Shlink Reverse Proxy

[id77777777]

Shlink version

3.10.2

PHP version

Included

How do you serve Shlink

Self-hosted nginx

Database engine

MariaDB

Database version

10.8

Summary

Hi All,

I'm finding it difficult to setup the SSL reverse proxy for Shlink. I am using all three containers on Portainer. MariaDB, Shlink-GUI & Shlink-Backend. I do not have much reverse proxy or NGINX experience so please be patient with me. Without SSL this all worked fine.

Docker Compose:

version: "3"

services:
  shlink:
    image: shlinkio/shlink:stable
    restart: always
    container_name: shlink-backend
    environment:
      - TZ="Europe/Belfast"
      - DEFAULT_DOMAIN=<HIDDEN FOR PRIVACY>
      - IS_HTTPS_ENABLED=true
      - GEOLITE_LICENSE_KEY=<HIDDEN FOR PRIVACY>
      - DB_DRIVER=maria
      - DB_USER=shlink
      - DB_NAME=shlink
      - DB_PASSWORD=<HIDDEN FOR PRIVACY>
      - DB_HOST=database
    depends_on:
      - database
    ports:
      - 8092:8080

  database:
    image: mariadb:latest
    restart: always
    container_name: shlink-database
    environment:
      - MARIADB_ROOT_PASSWORD=<HIDDEN FOR PRIVACY>
      - MARIADB_DATABASE=shlink
      - MARIADB_USER=shlink
      - MARIADB_PASSWORD=<HIDDEN FOR PRIVACY>
    volumes:
      - /home/docker/shlink:/var/lib/mysql

  shlink-web-client:
    image: shlinkio/shlink-web-client
    restart: always
    container_name: shlink-gui
    volumes:
      - /home/docker/shlink/servers.json:/usr/share/nginx/html/servers.json
    depends_on:
      - shlink
    ports:
      - 8334:80

Ports:
Shlink-GUI 8334:80
Shlink-Database -
Shlink-Backend 8092:8080

Reverse Proxy:
Here is my NGINX reverse proxy that I have setup on the Shlink-GUI container.
/etc/nginx/conf.d/ssl.conf

server {
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/<HIDDEN FOR PRIVACY>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<HIDDEN FOR PRIVACY>/privkey.pem;

    server_name <HIDDEN FOR PRIVACY>;
    charset utf-8;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://localhost:8080;
        proxy_read_timeout 90s;
    }
}

This was taken directly from the Shlink documentation and adjusted.
Fullchain & Privkey were self generated using Certbot.
Before implementing the SSL.conf, all was working except SSL & Shlink couldn't create short links.

Shlink-GUI logs:

/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf is not a file or does not exist
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-shlink-servers-json.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2023/09/12 09:41:42 [notice] 1#1: using the "epoll" event method
2023/09/12 09:41:42 [notice] 1#1: nginx/1.23.4
2023/09/12 09:41:42 [notice] 1#1: built by gcc 12.2.1 20220924 (Alpine 12.2.1_git20220924-r4)
2023/09/12 09:41:42 [notice] 1#1: OS: Linux 5.4.0-162-generic
2023/09/12 09:41:42 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2023/09/12 09:41:42 [notice] 1#1: start worker processes
2023/09/12 09:41:42 [notice] 1#1: start worker process 22
2023/09/12 09:41:42 [notice] 1#1: start worker process 23

I'm having a real headache with this one so thanks for any help!

[id77777777]

I've developed a little further with this. I added port 443 exposure to the Shlink-GUI, I now have a 502 error. Running CURL -vvv DOMAIN_HERE I get the following output.

root@localhost:~# curl -vvv https://<hiddenforpivacy>
*   Trying xx.xx.xx.111:443...
* TCP_NODELAY set
* Connected to <hiddenforpivacy> (xx.xx.xx.111) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=<hiddenforpivacy>
*  start date: Sep 12 07:15:30 2023 GMT
*  expire date: Dec 11 07:15:29 2023 GMT
*  subjectAltName: host "<hiddenforpivacy>" matched cert's "<hiddenforpivacy>"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: <hiddenforpivacy>
> User-Agent: curl/7.68.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 502 Bad Gateway
< Server: nginx/1.23.4
< Date: Tue, 12 Sep 2023 10:57:25 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 157
< Connection: keep-alive
<
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.23.4</center>
</body>
</html>
* Connection #0 to host <hiddenforpivacy> left intact

Docker Logs:

2023/09/12 10:57:04 [notice] 1#1: signal 17 (SIGCHLD) received from 31
2023/09/12 10:57:04 [notice] 1#1: worker process 31 exited with code 0
2023/09/12 10:57:04 [notice] 1#1: signal 29 (SIGIO) received
2023/09/12 10:57:04 [notice] 1#1: signal 17 (SIGCHLD) received from 30
2023/09/12 10:57:04 [notice] 1#1: worker process 30 exited with code 0
2023/09/12 10:57:04 [notice] 1#1: signal 29 (SIGIO) received
XXX.XXX.XX.116 - - [12/Sep/2023:10:57:11 +0000] "GET / HTTP/1.1" 502 559 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.76" "-"
2023/09/12 10:57:11 [error] 201#201: *1 connect() failed (111: Connection refused) while connecting to upstream, client: XXX.XXX.XX.116, server: signs-express.online, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8080/", host: "<hiddenforprivacy>"
2023/09/12 10:57:25 [error] 201#201: *4 connect() failed (111: Connection refused) while connecting to upstream, client: XX.XX.XX.111, server: signs-express.online, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8080/", host: "<hiddenforprivacy>"

[id77777777]

Nginx Error Logs:
[error] 262#262: *79 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 193.237.91.116, server: <hiddenforprivacy>, request: "GET / HTTP/1.1", upstream: "http://XX.XX.XX.111:8334/", host: "<hiddenforprivacy>"

[acelaya]

Hey @id77777777, I've seen the latest discussions you opened, and so far I don't see any Shlink-specific questions.

Mostly all the issues are due to lack of knowledge in other areas: docker, basic networking, reverse proxies, nginx, etc.

I would strongly suggest you start by getting that sorted out first. Dropping multiple text snippets here and there won't be helpful for you or others looking for more concrete issues.

If you find Shlink too difficult, that's fine. It's not a solution for everyone, as It's focused on advanced usage.

Feel free to try other alternatives, like YOURLS. If in the future, when things are more clear, you feel like giving Shlink another go, you can always import your short urls from external services.

[id77777777]

Thanks, it's not that I want to go through this whole rigmarole of setting up Shlink (yes I know it's my own fault)
We just want to use the end product in a production environment. Do you offer paid setup service?

[acelaya]

Do you offer paid setup service?

No, I'm afraid I don't