::jsonb)\n"
18:03:39.664 [info] == Migrated 20221229154115 in 0.0s
18:03:39.665 [info] == Running 20230104000803 FzHttp.Repo.Migrations.AddUsersSignInTokenHash.change/0 forward
18:03:39.666 [info] alter table users
18:03:39.666 [info] == Migrated 20230104000803 in 0.0s
18:03:39.669 [info] == Running 20230104181853 FzHttp.Repo.Migrations.ChangeUsersEmailToCitext.change/0 forward
18:03:39.669 [info] execute "CREATE EXTENSION IF NOT EXISTS citext"
18:03:39.675 [info] alter table users
18:03:39.680 [info] == Migrated 20230104181853 in 0.0s
18:03:39.684 [info] == Running 20230113184557 FzHttp.Repo.Migrations.AddDefaultPksValues.change/0 forward
18:03:39.684 [info] execute "ALTER TABLE connectivity_checks\nALTER COLUMN id\nSET DEFAULT gen_random_uuid();\n"
18:03:39.684 [info] execute "ALTER TABLE oidc_connections\nALTER COLUMN id\nSET DEFAULT gen_random_uuid();\n"
18:03:39.685 [info] execute "ALTER TABLE api_tokens\nALTER COLUMN id\nSET DEFAULT gen_random_uuid();\n"
18:03:39.686 [info] execute "ALTER TABLE configurations\nALTER COLUMN id\nSET DEFAULT gen_random_uuid();\n"
18:03:39.686 [info] execute "ALTER TABLE mfa_methods\nALTER COLUMN id\nSET DEFAULT gen_random_uuid();\n"
18:03:39.687 [info] == Migrated 20230113184557 in 0.0s
18:03:39.689 [info] == Running 20230116200524 FzHttp.Repo.Migrations.AddNotNullToMfaMethods.change/0 forward
18:03:39.690 [info] execute "UPDATE mfa_methods\nSET last_used_at = '1970-01-01 00:00:00+00'::timestamptz\nWHERE last_used_at IS NULL\n"
18:03:39.690 [info] execute "UPDATE mfa_methods\nSET payload = '4KoDFSI0rM4Pa/arI8dwlraUvIvWRbgjlSZOuoAyJjE='\nWHERE payload IS NULL\n"
18:03:39.691 [info] alter table mfa_methods
18:03:39.692 [info] create index mfa_methods_name_index
18:03:39.694 [info] == Migrated 20230116200524 in 0.0s
18:03:40.958 [info] Running FzHttpWeb.Endpoint with cowboy 2.9.0 at 0.0.0.0:13000 (http)
18:03:40.960 [info] Access FzHttpWeb.Endpoint at https://xxx.com

[whytf]

18:03:36.977 [error] Postgrex.Protocol (#PID<0.164.0>) failed to connect: ** (DBConnection.ConnectionError) tcp connect (postgres:5432): connection refused - :econnrefused
18:03:36.977 [error] Postgrex.Protocol (#PID<0.163.0>) failed to connect: ** (DBConnection.ConnectionError) tcp connect (postgres:5432): connection refused - :econnrefused

And that database error just shows as that I can't login into web ui

[jamilbk]

So the proxy chain is Nginx -> Caddy -> Firezone? You'll probably want to terminate SSL at Nginx, or Caddy but not both. Otherwise you'll need to configure Nginx to allow the insecure cert from Caddy.

The docker-compose.yml file is meant to serve as a template -- you'll need to either disable the caddy service and point Nginx straight at Firezone, or disable SSL in the Caddyfile configuration in the docker-compose.yml set SECURE_COOKIES=false for the firezone service.

[jamilbk]

E.g. try changing this:

        https:// {
          log
          reverse_proxy * 172.25.0.100:13000
          ${TLS_OPTS:-}
        }
        EOF

to this

        http:// {
          log
          reverse_proxy * 172.25.0.100:13000
        }
        EOF

and add SECURE_COOKIES=false to your $HOME/.firezone/.env

[whytf]

So the proxy chain is Nginx -> Caddy -> Firezone? You'll probably want to terminate SSL at Nginx, or Caddy but not both. Otherwise you'll need to configure Nginx to allow the insecure cert from Caddy.

The docker-compose.yml file is meant to serve as a template -- you'll need to either disable the caddy service and point Nginx straight at Firezone, or disable SSL in the Caddyfile configuration in the docker-compose.yml set SECURE_COOKIES=false for the firezone service.

I commented out the caddy from docker-compose and I changed it to look like this:
But it is not accessible over http or https, not sure why as I don't have much experience with docker compose

# Example compose file for production deployment on Linux.
#
# Note: This file is meant to serve as a template. Please modify it
# according to your needs. Read more about Docker Compose:
#
# https://docs.docker.com/compose/compose-file/
#
#
x-deploy: &default-deploy
  restart_policy:
    condition: unless-stopped
    delay: 5s
    window: 120s
  update_config:
    order: start-first

version: '3.7'

services:
  #caddy:
  #  image: caddy:2
  #  volumes:
  #    - ${FZ_INSTALL_DIR:-.}/caddy:/data/caddy
    # See Caddy's documentation for customizing this line
    # https://caddyserver.com/docs/quick-starts/reverse-proxy
  #  command:
  #    - /bin/sh
  #    - -c
  #    - |
  #      cat <<EOF > /etc/caddy/Caddyfile && caddy run --config /etc/caddy/Caddyfile

  #      https:// {
  #        log
  #        reverse_proxy * 172.25.0.100:13000
  #        ${TLS_OPTS:-}
  #      }
  #      EOF
  #  network_mode: "host"
  #  deploy:
  #    <<: *default-deploy

  firezone:
    image: firezone/firezone
    ports:
      - 51820:51820/udp
    env_file:
      # This should contain a list of env vars for configuring Firezone.
      # See https://docs.firezone.dev/reference/env-vars for more info.
      - ${FZ_INSTALL_DIR:-.}/.env
    volumes:
      # IMPORTANT: Persists WireGuard private key and other data. If
      # /var/firezone/private_key exists when Firezone starts, it is
      # used as the WireGuard private. Otherwise, one is generated.
      - ${FZ_INSTALL_DIR:-.}/firezone:/var/firezone
    cap_add:
      # Needed for WireGuard and firewall support.
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      # Needed for masquerading and NAT.
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    depends_on:
      - postgres
    networks:
      firezone-network:
        ipv4_address: 192.168.0.20

    deploy:
      <<: *default-deploy

  postgres:
    image: postgres:15
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: ${DATABASE_NAME:-firezone}
      POSTGRES_USER: ${DATABASE_USER:-postgres}
      POSTGRES_PASSWORD: ${DATABASE_PASSWORD:?err}
    networks:
      - firezone-network
    deploy:
      <<: *default-deploy
      update_config:
        order: stop-first

# Postgres needs a named volume to prevent perms issues on non-linux platforms
volumes:
  postgres-data:

networks:
  firezone-network:
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.0.0/16

[whytf]

I read a bit of documentation and added:

- 13000:443

to ports section in firezone and it didn't help either

[jamilbk]

Try switching the order, 443:13000 though you may need to update your nginx config to proxy to http and not https in this case. The firezone container only serves http.

[whytf]

Try switching the order, 443:13000 though you may need to update your nginx config to proxy to http and not https in this case. The firezone container only serves http.

Sorry my bad,

I tried 80:13000 but it didn't work as well,

I am gonna try the method with insecure cookies.

[whytf]

E.g. try changing this:

        https:// {
          log
          reverse_proxy * 172.25.0.100:13000
          ${TLS_OPTS:-}
        }
        EOF

to this

        http:// {
          log
          reverse_proxy * 172.25.0.100:13000
        }
        EOF

and add SECURE_COOKIES=false to your $HOME/.firezone/.env

Well, https://LAN IP gets ssl protocol error and from domain it's bad gateway:

172.68.50.168 - - [21/Jan/2023:21:38:37 +0100] "GET / HTTP/2.0" 502 552 "https://xxx.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"
172.68.50.168 - - [21/Jan/2023:21:38:37 +0100] "GET / HTTP/2.0" 502 552 "https://xxx.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36" 

[whytf]

I tried 80:13000 but it didn't work as well

Well and same with caddy disabled, secure cookies parameter removed, but with exception that http://LAN IP gets connection refused

141.101.96.208 - - [21/Jan/2023:21:46:39 +0100] "GET / HTTP/2.0" 502 552 "https://xxx.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"
141.101.96.208 - - [21/Jan/2023:21:46:39 +0100] "GET / HTTP/2.0" 502 552 "https://xxx.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"

[AndrewDryga]

@whytf is nginx running within the same docker-compose?

172.25.0.100 is a network IP that is internal for docker, so if nginx is standalone, then you want to forward to a different address (localhost:13000, probably).

Also, you definitely want to open 13000 port in docker-compose to make Firezone port available to nginx. Once port is open you should be able to open http://localhost:13000 in a browser and see the UI (after you confirm that you ignore untrusted cert).

Lastly, you need to either configure nginx to trust Firezone self-signed certificate or switch it to run in HTTP mode (not HTTPS) by settings EXTERNAL_URL with http:// protocol.

And make sure that you follow the third-party proxy instructions, especially by setting X-Forwarded-For header in nginx config: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;.