[BUG] Unable to make stream work

[amberflag48]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Hello,

I either get a connection unexpectedly closed or timeout when accessing backend apps using Stream and SSL preread. The back-end apps are working fine when accessed directly. The frontend host, where I am trying to setup stream from, can server v-host sites just fine, so the certs are working.

I do not see any errors in the stream, nor nginx logs.

The nginx.conf file is default except I've commented include /config/nginx/site-confs/*.conf;. The content of the attached stream.txt file is stored under /etc/nginx/stream.d/stream.conf and is being included correctly.
stream.txt

Thanks!

Expected Behavior

Stream should be working, like it does when building Nginx from source.

Steps To Reproduce

1. Spin up a new Linode.
2. Install Docker using the official Docker repo.
3. Spin up a SWAG instance, make sure the certificate is being generated properly.
4. Setup Stream using SSL Preread.
5. Change the DNS records to point to front-end instead of back-end.

Environment

- OS: Debian 11
- How docker service was installed: Official repo

CPU architecture

x86-64

Docker creation

services:
  swag:
    image: 'lscr.io/linuxserver/swag'
    container_name: 'swag'
    cap_add:
      - 'NET_ADMIN'
    environment:
      - "PUID=${PUID}"
      - "PGID=${PGID}"
      - "TZ=${TZ}"
      - "URL=${Public_Domain}"
      - 'SUBDOMAINS=wildcard'
      - 'VALIDATION=dns'
      - 'DNSPLUGIN=cloudflare'
      - 'PROPAGATION=60'
      - "EXTRA_DOMAINS=*.media.${Public_Domain},*.private.${Public_Domain}"
    volumes:
      - "${Docker_Path}/swag:/config"
      - "${Docker_Path}/swag/stream.d:/etc/nginx/stream.d"
    ports:
      - '443:443'
    restart: "${Restart}"

Container logs

migrations] started
[migrations] 01-nginx-site-confs-default: skipped
[migrations] done
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗ 
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝ 

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
Certbot: https://supporters.eff.org/donate/support-work-on-certbot

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────

using keys found in /config/keys
Variables set:
PUID=1000
PGID=1000
TZ=America/Toronto
URL=example.com
SUBDOMAINS=wildcard
EXTRA_DOMAINS=*.media.example.com,*.private.example.com
ONLY_SUBDOMAINS=false
VALIDATION=dns
CERTPROVIDER=
DNSPLUGIN=cloudflare
EMAIL=
STAGING=

Using Let's Encrypt as the cert provider
SUBDOMAINS entered, processing
Wildcard cert for example.com will be requested
EXTRA_DOMAINS entered, processing
Extra domains processed are:  -d *.media.example.com -d *.private.example.com
No e-mail address entered or address invalid
dns validation via cloudflare plugin is selected
Certificate exists; parameters unchanged; starting nginx
The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am).
[custom-init] No custom files found, skipping...
[ls.io-init] done.
Server ready

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

We don't provide support for the nginx Stream module. There's no reason it shouldn't be possible to make it work, but the number of possible configurations means it's not something we'll assist with setting up.

[nemchik]

We actually recently removed the stream.conf shipped by alpine linuxserver/docker-baseimage-alpine-nginx#129 making it possibly to include and configure your own stream configs. That being said, I will echo @thespad in that we don't provide support for it, but you should now be able to accomplish it.