Immich•3y ago

Can't connect to api endpoint after docker-compose setup

I've attempted to set up Immich using the docker-compose setup doc (https://immich.app/docs/installation/recommended-installation, https://immich.app/docs/usage/post-installation). I am unable to log in on the mobile app but am able to use the app from a web browser on desktop. The only changes I've made to my .env are setting the upload, jwt_secret, and setting the log_level to verbose in an attempt to get more information on anything that I'm seeing:

UPLOAD_LOCATION=./upload

###################################################################################
# Log message level - [simple|verbose]
###################################################################################

LOG_LEVEL=verbose

###################################################################################
# JWT SECRET
#
# This JWT_SECRET is used to sign the authentication keys for user login
# You should set it to a long randomly generated value
# You can use this command to generate one: openssl rand -base64 128
###################################################################################

JWT_SECRET=redacted

UPLOAD_LOCATION=./upload

###################################################################################
# Log message level - [simple|verbose]
###################################################################################

LOG_LEVEL=verbose

###################################################################################
# JWT SECRET
#
# This JWT_SECRET is used to sign the authentication keys for user login
# You should set it to a long randomly generated value
# You can use this command to generate one: openssl rand -base64 128
###################################################################################

JWT_SECRET=redacted

When I attempt to curl the api endpoint from localhost I get the following:

$ curl http://localhost:2283/api
{"statusCode":404,"message":"Cannot GET /api","error":"Not Found"}

$ curl http://localhost:2283/api
{"statusCode":404,"message":"Cannot GET /api","error":"Not Found"}

I've attempted to watch this live while using docker-compose up instead of with -d, but there doesn't seem to be any errors logging, even with LOG_LEVEL set to verbose. Does anyone have some hints at what to do here to debug this (probably user error)? Of particular interest would be if there are any other curl requests that reflect mine being wrong that I could use to debug.

35 Replies

Alex Tran•3y ago

did you append the /api after your IP?

monikerOP•3y ago

I did in the curl request and mobile app

Alex Tran•3y ago

your server seems to be working try curl http://your-up:2283/api/server-info can you take a screenshot of your mobile app login screen?

monikerOP•3y ago

Ah yeah that gives a correct response

Alex Tran•3y ago

if you replace localhost with the machine IP, what happened?

monikerOP•3y ago

{"diskAvailable":"59.4 TiB","diskSize":"59.6 TiB","diskUse":"210.3 GiB","diskAvailableRaw":65337326829568,"diskSizeRaw":65563158904832,"diskUseRaw":225832075264,"diskUsagePercentage":0.34}

{"diskAvailable":"59.4 TiB","diskSize":"59.6 TiB","diskUse":"210.3 GiB","diskAvailableRaw":65337326829568,"diskSizeRaw":65563158904832,"diskUseRaw":225832075264,"diskUsagePercentage":0.34}

Alex Tran•3y ago

Can you show the login screen on the mobile app? or the exact value you have for the server endpoint field

monikerOP•3y ago

sure it's http://192.168.0.35/api

Alex Tran•3y ago

it should be http://192.168.0.35:2283/api you forgot the port

monikerOP•3y ago

Ah yeah good point. I'd also like to have this behind an nginx reverse proxy. Are there any things to look out for there?

Alex Tran•3y ago

Yes you should specific client_max_body_size so that it can accept large file then just proxy back to http://192.168.0.35:2283 and you should be good to go

monikerOP•3y ago

Ack, thanks. Let me put together a quick config for that

monikerOP•3y ago

It does work on my mobile browser, but I'm not able to log in with the app. Is there any particular container that would have debug logging for this?

monikerOP•3y ago

Here is the rough proxy config (I've had issues with other headers before and other apps):

        proxy_pass http://127.0.0.1:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

        proxy_pass http://127.0.0.1:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

Alex Tran•3y ago

shoudl proxy-pass have to pass back to 192.168.0.35?

monikerOP•3y ago

usually it shouldn't need to, ideally it would be firewalled off not over https, but for debugging the port was opened Does the api try to listen for a specific hostname?

Alex Tran•3y ago

Yes it use docker dns for some@communication Can you help us to provide your whole setup, so we have a clearer picture of where might be the problem?

monikerOP•3y ago

Sure, I'm using docker-compose to run the apps, it looks like it has a reverse proxy built in (just found that config). In front of that is nginx which redirects a subdomain to localhost2283 on the server. Ideally 2283 will be restricted to localhost connections via the reverse proxy for the subdomain so it may only be accessed via https://photos.domain.tld

Alex Tran•3y ago

What is your current nginx config?

monikerOP•3y ago

server {
    if ($host = photos.domain.tld) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    listen [::]:80;

    server_name photos.domain.tld;
    return 404; # managed by Certbot
}


server {
    listen 443 ssl http2;
    server_name photos.domain.tld;
    ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    add_header Strict-Transport-Security "max-age=31536000" always;
    ssl_trusted_certificate /etc/letsencrypt/live/your_domain/chain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    client_max_body_size 500M;

    #Security / XSS Mitigation Headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    location / {
        if ($photo_users = 0) {
                add_header Content-Type text/plain;
                return 200 '';
        }

        proxy_pass http://127.0.0.1:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
    }

server {
    if ($host = photos.domain.tld) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    listen [::]:80;

    server_name photos.domain.tld;
    return 404; # managed by Certbot
}


server {
    listen 443 ssl http2;
    server_name photos.domain.tld;
    ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    add_header Strict-Transport-Security "max-age=31536000" always;
    ssl_trusted_certificate /etc/letsencrypt/live/your_domain/chain.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    client_max_body_size 500M;

    #Security / XSS Mitigation Headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    location / {
        if ($photo_users = 0) {
                add_header Content-Type text/plain;
                return 200 '';
        }

        proxy_pass http://127.0.0.1:2283;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
    }

Is there any log location in the app perchance? I see the logs but they are empty

Alex Tran•3y ago

Yes you can access the server container log

monikerOP•3y ago

docker logs immich_immich-server_1  -f --tail 0

docker logs immich_immich-server_1  -f --tail 0

doesn't how anything while trying to log in or use the webapp Would changing NODE_ENV give more output?

Alex Tran•3y ago

No, then there is no logs on that level What is the response of the endpoint yourdns/api/server-info?

monikerOP•3y ago

That's fine

{"diskAvailable":"59.4 TiB","diskSize":"59.6 TiB","diskUse":"210.3 GiB","diskAvailableRaw":65337326829568,"diskSizeRaw":65563158904832,"diskUseRaw":225832075264,"diskUsagePercentage":0.34}

{"diskAvailable":"59.4 TiB","diskSize":"59.6 TiB","diskUse":"210.3 GiB","diskAvailableRaw":65337326829568,"diskSizeRaw":65563158904832,"diskUseRaw":225832075264,"diskUsagePercentage":0.34}

Alex Tran•3y ago

strange not sure why the mobile app cannot connect to the server

bo0tzz•3y ago

Is the https cert valid? & is there anything in the mobile app logs?

monikerOP•3y ago

no yes

monikerOP•3y ago

From the second screenshot here it seems like the mobile website can touch the api server-status endpoint (disk usage is available in the bottom left)

bo0tzz•3y ago

@Alex Tran we should add some logging in the login code

monikerOP•3y ago

Thanks for the help y'all, I am not in any rush to have everything up and running, so if that isn't a large lift I can wait until that to see what issue I undoubtedly have on my end lol. I believe the web app will be enough to start with for a bit playing with my existing pictures folder 🙂 Very cool project, and thanks for the quick replies

Alex Tran•3y ago

Can you try remove these line?

        if ($photo_users = 0) {
                add_header Content-Type text/plain;
                return 200 '';
        }

        if ($photo_users = 0) {
                add_header Content-Type text/plain;
                return 200 '';
        }

monikerOP•3y ago

Sure Same failure oh wait I had a type with the first failure, hmm that's super interesting. That check was with the geo_ip module to see if it's certain IPs cool it seems like it logged in! I'll have to do some debugging on my side, I also downgraded the http version with proxy_http_version 1.1;, but I didn't kill and clear the data of themmobile app

Alex Tran•3y ago

Ah a good step forward then let us know what you find out, it will be great for the latecomer with the similar issues

monikerOP•3y ago

Awesome, thanks! I re-enabled the geo_ip filtering (makes sure only certain wg peers can see sites), and the app still works. So it seems like if there is a proxy in front of it there should be a similar clause to that in the immich reverse proxy:

      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;

      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;

the first line there is what I was lacking So within my setup if someone has a nginx reverse proxy in front of the app they should include:

        proxy_pass http://127.0.0.1:2283;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

        proxy_pass http://127.0.0.1:2283;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

in the server block for their subdomain, provided they are running it on the same local IP

Gaming

Programming

Can't connect to api endpoint after docker-compose setup

Did you find this page helpful?