Nginx Reverse Proxy into Foundry Containers

[LousyLeonard]

Hi There,

I'm really struggling getting over the finish line setting up a reverse Nginx proxy server in front of two of your docker containers (eventually to be at /laz and /dom but for now just on different ports).

Bit of a punt but can you offer any guidance?
I can reach both the containers at their ports with https://<ip>:<port>.com.
<my ip>/laz or /dom gives me nothing.
The Nginx config originally started as the frontpage's readme but I've slowly removed all the frills in an effort to debug.

foundaryvtt-loc-image is built from felddy/foundryvtt-docker with the port changed to 8080.

Nginx is running from the VM not docker. (but that didn't work either)

docker-compose.yml

version: "3.8"

services:
  foundry:
    image: foundaryvtt-loc-image (built from felddy/foundryvtt-docker with port change to 8080)
    container_name: foundaryvtt-container
    hostname: my_foundry_host
    init: true
    restart: "always"
    volumes:
      - type: bind
        source: ../foundaryvtt-data/data 
        target: /data
    environment:
      - FOUNDRY_PASSWORD=<pass>
      - FOUNDRY_USERNAME=<user>
      - FOUNDRY_ADMIN_KEY=<key>
      - CONTAINER_CACHE=/data/container_cache
      - FOUNDRY_MINIFY_STATIC_FILES=true
    ports:
      - target: ${PORT:-8080}
        published: ${PORT:-30001}
        protocol: tcp
        mode: host

  foundry2:
    image: foundaryvtt-loc-image
    container_name: foundaryvtt-container2
    hostname: my_foundry_host2
    init: true
    restart: "always"
    volumes:
      - type: bind
        source: ../foundaryvtt-data3/data
        target: /data
    environment:
      - FOUNDRY_ADMIN_KEY=<key2>
      - FOUNDRY_PASSWORD=<pass2>
      - FOUNDRY_USERNAME=<user2>
      - CONTAINER_CACHE=/data/container_cache
      - FOUNDRY_MINIFY_STATIC_FILES=true
    ports:
      - target: ${PORT:-8080}
        published: ${PORT:-30000}
        protocol: tcp
        mode: host

default.conf

server {
    listen 443 ssl;
    server_name <my domain> www.<my domain>;

    ssl_certificate /etc/letsencrypt/live/<my domain>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<my domain>/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/<my domain>/chain.pem;

    # location / {
    #     return 301 https://<my domain>/laz;
    # }

    location /laz {
        proxy_pass http://127.0.0.1:30001;
    }

    location /dom {
        proxy_pass http://127.0.0.1:30000;
    }
}


server {
    listen 80;
    server_name <my domain> www. <my domain>;
    return 301 https://<my domain>/$request_uri;
}

[felddy]

Hey @LousyLeonard,

I'll see if I can help, but using a modification of the this project's container is going to limit my confidence in any solution I provide to you. You shouldn't need to change the port that is "exposed" by the container. If you want the service to listen on a different port, you simply need to "publish" that port.

This might be a useful read if you are new to Docker networking:

• https://docs.docker.com/config/containers/container-networking/
• https://docs.docker.com/network/

This is how I would accomplish what I believe you are trying to do using the container from this project. Let me know if it works for you.

docker-compose.yml

---
version: "3.8"

services:
  foundry_1:
    image: felddy/foundryvtt:release
    hostname: foundry_host_1
    init: true
    restart: "unless-stopped"
    volumes:
      - type: bind
        source: ./data_1
        target: /data
    environment:
      - CONTAINER_CACHE=/data/container_cache
      - CONTAINER_VERBOSE=true
      - FOUNDRY_ADMIN_KEY=<key>
      - FOUNDRY_LICENSE_KEY=1
      - FOUNDRY_MINIFY_STATIC_FILES=true
      - FOUNDRY_PASSWORD=<pass>
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_ROUTE_PREFIX=laz
      - FOUNDRY_USERNAME=<user>
    ports:
      - target: "30000"
        published: "30001"
        protocol: tcp
  foundry_2:
    image: felddy/foundryvtt:release
    hostname: foundry_host_2
    init: true
    restart: "unless-stopped"
    volumes:
      - type: bind
        source: ./data_2
        target: /data
    environment:
      - CONTAINER_CACHE=/data/container_cache
      - CONTAINER_VERBOSE=true
      - FOUNDRY_ADMIN_KEY=<key>
      - FOUNDRY_LICENSE_KEY=2
      - FOUNDRY_MINIFY_STATIC_FILES=true
      - FOUNDRY_PASSWORD=<pass>
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_ROUTE_PREFIX=dom
      - FOUNDRY_USERNAME=<user>
    ports:
      - target: "30000"
        published: "30002"
        protocol: tcp

nginx.conf

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name example.com www.example.com;

    if ($host = www.example.com) {
        return 301 https://example.com$request_uri;
    }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    add_header Access-Control-Allow-Origin https://example.com always;

    location /laz {
        # Foundry Virtual Tabletop routePrefix = "laz"

        proxy_http_version 1.1;
        access_log /var/log/nginx/upstream_log upstream_logging;

        proxy_read_timeout 90;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        proxy_pass http://localhost:30001;
    }

    location /dom {
        # Foundry Virtual Tabletop routePrefix = "dom"

        proxy_http_version 1.1;
        access_log /var/log/nginx/upstream_log upstream_logging;

        proxy_read_timeout 90;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        proxy_pass http://localhost:30002;
    }
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

[LousyLeonard]

Thanks I'll give this a go later tonight.

For context I modified the original container to work on the Google Run engine which is a CaaS. Part of the agreement was that it had to serve from 8080 and contain their {PORT} variable - the container not the published port. I dropped this though when I realised there was no persistent storage solution offered.
The image remains in use as it's convenient to avoid the download as I try new things.

[LousyLeonard]

This got it working cheers!

Worth noting that I don't believe upstream_logging is a traditional nginx logging format, I ended up declaring a custom version myself.
I found a version here:
https://dev.to/danielkun/nginx-everything-about-proxypass-2ona
but it also required me to set the upstream variable.

Finally I had to remove the default_server from the 80 port as it complained about a duplicate.

Final version of default.conf

log_format upstream_logging '[$time_local] $remote_addr - $remote_user - $server_name to: "$upstream": "$request" upstream_response_time $upstream_response_time msec $msec request_time $request_time';
server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name example.com www.example.com;

     if ($host = www.example.com) {
        return 301 https://example.com$request_uri;
     }

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    add_header Access-Control-Allow-Origin https://example.com always;

    location /laz {
        # Foundry Virtual Tabletop routePrefix = "laz"
        proxy_http_version 1.1;
        access_log /var/log/nginx/upstream_log upstream_logging;

        proxy_read_timeout 90;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        set $upstream http://localhost:30001;
        proxy_pass $upstream;
    }

   location /dom {
        # Foundry Virtual Tabletop routePrefix = "dom"
        proxy_http_version 1.1;
        access_log /var/log/nginx/upstream_log upstream_logging;

        proxy_read_timeout 90;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;

        set $upstream http://localhost:30002;
        proxy_pass $upstream;
    }
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://example.com/$request_uri;
}

[LousyLeonard]

Following on from this if anyone is trying to do this.

Within my server block I have had to add:

client_max_body_size 2000M; 

To actually download some of the assets from foundry.