[BUG] connection refused errors in proxy log

[dsm1212]

The bug

Honestly I'm not sure there is anything wrong as things seem to be working, but I worry there is something wrong with my swag setup in front of the proxy.

In my proxy log I see a bunch of connection refused messages. The client is always the gateway IP and the destination is always a /api endpoint. Here are a few:

2023/11/10 15:18:47 [error] 41#41: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 172.20.0.1, server: , request: "GET /api/socket.io/?EIO=4&transport=polling&t=Okvq74V HTTP/1.1", upstream: "http://172.20.0.8:3001/socket.io/?EIO=4&transport=polling&t=Okvq74V", host: "", referrer: "https:///photos"
2023/11/10 15:18:51 [error] 44#44: *3 connect() failed (111: Connection refused) while connecting to upstream, client: 172.20.0.1, server: , request: "GET /api/server-info HTTP/1.1", upstream: "http://172.20.0.8:3001/server-info", host: "", referrer: "https:///photos"
2023/11/10 15:18:52 [error] 45#45: *5 connect() failed (111: Connection refused) while connecting to upstream, client: 172.20.0.1, server: , request: "GET /api/socket.io/?EIO=4&transport=polling&t=Okvq8Io HTTP/1.1", upstream: "http://172.20.0.8:3001/socket.io/?EIO=4&transport=polling&t=Okvq8Io", host: "", referrer: "https:///photos"
2023/11/10 15:18:52 [error] 42#42: *13 connect() failed (111: Connection refused) while connecting to upstream, client: 172.20.0.1, server: , request: "GET /api/server-info/features HTTP/1.1", upstream: "http://172.20.0.8:3001/server-info/features", host: "", referrer: "https:///auth/login"

Here is my swag config. All of the other settings you mention for "set" were already in my proxy.conf. Do I need to do something special for the /api location?

server {
listen 443 ssl;
listen [::]:443 ssl;

server_name immich.*;

include /config/nginx/ssl.conf;
client_max_body_size 50000M;

location / {

    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_app immich;
    set $upstream_port 2283;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}

}

~

The OS that Immich Server is running on

docker on 6.1.0-0.deb11.11-amd64

Version of Immich Server

v1.85.0

Version of Immich Mobile App

not in use for this issue

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

version: "3.8"

services:
  immich-server:
    container_name: immich_server
    hostname: immich-server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    network_mode: immich
    command: ["start.sh", "immich"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro 
      - /media/pictures/McAfee-Belles:/media/pictures/McAfee-Belles:ro
      - /media/pictures/uploads:/media/pictures/uploads
      - /media/pictures/Grace/Pictures:/media/pictures/Grace:ro
      - /apps/immich:/apps/immich
    user: "1030:1001"
    env_file:
      - immich.env
    depends_on:
      - redis
      - database
      - typesense
    restart: always

  immich-microservices:
    container_name: immich_microservices
    hostname: immich-microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    network_mode: immich
    # extends:
    #   file: hwaccel.yml
    #   service: hwaccel
    command: ["start.sh", "microservices"]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - /media/pictures/McAfee-Belles:/media/pictures/McAfee-Belles:ro
      - /media/pictures/uploads:/media/pictures/uploads
      - /media/pictures/Grace/Pictures:/media/pictures/Grace:ro
      - /apps/immich:/apps/immich
    env_file:
      - immich.env
    depends_on:
      - redis
      - database
      - typesense
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    hostname: immich-machine-learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    network_mode: immich
    volumes:
      - model-cache:/cache
    env_file:
      - immich.env
    restart: always

  immich-web:
    container_name: immich_web
    hostname: immich-web
    image: ghcr.io/immich-app/immich-web:${IMMICH_VERSION:-release}
    network_mode: immich
    user: "1030:1001"
    env_file:
      - immich.env
    restart: always

  typesense:
    container_name: immich_typesense
    hostname: typesense
    image: typesense/typesense:0.24.1@sha256:9bcff2b829f12074426ca044b56160ca9d777a0c488303469143dd9f8259d4dd
    network_mode: immich
    environment:
      - TYPESENSE_API_KEY=${TYPESENSE_API_KEY}
      - TYPESENSE_DATA_DIR=/data
      # remove this to get debug messages
      - GLOG_minloglevel=1
    volumes:
      - tsdata:/data
    restart: always

  redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    network_mode: immich
    restart: always

  database:
    container_name: immich_postgres
    image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441
    network_mode: immich
    env_file:
      - immich.env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

  immich-proxy:
    container_name: immich_proxy
    image: ghcr.io/immich-app/immich-proxy:${IMMICH_VERSION:-release}
    network_mode: immich
    ports:
      - 2283:8080
    depends_on:
      - immich-server
      - immich-web
    restart: always

volumes:
  pgdata:
  model-cache:
  tsdata:

Your .env content

# You can find documentation for all the supported env variables at https://immich.app/docs/install/environment-variables

# The location where your uploaded files are stored
UPLOAD_LOCATION=/unsafe/immich

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

IMMICH_CONFIG_FILE=/apps/immich/immich.config

# Connection secrets for postgres and typesense. You should change these to random passwords
TYPESENSE_API_KEY=<redacted>
DB_PASSWORD=<redacted>

TZ=America/New_York

# The values below this line do not need to be changed
###################################################################################
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich_redis

Reproduction steps

start up serfices and login from web

Additional information

No response

[alextran1502]

You don't have to do anything with the /api since it is handled by Immich proxy service.

You simply need to proxy back to your local immich instance at http://ip:2283

[dsm1212]

So, I figured out what was going on here. The problem is the proxy server gets a container ip in a bridge mode and swag was redirecting to the host ip:port for some calls (not sure why). You would think this would be fine, but I believe it causes a csrf issue for the api calls. So I put swag in the same network with immich and then in the swag config for upstream_app I use immich_proxy. That's a hostname that gets defined in the docker dns automatically for the proxy container. This redirects the requests always to the proxy container ip. Errors went away.