v1 - tsdproxy can see the hosts but fails to forward to them (502 each time)

[yatesco]

EDIT: it works if I expose the port to the host (e.g. use "Publish port on the host for external access"). I understand this allows Tailscale to access the host directly, but I thought the "proxy" part of "tsdproxy" meant it didn't need to (i.e. everything goes through tsdproxy!). Should I set up caddy/traefik instead?

I'm using truenas scale and configured a number of apps from their store. They are all configured with:

• network mode of "Expose port for inter-container communication".
• label of tsdproxy.enable = true mapped to the actual service
• label of tsdproxy.port = "<whatever is configured in the TrueNAS UI>"

I ran tsdproxy (v1) manually as root via the provided docker-compose and haven't changed the generated tsdproxy.yaml.

Visiting the tsdproxy dashboard shows the correct names of the dockers and I can authorised them.

However, when I try and connect it isn't managing to forward on to them and times out, showing a 502 in the tsdproxy logs.

I've tried adding the "tsdproxy.container_port=<the actual port running in the downstream docker container>" but no luck.

For example:

and

My thinking is that if tsdproxy can query the labels then it should be able to access the correct port without the app container (e.g. gitea) having to export the port to the host?

Help :-).

(similar: #244)

[dextermb]

I have got it working with the following set up...

When I was hitting 502s from my proxied services it was due to having them as Ephemeral so when I was auto-deploying (downing and recreating) it was causing DNS issues. However since moving away from Ephemeral machines when I auto-deploy it just re-attaches to the pre-existing instance of the machine.

Sometimes when deploying a new machine (service) it seems like DNS propagation takes some time, but after the initial creation I don't have issues.

TSDProxy:
docker-compose.yml

services:
  tailscale-proxy:
    image: almeidapaulopt/tsdproxy:1
    volumes:
      - /srv/tailscale-authkey.txt:/config/authkey.txt
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config:/config
      - datadir:/data
    restart: unless-stopped
    ports:
      - "8080:8080"
    networks:
      - tsdproxy

networks:
  tsdproxy:
    driver: bridge
    name: tsdproxy

volumes:
  datadir:

tsdproxy.yaml

defaultProxyProvider: default
docker:
    local:
        host: unix:///var/run/docker.sock
        targetHostname: 172.31.0.1
        defaultProxyProvider: default
files: {}
tailscale:
    providers:
        default:
            authKeyFile: /config/authkey.txt
            controlUrl: https://controlplane.tailscale.com
    dataDir: /data/
http:
    hostname: 0.0.0.0
    port: 8080
log:
    level: info
    json: false
proxyAccessLog: true

Frontend:
docker-compose.yml

services:
  nginx:
    build: .
    expose:
      - 80
    labels:
      - "tsdproxy.enable=true"
      - "tsdproxy.name=frontend"
      - "tsdproxy.container_port=80"
    networks:
      - website
      - tsdproxy

networks:
  website:
    external: true
  tsdproxy:
    external: true

Backend:
docker-compose.yml

services:
  nginx:
    build: .
    expose:
      - 80
    labels:
      - "tsdproxy.enable=true"
      - "tsdproxy.name=backend"
      - "tsdproxy.container_port=80"
    networks:
      - website
      - tsdproxy

networks:
  website:
    name: website
  tsdproxy:
    external: true

[yatesco]

thanks! I'll have a play.