Repository navigation
Let lab-net containers reach eln.ddomlab.org through Caddy - #4
Merged
Merged
Conversation
eln-server calls eLabFTW's API at https://eln.ddomlab.org. From inside a container that name resolves to the server's own public IP, and the host firewall drops that traffic, so the call times out. A network alias makes the name resolve to the Caddy container on lab-net instead: same certificate, same route to eLabFTW, and no firewall change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
During the eln_server deploy, the new
eln-servercontainer was healthy but couldn't reach eLabFTW.https://eln.ddomlab.org/api/v2/infotimed out from inside the container (from the host and from outside, it answers 401 as expected).Inside a container,
eln.ddomlab.orgresolves to the server's own public IP. Docker doesn't route a container's call to its own host's published port back through Docker's port forwarding, so the packet lands on the host's firewall, which only allows SSH, and gets dropped.Fix
Give the Caddy container the network alias
eln.ddomlab.orgonlab-net. Docker's internal DNS answers that name with Caddy's container IP for containers onlab-net, so eln-server talks to Caddy directly: same valid Let's Encrypt certificate, same route to eLabFTW, and it shows up in the Caddy access log. Clients outside Docker aren't affected, and there's no firewall change.Tested
docker compose config: valid.172.25.0.2), not public DNS.Deploy
The compose file changed, so Caddy must be recreated:
sudo docker compose up -din/opt/edge(a plainrestartdoesn't apply compose changes). This also picks up the:5000route from #3. The site drops for a second or two.🤖 Generated with Claude Code