502 Bad Gateway for Documenso behind Cloudflare Tunnel + Traefik

[InvixGG]

To Reproduce

Description
I’m trying to expose my Dokploy-deployed Documenso app at sign.vexelstudios.com via a Cloudflare Tunnel → Traefik (host‐mode) setup over the past 4 hours, but I keep getting a 502 Bad Gateway. Local testing shows the app is healthy. Traefik’s dashboard is up, and the router for sign.vexelstudios.com exists, but every request fails at the origin.

Troubleshooting So Far

• Verified Postgres and Documenso containers are healthy and listening on expected ports.
• Cloudflared logs (HTTP→80) show 502. Tried HTTPS→443 + --no-tls-verify → tunnel fails cert check.

Current vs. Expected behavior

Traefik should route sign.vexelstudios.com → The Documenso container over HTTP (or HTTPS end‐to‐end), and I should see the app rather than a 502.

Provide environment information

Environment
• Raspberry Pi 5, Raspberry Pi OS Lite (64-bit)
• Dokploy v0.24.0
• Traefik v3.1.2
• Cloudflared image: cloudflare/cloudflared:latest
• Documenso image: dokumenso/documenso:latest
• Postgres image: postgres:16

Which area(s) are affected? (Select all that apply)

Docker, Traefik, Docker Compose, Application, Installation

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

Documenso:

services:
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:?err}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?err}
      - POSTGRES_DB=${POSTGRES_DB:?err}
    expose:
      - "5432"
    ports:
      - "5434:5432"
    networks:
      - dokploy-network
    volumes:
      - documenso-data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}']
      interval: 10s
      timeout: 5s
      retries: 5

  documenso:
    image: documenso/documenso:latest
    restart: unless-stopped
    user: "root"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - PORT=${PORT:-3000}
      - (And all other env's)
    expose:
      - "${PORT}"
    networks:
      - dokploy-network
    volumes:
      - /home/Levi/documenso/certificate.p12:/opt/documenso/cert.p12

volumes:
  documenso-data:

networks:
  dokploy-network:
    external: true

Cloudflared:

services:
  cloudflared:
    image: 'cloudflare/cloudflared:latest'
    network_mode: host
    restart: unless-stopped
    environment:
      - 'TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}'
    command: [
      "tunnel",
      "--no-autoupdate",
      "run"
    ]

Cloudflare Tunnel:

Domain in Dokploy:

Traefik File System has been left to default

Cloudflare DNS:
CNAME sign (id).cfargotunnel.com Proxied: True TTL: Auto

https://sign.vexelstudios.com/
You can go to the site yourself to see the Bad gateway

Also, I have managed to make this work with Nginx Proxy Manager. That was just straightforward add a Reverse Proxy pointing to local ip + port and the sign.vexelstudios.com host.

Will you send a PR to fix it?

No

[Siumauricio]

I am going to transfer this to discussions, I have no experience with cloudflare tunnels, so I am sorry for not guiding you in this case.

[InvixGG]

Alright no worries, thanks for the info!

[djsisson]

@InvixGG in your original post you said traefik was in host mode, if you mean you set network_mode: host, then it is not in any docker network and so has no access to any containers using traditional docker dns, you would need to use server.url in labels with container ip address

if you're running a tunnel my suggestion is this

1. run cloudflared and traefik both in the ingress network, do not run host mode in either, (its ok to add extra_hosts: ["host.docker.internal:host-gateway"] in cloudflared if you really do need ssh to host.

2. remove port bindings in traefik, once they are both inside same docker network, you no longer need external port bindings or at least only bind to local network ip, ideally you end up with no external ports open.

3. in cf tunnel config, do not use localhost, but use the service name for traefik (usually traefik) since they are in same docker network, this name resolution works fine. e.g HTTP traefik 80

4. if you need https to traefik then make sure tunnel config is set to port 443 not 80 and add the origin domain in your tls tunnel config, as well as make sure you have either valid cf origin certificate added to traefik or you're using dns challenge (the latter is preferable, since the origin cert is only valid coming via the tunnel, it will not work if you're using private networking using cf warp, so things like internal docker registries need a let's encrypt cert)

hope that helps

ps i also notice in one image you had port 3001 for container but in other you had default of 3000 (it might be nothing)

[InvixGG]

Thanks for all the suggestions!

I've applied some into a new setup. But it still didn't work, not sure if I missed something so I'll also add some of the environment variables.

Also there's an issue where when going to http://192.168.2.15:3001 we can't reach the site directly. Not sure if this is a Dokploy/Traefik thing or there's already an issue there.

Neither domains seem to work either. Both get either a 404 or 502:

Documenso:

services:
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:?err}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?err}
      - POSTGRES_DB=${POSTGRES_DB:?err}
    expose:
      - "5432"
    ports:
      - "5434:5432"
    networks:
      - dokploy-network
    volumes:
      - documenso-data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER}']
      interval: 10s
      timeout: 5s
      retries: 5

  documenso:
    image: documenso/documenso:latest
    restart: unless-stopped
    user: "root"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      - PORT=${PORT:-3000}
      - NEXTAUTH_URL=${NEXTAUTH_URL:-${NEXT_PUBLIC_WEBAPP_URL}}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET:?err}
      - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY:?err}
      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY:?err}
      - NEXT_PUBLIC_WEBAPP_URL=${NEXT_PUBLIC_WEBAPP_URL:?err}
      - NEXT_PRIVATE_INTERNAL_WEBAPP_URL=${NEXT_PRIVATE_INTERNAL_WEBAPP_URL:-http://localhost:$PORT}
      - NEXT_PUBLIC_MARKETING_URL=${NEXT_PUBLIC_MARKETING_URL:-https://documenso.com}
      - NEXT_PRIVATE_DATABASE_URL=${NEXT_PRIVATE_DATABASE_URL:?err}
      - NEXT_PRIVATE_DIRECT_DATABASE_URL=${NEXT_PRIVATE_DIRECT_DATABASE_URL:-${NEXT_PRIVATE_DATABASE_URL}}
      - NEXT_PUBLIC_UPLOAD_TRANSPORT=${NEXT_PUBLIC_UPLOAD_TRANSPORT:-database}
      - NEXT_PRIVATE_SMTP_TRANSPORT=${NEXT_PRIVATE_SMTP_TRANSPORT:?err}
      - NEXT_PRIVATE_SMTP_HOST=${NEXT_PRIVATE_SMTP_HOST}
      - NEXT_PRIVATE_SMTP_PORT=${NEXT_PRIVATE_SMTP_PORT}
      - NEXT_PRIVATE_SMTP_USERNAME=${NEXT_PRIVATE_SMTP_USERNAME}
      - NEXT_PRIVATE_SMTP_PASSWORD=${NEXT_PRIVATE_SMTP_PASSWORD}
      - NEXT_PRIVATE_SMTP_SECURE=${NEXT_PRIVATE_SMTP_SECURE}
      - NEXT_PRIVATE_SMTP_FROM_NAME=${NEXT_PRIVATE_SMTP_FROM_NAME:?err}
      - NEXT_PRIVATE_SMTP_FROM_ADDRESS=${NEXT_PRIVATE_SMTP_FROM_ADDRESS:?err}
      - NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=${NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT}
      - NEXT_PUBLIC_DISABLE_SIGNUP=${NEXT_PUBLIC_DISABLE_SIGNUP}
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=${NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH:-/opt/documenso/cert.p12}
      - NEXT_PRIVATE_SIGNING_PASSPHRASE=${NEXT_PRIVATE_SIGNING_PASSPHRASE}
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS=${NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS}
    expose:
      - "${PORT}"
    networks:
      - dokploy-network
    volumes:
      - /home/Levi/documenso/certificate.p12:/opt/documenso/cert.p12

volumes:
  documenso-data:

networks:
  dokploy-network:
    external: true

Env Documenso:

NEXTAUTH_SECRET=
NEXT_PRIVATE_ENCRYPTION_KEY=
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=
NEXT_PUBLIC_WEBAPP_URL=https://sign.vexelstudios.com
NEXT_PRIVATE_INTERNAL_WEBAPP_URL=http://192.168.2.15:3001

# SMTP Configuration
NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth"
NEXT_PRIVATE_SMTP_HOST="mail.vexelstudios.com"
NEXT_PRIVATE_SMTP_PORT=465
NEXT_PRIVATE_SMTP_USERNAME="[email protected]"
NEXT_PRIVATE_SMTP_PASSWORD=
NEXT_PRIVATE_SMTP_FROM_NAME="Vexel Studios"
NEXT_PRIVATE_SMTP_FROM_ADDRESS="[email protected]"
NEXT_PRIVATE_SMTP_SECURE="true"
NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS="false"

NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=50

PORT=3001

POSTGRES_USER=postgres
POSTGRES_PASSWORD=
POSTGRES_DB=postgres

NEXT_PRIVATE_DATABASE_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
NEXT_PRIVATE_JOBS_PROVIDER="local"
NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH="/opt/documenso/cert.p12"
NEXT_PRIVATE_SIGNING_PASSPHRASE=

Cloudflared:

services:
  cloudflared:
    image: 'cloudflare/cloudflared:latest'
    restart: unless-stopped
    environment:
      - 'TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}'
    networks:
      - dokploy-network
    command: [
      "tunnel",
      "--no-autoupdate",
      "run"
    ]

networks:
  dokploy-network:
    external: true

I've changed up the url as you said in Cloudflared:

Logs don't seem to say anything either in any of the containers.

Not sure if I'm missing anything to setup in Traefik itself. Never really worked with Traefik, mostly with Nginx.

[djsisson]

your NEXT_PRIVATE_INTERNAL_WEBAPP_URL should be left as localhost as its internal to the container

you're trying to visit i assume your own private ip : 3001 but you aren't port binding to your host

the traefik.me domain probably doesnt work due to using incorrect private url env

so, make sure container is working first, you can check using curl.

after that if its not working through the tunnel

can you rundocker ps to get the container id of documenso then run

docker container inspect -f '{{json .Config.Labels }}' CONTAINER_ID | jq

[InvixGG]

I see, I've set the NEXT_PRIVATE_INTERNAL_WEBAPP_URL=http://localhost:3001.

The current setup looks like this: I run Dokploy, Traefik, Cloudflared, and Documenso on my Raspberry Pi 5 with the local IP 192.168.2.15. Then I ssh into it, to manage everything and set it all up from my PC. And then just go to http://192.168.2.15:3000 to access Dokploy and setup all the Documenso stuff we're currently doing.

After running the command I get this:

Levi@raspberrypi:~ $ sudo docker container inspect -f '{{json .Config.Labels }}' 31cb4204d9e8 | jq
{
  "com.docker.compose.config-hash": "80097de73b73c012e5f710019a3e0fb2bb44a4d8e9717541aa1d0a74029520e7",
  "com.docker.compose.container-number": "1",
  "com.docker.compose.depends_on": "postgres:service_healthy:false",
  "com.docker.compose.image": "sha256:dd839d784875386c6f26552169906c45f8c2987fa0414722f32f04d026c64618",
  "com.docker.compose.oneoff": "False",
  "com.docker.compose.project": "documenso-documenso-s493mx",
  "com.docker.compose.project.config_files": "/etc/dokploy/compose/documenso-documenso-s493mx/code/docker-compose.yml",
  "com.docker.compose.project.working_dir": "/etc/dokploy/compose/documenso-documenso-s493mx/code",
  "com.docker.compose.replace": "c2baa9e63ca8cffd01fdec2b4ce98bedaffaab47afe8684cb2ac707c2177c50f",
  "com.docker.compose.service": "documenso",
  "com.docker.compose.version": "2.38.2",
  "traefik.enable": "true",
  "traefik.http.routers.documenso-documenso-s493mx-1-web.entrypoints": "web",
  "traefik.http.routers.documenso-documenso-s493mx-1-web.rule": "Host(`documenso-documenso-cd3fb6-192-168-2-15.traefik.me`)",
  "traefik.http.routers.documenso-documenso-s493mx-1-web.service": "documenso-documenso-s493mx-1-web",
  "traefik.http.routers.documenso-documenso-s493mx-2-web.entrypoints": "web",
  "traefik.http.routers.documenso-documenso-s493mx-2-web.rule": "Host(`sign.vexelstudios.com`)",
  "traefik.http.routers.documenso-documenso-s493mx-2-web.service": "documenso-documenso-s493mx-2-web",
  "traefik.http.services.documenso-documenso-s493mx-1-web.loadbalancer.server.port": "3001",
  "traefik.http.services.documenso-documenso-s493mx-2-web.loadbalancer.server.port": "3001"
}

When checking the network we weirdly get this, on 3000. So not sure what happened there?

Levi@raspberrypi:~ $ CID=$(sudo docker ps -qf name=documenso-documenso-s493mx-documenso-1)
Levi@raspberrypi:~ $ sudo docker exec -it "$CID" sh
/app/apps/remix # netstat -ltnp 2>/dev/null | grep LISTEN
tcp        0      0 127.0.0.11:40697        0.0.0.0:*               LISTEN      -
tcp        0      0 :::3000                 :::*                    LISTEN      78/node

[djsisson]

OK so if it's running on 3000 then that is causing your issues

So just change to port 3000

Then On your host can you run

curl -v -H "host: sign.vexelstudios.com" http://localhost

[InvixGG]

No issue with running on 3000 is that Dokploy already runs on 3000.

[djsisson]

Each container is seperate the apps inside can run on any port

[InvixGG]

Damn it finally worked!

I made the domains 3000, the PORT=3000, and NEXT_PRIVATE_INTERNAL_WEBAPP_URL=http://localhost:3000.

The Traefik domain still doesn't work. But the https://sign.vexelstudios.com/ finally works!

I've been on this for so long! Thank you so much! I really appreciate all the help.