Getting ConnectTimeoutError

[abedhariri]

Hi Everyone

This is my first question here, if I am missing anything please tell me.

I have a nextjs v15 hosted on digital ocean on a droplet using docker (standalone). I implemented next-auth v5 a while back (3month ago), it was working fine untill 2 weeks ago, when it started not working. I am unable to sign in with credentials, google or github. It is important to mention I am using nginx as a reverse_proxy. the setup is working fine local but not in prod.

Here is my auth file

export const { handlers, signIn, signOut, auth } = NextAuth({
  session: {
    strategy: 'jwt',
  },
  jwt: { encode, decode },
  debug: true,
  providers: [
    Credentials({
      credentials: {
        email: { label: 'email' },
        password: { label: 'password' },
      },
      async authorize(credentials) {
        if (!credentials?.email || !credentials?.password) return null;
        console.log('#### starting signin');

        const user = await getUserByEmail(credentials.email as string, true);
        console.log('#### getUser');

        if (!user) return null;
        console.log('#### getUser');

        const isPasswordValid = await bcrypt.compare(credentials.password as string, user.password!);
        console.log('#### compare password');

        if (!isPasswordValid) return null;
        console.log('#### password is valid');

        return user;
      },
    }),
    Github,
    Google,
  ],
  pages: {
    signIn: '/signin',
  },
  trustHost: true,
});

Here is my nginx conf

server
{

    server_name www.taskapm.com taskapm.com;

    location / {
        proxy_pass http://localhost:3000;
	# Forward headers to match the domain
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/taskapm.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/taskapm.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server
{
    if ($host = www.taskapm.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = taskapm.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    listen [::]:80;

    server_name www.taskapm.com taskapm.com;
    return 404; # managed by Certbot

}

Package.json

{
  "name": "nextjs-template",
  "version": "1.24.0",
  "private": true,
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "npm run copy:public && npm run copy:static && node .next/standalone/server.js",
    "lint": "next lint",
    "test:ui": "npx playwright test --ui",
    "copy:public": "cp -R public ./.next/standalone/public",
    "copy:static": "cp -R .next/static ./.next/standalone/.next/static",
    "prepare": "husky"
  },
  "dependencies": {
    "@auth/pg-adapter": "^1.7.4",
    "@hookform/resolvers": "^3.9.1",
    "@opentelemetry/api-logs": "^0.57.1",
    "@opentelemetry/auto-instrumentations-node": "^0.56.0",
    "@opentelemetry/exporter-jaeger": "^1.30.1",
    "@opentelemetry/exporter-trace-otlp-http": "^0.57.1",
    "@opentelemetry/instrumentation": "^0.57.1",
    "@opentelemetry/resources": "^1.30.1",
    "@opentelemetry/sdk-logs": "^0.57.1",
    "@opentelemetry/sdk-node": "^0.57.1",
    "@opentelemetry/sdk-trace-node": "^1.30.1",
    "@opentelemetry/semantic-conventions": "^1.29.0",
    "@opentelemetry/winston-transport": "^0.10.0",
    "@radix-ui/react-checkbox": "^1.1.2",
    "@radix-ui/react-dialog": "^1.1.2",
    "@radix-ui/react-dropdown-menu": "^2.1.2",
    "@radix-ui/react-label": "^2.1.0",
    "@radix-ui/react-popover": "^1.1.2",
    "@radix-ui/react-separator": "^1.1.0",
    "@radix-ui/react-slot": "^1.1.0",
    "@radix-ui/react-switch": "^1.1.2",
    "@radix-ui/react-tabs": "^1.1.1",
    "@radix-ui/react-toast": "^1.2.2",
    "@radix-ui/react-tooltip": "^1.1.3",
    "@semantic-release/git": "^10.0.1",
    "@semantic-release/npm": "^12.0.1",
    "@tanstack/react-table": "^8.20.5",
    "bcryptjs": "^2.4.3",
    "class-variance-authority": "^0.7.0",
    "clsx": "^2.1.1",
    "date-fns": "^3.6.0",
    "date-fns-tz": "^3.2.0",
    "lucide-react": "^0.454.0",
    "next": "15.0.3",
    "next-auth": "^5.0.0-beta.25",
    "pg": "^8.13.1",
    "prettier": "^3.4.2",
    "react": "18.3.1",
    "react-day-picker": "^8.10.1",
    "react-dom": "18.2.0",
    "react-hook-form": "^7.53.1",
    "tailwind-merge": "^2.5.4",
    "tailwindcss-animate": "^1.0.7",
    "ternat": "^1.4.0",
    "uuid": "^11.0.2",
    "zod": "^3.23.8"
  },
  "devDependencies": {
    "@playwright/test": "^1.49.0",
    "@semantic-release/changelog": "^6.0.3",
    "@semantic-release/commit-analyzer": "^13.0.0",
    "@semantic-release/github": "^11.0.0",
    "@semantic-release/release-notes-generator": "^14.0.1",
    "@types/bcryptjs": "^2.4.6",
    "@types/node": "^20",
    "@types/pg": "^8.11.10",
    "@types/react": "^18",
    "@types/react-dom": "^18",
    "dotenv": "^16.4.5",
    "eslint": "^8",
    "eslint-config-next": "15.0.3",
    "husky": "^9.1.7",
    "lint-staged": "^15.2.11",
    "postcss": "^8",
    "tailwindcss": "^3.4.1",
    "tsx": "^4.19.2",
    "typescript": "^5"
  },
  "lint-staged": {
    "*.ts?(x)": [
      "eslint",
      "prettier --write"
    ]
  }
}

Here are the envs I am using. I have double checked if the are being set and they are.
AUTH_SECRET
AUTH_TRUST_HOST
AUTH_GITHUB_ID
AUTH_GITHUB_SECRET
AUTH_GOOGLE_ID
AUTH_GOOGLE_SECRET

Here is the error I am getting in production

[auth][error] CallbackRouteError: Read more at https://errors.authjs.dev#callbackrouteerror
[auth][cause]: TypeError: fetch failed
at node:internal/deps/undici/undici:13502:13
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
at async tW (/app/.next/standalone/.next/server/chunks/466.js:368:14205)
at async rK (/app/.next/standalone/.next/server/chunks/466.js:368:33428)
at async rQ (/app/.next/standalone/.next/server/chunks/466.js:368:40473)
at async r9 (/app/.next/standalone/.next/server/chunks/466.js:368:52077)
at async ne (/app/.next/standalone/.next/server/chunks/466.js:368:56815)
at async te.do (/app/.next/standalone/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:18:17826)
at async te.handle (/app/.next/standalone/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:18:22492)
at async doRender (/app/.next/standalone/node_modules/next/dist/server/base-server.js:1455:42)
[auth][details]: {
"name": "ConnectTimeoutError",
"code": "UND_ERR_CONNECT_TIMEOUT",
"provider": "github"
}

[Aman3899]

This error (ConnectTimeoutError: UND_ERR_CONNECT_TIMEOUT) indicates that NextAuth is unable to reach GitHub for authentication. Here are some possible causes and fixes:

1. Check Network Connectivity

• Run the following command on your Digital Ocean droplet to check if it can reach GitHub:

  curl -v https://github.com

  If it fails, your server might be blocking outbound requests.

2. Check Nginx Configuration

Your Nginx reverse proxy is missing proxy_timeout settings, which might be causing the timeout. Update your config:

server {
    server_name www.taskapm.com taskapm.com;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Add timeout settings
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/taskapm.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/taskapm.com/privkey.pem;
}

After updating, restart Nginx:

sudo systemctl restart nginx

3. Increase NextAuth Timeout

Modify your NextAuth configuration to set a higher fetch timeout:

export const { handlers, signIn, signOut, auth } = NextAuth({
  providers: [
    Github({
      clientId: process.env.AUTH_GITHUB_ID,
      clientSecret: process.env.AUTH_GITHUB_SECRET,
      httpOptions: {
        timeout: 60000, // 60 seconds
      }
    }),
    Google({
      clientId: process.env.AUTH_GOOGLE_ID,
      clientSecret: process.env.AUTH_GOOGLE_SECRET,
      httpOptions: {
        timeout: 60000, // 60 seconds
      }
    }),
  ],
  debug: true,
  trustHost: true,
});

4. Check Digital Ocean Firewall

• If your droplet has a firewall, ensure it allows outbound requests to GitHub and Google.
• Run:

  sudo ufw status

  If it's active, allow outbound traffic:

  sudo ufw allow out on eth0

5. Check Docker Network

Since you're running inside a Docker container, it might be a DNS issue:

• Try restarting your container:

  docker restart <your_container_id>

• Check if the container can resolve GitHub:

  docker exec -it <your_container_id> ping github.com

  If it fails, add Google's DNS to your container:

  docker network create \
    --driver bridge \
    --dns 8.8.8.8 \
    --dns 8.8.4.4 \
    my_custom_network

  Then restart your container using this network.