0

I have a NAS where I am running various web apps in docker containers through docker-compose. I want some of these web apps to be accessible through the internet, not only when I am connected to my home network.

The problem I'm currently facing is that while cloudflare is able to expose the default web apps (default NAS management 192.168.1.135:80 can be mapped to subdomain.domain.com, for instance), it is unable to expose any docker container I try to run (192.168.1.135:4444 cannot be mapped to subdomain2.domain.com), and I receive a 502 bad gateway error with every app I have tried so far.

The configuration shouldn't be the issue, and it's definitely not the NoTLSVerify flag because the apps run on HTTP and I have configured it that way, so I am out of options to know what is going on and how to solve it.

Hamperfait
  • 465
  • 1
  • 6
  • 18

2 Answers2

0

Looks like the apps you're running on your NAS are proxied through the docker runtime. Consequently, the IP:port you need to add to the cloudflare tunnel config is the one that is reachable from the Host (not the IP of the host itself).

If the host is 192.168.1.135, you need to know which the the IP (internal to the docker network) of the app that you want to access from the outside, typically in the 172.0.0.1/24 range.

Example: If the containers running the apps you want to access are running on 172.0.0.2:4444 for app1 and 172.0.0.3:5555 for app2, the cloudflare config would look like this:

tunnel: the_ID_of_the_tunnel
credentials-file: /root/.cloudflared/the_ID_of_the_tunnel.json

ingress:
  - hostname: yourapp1.example.com
    service: http://172.0.0.2:4444
  - hostname: ypurapp2.example.com
    service: http://172.0.0.3:5555
  - service: http_status:404

See more details and a video here: How to redirect subdomain to port (docker)

lu4t
  • 304
  • 2
  • 5
  • I retrieved the IP address of the front and it's 172.29.20.2, the docker-compose has in the ports section 80:80, so I am redirecting cloudflare to http://172.29.20.2:80, but I am still getting the same error. I have tried with the rest of the containers that the docker creates, but none of them redirect me to the app when I access my public domain – Hamperfait Jan 27 '23 at 21:35
  • Turns out the problem might not be the IP itself, but the way I have to run both containers. Apparently they don't have visibility on each other and I haven't specified the network, so it won't work until I'm able to fix that issue first. – Hamperfait Jan 28 '23 at 06:50
  • if you're running a container version of cloudflared, you need to attach the container to either the host nw, or the nw that the apps are attached to. Otherwise it wont work. – lu4t Jan 28 '23 at 07:02
0

Turns out the problem is due to how docker works with networks, not with how Cloudflare accesses them. I first had to create a network that connected both containers, since adding cloudflare to my docker-compose file didn't work for some reason.

  1. Create a docker network docker network create tunnel
  2. Run docker without specifying the network docker run -d --name cloudflare cloudflare/cloudflared:latest tunnel --no-autoupdate run --token
  3. Add the docker to the network docker network connect tunnel cloudflare
  4. Run the container (note the container should have, as you specified, the network name identical to the one you created earlier, but cloudflare should not be in your docker-compose file) docker-compose up
  5. In the cloudflare tunnel config, you will have to specify the docker internal address of your container (as @lu4t suggested). You can identify the address with docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' container
Hamperfait
  • 465
  • 1
  • 6
  • 18