Error log but successfull connection when using reverse proxy with NGINX

[viertelb]

I want to find out why error.log is posting an error

2022/07/27 09:01:47 [error] 7337#7337: *10 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.111.1, server: MYDOMAIN.de, request: "REPORT /Hans/15b89950-1c5a-2b10-38bd-8b01c1178843/ HTTP/1.1", upstream: "http://[::1]:5232/Hans/15b89950-1c5a-2b10-38bd-8b01c1178843/", host: "MYDOMAIN.de:MYPORT"

while the connection actually is established well

192.168.111.1 - Hans [27/Jul/2022:09:01:46 +0200] "PROPFIND /Hans/15b89950-1c5a-2b10-38bd-8b01c1178843/ HTTP/1.1" 207 473 "-" "DAVx5/3.3.7-ose (2020/11/30; dav4jvm; okhttp/4.9.0) Android/10"
192.168.111.1 - Hans [27/Jul/2022:09:01:47 +0200] "REPORT /Hans/15b89950-1c5a-2b10-38bd-8b01c1178843/ HTTP/1.1" 207 4776 "-" "DAVx5/3.3.7-ose (2020/11/30; dav4jvm; okhttp/4.9.0) Android/10"
192.168.111.1 - Hans [27/Jul/2022:09:01:47 +0200] "REPORT /Hans/15b89950-1c5a-2b10-38bd-8b01c1178843/ HTTP/1.1" 207 573 "-" "DAVx5/3.3.7-ose (2020/11/30; dav4jvm; okhttp/4.9.0) Android/10"

and the changes or additions in my calendar are written and the changes are immediately readable from other clients.

My setup is

• client phone using OpenSync
• client phone using DAVx
• Raspberry Pi with Radicale and NGINX as reverse proxy

NGINX config file in conf.d for the Radicale server:

server {
  server_name MYDOMAIN.de;
  listen MYPORT ssl;
  location / {
    proxy_pass http://localhost:5232/;
    proxy_set_header X-Script-Name /;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_pass_header Authorization;
  }

  # managed by Certbot:
  ssl_certificate /etc/letsencrypt/live/MYDOMAIN.de/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/MYDOMAIN.de/privkey.pem; 
  include /etc/letsencrypt/options-ssl-nginx.conf; 
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

general nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	gzip on;

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}

and /etc/radicale/config:

[server]

# CalDAV server hostnames separated by a comma
# IPv4 syntax: address:port
# IPv6 syntax: [address]:port
# For example: 0.0.0.0:9999, [::]:9999
#hosts = localhost:5232

# Max parallel connections
#max_connections = 8

# Max size of request body (bytes)
#max_content_length = 100000000

# Socket timeout (seconds)
#timeout = 30

# SSL flag, enable HTTPS protocol
#ssl = False

# SSL certificate path
#certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem

# SSL private key
#key = /etc/ssl/private/ssl-cert-snakeoil.key

# CA certificate for validating clients. This can be used to secure
# TCP traffic between Radicale and a reverse proxy
#certificate_authority =

hosts = 192.168.111.90:5232, 127.0.0.1:5232

[encoding]

# Encoding for responding requests
#request = utf-8

# Encoding for storing local collections
#stock = utf-8


[auth]

# Value: none | htpasswd | remote_user | http_x_remote_user
type = htpasswd

htpasswd_filename = /etc/radicale/users

# Value: plain | bcrypt | md5
# bcrypt requires the installation of radicale[bcrypt].
htpasswd_encryption = md5

# Incorrect authentication delay (seconds)
#delay = 1

# Message displayed in the client when a password is needed
#realm = Radicale - Password Required


[rights]

# Rights backend
# Value: none | authenticated | owner_only | owner_write | from_file
type = from_file

# File for rights management from_file
file = /etc/radicale/rights


[storage]

# Storage backend
# Value: multifilesystem
#type = multifilesystem

# Folder for storing local collections, created if not present
#filesystem_folder = /var/lib/radicale/collections

# Delete sync token that are older (seconds)
#max_sync_token_age = 2592000

# Command that is run after changes to storage
# Example: ([ -d .git ] || git init) && ([ -e .gitignore ] || printf '.Radicale.cache\n.Radicale.lock\n.Radicale.tmp-*\n' > .gitignore) && git add -A && (git diff --cached --quiet || git commit -m "Changes by "%(user)s)
#hook =


[web]

# Web interface backend
# Value: none | internal
#type = internal


[logging]

# Threshold for the logger
# Value: debug | info | warning | error | critical
level = error

# Don't include passwords in logs
#mask_passwords = True


[headers]

# Additional HTTP headers
#Access-Control-Allow-Origin = *

[hanscees]

I am troubleshooting this as well. I haver not found any working radicale nginx configuration.
It seems all nginx reverse proxy examples from the recidale website are broken.

I have the same nginx reverse proxy setup as you have here above. When using nginx before radicale it simply does not work with radicale authentication.

Here you can see another person not being able to authentice to racidale: tomsquest/docker-radicale#138

While using radicale without the reverse proxy before it, it works fine. When I connect directly to the radicale server on the docker host all is well: I get the login page. I can log in fine. I can upload an ics file and use thunderbird to manage my calendar. Perfect.

But when nginx is in front of it, the login page does not work at all.
I do get the login page in the browser. But when I add the user and password and hit enter nothing happens: there is no http traffic going from nginx to the remote radicale server at all.

It seems the documentation is simply wrong as it is on the website.

[pbiering]

I can't replicate.

• installed `nginx' (EL9)
• created config as documented on https://github.com/Kozea/Radicale/blob/master/DOCUMENTATION.md

cat /etc/nginx/default.d/radicale.conf 
location /radicale/ { # The trailing / is important!
    proxy_pass        http://localhost:5232/; # The / is important!
    proxy_set_header  X-Script-Name /radicale;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;
    proxy_pass_header Authorization;
}

• Radicale listen config:

[server]
hosts = localhost:5232

• Radicale started, it's listen on configured IP/ports:

netstat -nlpt |grep :5232
tcp        0      0 127.0.0.1:5232          0.0.0.0:*               LISTEN      4117/python3        
tcp6       0      0 ::1:5232                :::*                    LISTEN      4117/python3       

• nginx started, it's listen on default IP/ports:

netstat -nlpt |grep ":80 "
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      3942/nginx: master  
tcp6       0      0 :::80                   :::*                    LISTEN      3942/nginx: master  

• Connect on local system directly using curl to radicale's port (returns HTML)

curl http://localhost:5232/.web/

• Connect on local system directly using curl to nginx port and extended URI matching configured location (returns HTML)

curl http://localhost:80/radicale/.web/

Using brower and URL from above, login window appears and credentials are accepted.

[pbiering]

See also https://github.com/Kozea/Radicale/wiki/Reverse-Proxy-Diagnostics-Troubleshooting

[damionx7]

Try using solution posted at #838 (comment).