1

Issue Summary

Since setting up an Nginx reverse proxy on my home network, one of the applications I host on my server consistently yields an error 502: Bad Gateway when I visit its URL, with at least one corresponding error 111 ("Connection refused") in the Nginx error log.

System Details

  • Server ("MyDomain"):
    • OS: YunoHost v. 3.8.5.7 (a Debian Stretch-based distro)
    • Hardware: An old desktop computer
    • Network Connection: via Ethernet cable to my router
  • Reverse proxy:
    • OS: Raspbian GNU/Linux 10 (buster)
    • Hardware: Raspberry Pi 4 Model B
    • Network Connection: via WiFi

The flow of network traffic looks something like this:

Internet -> Router -> Raspberry Pi reverse proxy -> [ MyDomain server -> internal reverse proxy ]

That last step, "internal reverse proxy", refers to the Nginx reverse proxy that is automatically configured and managed by the YunoHost system, which allows for several different services to be hosted and fetched.

Issue Details

I use YunoHost to host several services on servers on my home network, including calibreweb. I use several domains, but only one is affected by this issue--let's call it MyDomain.com.

On June 11, I set up the Raspberry Pi reverse proxy on my home network so that I could direct traffic to two separate YunoHost servers. Before setting up that proxy, I could navigate to MyDomain.com/calibre and the calibreweb service would load. Since that date, navigating to MyDomain.com/calibre instead yields an error 502: Bad Gateway in my browser. When I check the /var/log/nginx/mydomain.com-error.log file on the MyDomain server, I see a corresponding error message:

2020/08/14 17:32:46 [error] 23605#23605: *149804 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.0.179, server: mydomain.com, request: "GET /calibre/ HTTP/1.0", upstream: "http://127.0.0.1:8083/calibre/", host: "mydomain.com"

Additionally, there has been nothing added to the /var/log/calibreweb/calibreweb-access.log file since June 11.

No other services on the mydomain.com domain are similarly affected. I can go to mydomain.com/gitea, mydomain.com/wallabag, and mydomain.com/wiki successfully. It is only calibreweb that fails in this way.

Expected Behavior

Navigating to mydomain.com/calibre loads the Calibre web app.

Nginx configuration files

As mentioned above, there are two Nginx reverse proxies at play here, and I expect there is some disagreement between the two of them causing this issue. The first reverse proxy is the Raspberry Pi proxy, which directs traffic to different machines on my home network depending on what is requested. The second reverse proxy is the YunoHost built-in proxy on the MyDomain machine.

On the Raspberry Pi reverse proxy (the first reverse proxy encountered), the /etc/nginx/sites-available/xanderwhart.us.conf file looks like this:

server {
        server_name mydomain.com;
        location / {
                proxy_pass              https://192.168.0.117;
                proxy_redirect          off;
                proxy_read_timeout      60s;

                proxy_set_header        Host            mydomain.com;
                proxy_set_header        X-Real-IP       $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;

                client_max_body_size 50M;
        }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



}
server {
    if ($host = mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        server_name mydomain.com;
    return 404; # managed by Certbot


}

On the YunoHost built-in proxy (the second encountered), here's /etc/nginx/conf.d/mydomain.com.d/calibreweb.conf:

location /calibre {
  client_max_body_size 200M;
  # Force usage of https
  if ($scheme = http) {
    rewrite ^ https://$server_name$request_uri? permanent;
  }
        proxy_pass                              http://localhost:8083;
        proxy_set_header                X-Forwarded-For                         $remote_addr;
        proxy_set_header                Host                                            $http_host;
        proxy_set_header                X-Forwarded-For                         $proxy_add_x_forwarded_for;
        proxy_set_header                X-Scheme                                        $scheme;
        proxy_set_header                X-Script-Name                           /calibre;
#        proxy_set_header               X-Remote-User                           $remote_user;

  # Include SSOWAT user panel.
  include conf.d/yunohost_panel.conf.inc;
}

What I've tried

  • Restarting the Nginx service: Nothing changes
  • Restarting the Calibreweb service: Nothing changes
  • Checking the status of calibreweb with systemctl status calibreweb: Reports as loaded and active
  • Executing curl 127.0.0.1:8083 from a session on the MyDomain computer: Yields "curl: (7) Failed to connect to 127.0.0.1 port 8083: Connection refused"
  • Checking if port 8083 is open on the MyDomain computer: It is
  • Navigating to http://192.168.0.117:8083/ (the local IP address of the MyDomain computer) from my desktop computer on the same network: "Firefox can’t establish a connection to the server at 192.168.0.117:8083."

Suspicions and Final Notes

I suspect that there is an incompatibility between the two Nginx reverse proxies based on the timing of this issue's onset, but I am not a knowledgeable enough network admin (I'm a total newb) to identify what's going on. All assistance is welcome; thanks in advance.

1

Well, I tried uninstalling and reinstalling the Calibreweb package, and that appears to have fixed the issue. It doesn't leave me any closer to understanding the issue, but at least it's resolved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.