Cloudflare Developers•4w ago

522 timeout

Hey everyone! Earlier I installed a docker image and set it up to be behind a proxy with nginx. The problem now is that cloudflare keeps giving me a 522 error. I've restarted the origin (raspberry pi) and nginx. I don't think it's with nginx because I also deleted the modified configuration. I'm all out of ideas and I don't know what else to try. If someone has any ideas that would be great. https://ryglassman.com

114 Replies

Dog KnifeOP•4w ago

Everything was up and running until i restarted nginx and added the DNS entry filestash.ryglassman.com

Dog KnifeOP•4w ago

these logs are from earlier i dont know if they'll help

David Wang•4w ago

You have a reverse proxy set up with nginx? How is it configured? It's basically complaining that there's nowhere to forward traffic to

Dog KnifeOP•4w ago

which file do you want to look at. the main configuration or for a reverse proxy Also yes, the reverse proxy has been set up

user root;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

user root;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

thats nginx.conf this is one of my reverse proxy files

server {
    listen 80;
    listen [::]:80;

    server_name  ssh.ryglassman.com;

    location / {
        proxy_pass https://localhost:4243;
        include proxy_params;
    }
}

server {
    listen 80;
    listen [::]:80;

    server_name  ssh.ryglassman.com;

    location / {
        proxy_pass https://localhost:4243;
        include proxy_params;
    }
}

im not sure what went wrong because everything was working until i added the DNS entry and restarted nginx, after that it all stopped working. i reverted the changes and i still cant get it to work

David Wang•4w ago

Do you have a server entry for the domain you mentioned? This is for ssh. You need an entry specifically for filestash.ryglassman.com What's "it"?

Dog KnifeOP•4w ago

Anything I can't visit anything under my domain It all raises error 522

David Wang•4w ago

Do you have a server entry for your domain?

Dog KnifeOP•4w ago

Yes

David Wang•4w ago

Show

Dog KnifeOP•4w ago

David Wang•4w ago

In cloudflare, is ssl set to full or flexible?

Dog KnifeOP•4w ago

the only thing i changed with nginx was a file which has since been deleted where do i find that?

David Wang•4w ago

Go to the domain settings in the dashboard, open the domain, and on the left click on ssl

Dog KnifeOP•4w ago

i might have found it flexible i havent touched that at all

David Wang•4w ago

Hm Ok try running systemctl status nginx

Dog KnifeOP•4w ago

Last I ran that it didn't report anything but I'll see if it does this time

David Wang•4w ago

And you said you tried restarting the nginx service, right?

Dog KnifeOP•4w ago

correct

Dog KnifeOP•4w ago

David Wang•4w ago

And i assume you're on a home network. Have you confirmed that the public ip hasn't chnaged?

Dog KnifeOP•4w ago

yes i have

David Wang•4w ago

Can you run ls /home/control/sites/www and show me the output

Dog KnifeOP•4w ago

David Wang•4w ago

I'm wondering if the www-data user can cd to that directory since it's in your home directory You might want to check the perms of all teh folders in teh path as well as all the files in the www directory

Dog KnifeOP•4w ago

okay, i'll try that wait i changed it to root instead of www-data which let it in everything it needed when i had permission issues previously nginx would respond with 404 not found when i just type the local ip address of the raspberry pi it responds with 404 not found

David Wang•4w ago

Yea b/c the ip doesn't match anything So the files are owned by root?

Dog KnifeOP•4w ago

no they're owned by control

David Wang•4w ago

So what did you change to root?

Dog KnifeOP•4w ago

the first line of nginx.conf the only other thing i did was setup docker-compose and downloaded an image and ran it

David Wang•4w ago

That's dangerous If you get breached then the hacker has unrestricted access to your entire system The best way to take care of this is to make sure all the folders from home to www have perms 744 i believe Anyways i made my case. How did you run the docker image?

Dog KnifeOP•4w ago

docker-compose up -d Something like that Ok I'll look into resolving that

David Wang•4w ago

Ok can you post your compose file

Dog KnifeOP•4w ago

I would but I'm not home and I can't ssh into the server I used my home ip and it said connection timed out So I think it's more then cloud flare sorry for taking long anywasys here it is

version: '2'
services:
  app:
    platform: "linux/${ARCH:-amd64}"
    container_name: filestash
    image: machines/filestash
    restart: always
    environment:
    - APPLICATION_URL=
    - GDRIVE_CLIENT_ID=<gdrive_client>
    - GDRIVE_CLIENT_SECRET=<gdrive_secret>
    - DROPBOX_CLIENT_ID=<dropbox_key>
    - ONLYOFFICE_URL=http://onlyoffice
    ports:
    - "8334:8334"
    volumes:
    - filestash:/app/data/state/

  onlyoffice:
    container_name: filestash_oods
    image: onlyoffice/documentserver:7.1
    restart: always

volumes:
    filestash: {}

version: '2'
services:
  app:
    platform: "linux/${ARCH:-amd64}"
    container_name: filestash
    image: machines/filestash
    restart: always
    environment:
    - APPLICATION_URL=
    - GDRIVE_CLIENT_ID=<gdrive_client>
    - GDRIVE_CLIENT_SECRET=<gdrive_secret>
    - DROPBOX_CLIENT_ID=<dropbox_key>
    - ONLYOFFICE_URL=http://onlyoffice
    ports:
    - "8334:8334"
    volumes:
    - filestash:/app/data/state/

  onlyoffice:
    container_name: filestash_oods
    image: onlyoffice/documentserver:7.1
    restart: always

volumes:
    filestash: {}

David Wang•4w ago

Np. I wasn't sitting here waiting for you. was this docker container supposedt to be served on filestash.ryglassman.com? Also IP for sure wont' work b/c it follows the nginx default server config, not the config for any domain

Dog KnifeOP•4w ago

Yes Wdym? It worked earlier? I'm just confused that's all

David Wang•4w ago

I'm probably not seeing all the relevant configs. But for ip to work, iirc you need a server entry without server_name (on port 80) Did you set up a virtual server like this for filestash.ryglassman.com?

Dog KnifeOP•4w ago

Yes

David Wang•4w ago

And you changed the port to 8334? Not the listen port, but the proxy to http://localhost:8334 Also can you run ls /etc/nginx/conf.d/ and show me the output

Dog KnifeOP•4w ago

Yep No output The current problem is the entire domain is no longer working and I don't know what else to do. I reverted all the configuration and it still gives 522 error I also can't access ssh with my external ip I think I'm going to try a fresh reinstall of everything I also want to upgrade it so I'll do that as well. I did a fresh reinstall of the entire OS and it still returns error 522 only thing I have on it is nginx. Here's my config file agh

server {
    listen 80;
    listen [::]:80;

    server_name  agh.ryglassman.com;
        
    location / {
        proxy_pass http://10.0.0.246:80;
        include proxy_params;
    }
}

server {
    listen 80;
    listen [::]:80;

    server_name  agh.ryglassman.com;
        
    location / {
        proxy_pass http://10.0.0.246:80;
        include proxy_params;
    }
}

nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

https://agh.ryglassman.com

David Wang•4w ago

What's 10.0.0.246? Also does it work with proxy turned off?

Dog KnifeOP•4w ago

No I'm starting to think its cloud flare

David Wang•4w ago

Not if it doesn't work with proxy turned off You need to wait a couple hours after turning proxy on/off though to test And you haven't anwered my question about the ip address

Dog KnifeOP•4w ago

It's a different device that runs the adguard home console

David Wang•4w ago

On the same network i'm presuming Is this all at home?

Dog KnifeOP•4w ago

yes either its that or something changed with my network at the same time i updated dns

David Wang•4w ago

More likely Port forwarded? (80) Also in termainal, run curl ifconfig.me and compare that to the ip address in the A Record in Cloudflare DNS records for the domains

Dog KnifeOP•4w ago

that gave me an ipv6 address im only using ipv4

David Wang•4w ago

Ok then google "whats my ip address" Your isp doesn't give you an ipv4 at all?

Dog KnifeOP•4w ago

it does i have it 80 is still forwarded

David Wang•4w ago

Ok compare that with the cloudflare dns records for the domain

Dog KnifeOP•4w ago

didnt change

David Wang•4w ago

Make sure the server internal ip address also hasn't changed

Dog KnifeOP•4w ago

also didnt change

David Wang•4w ago

Compare the port forward settings with the results of ip addr show

Dog KnifeOP•4w ago

how so

David Wang•4w ago

The destination ip in the port forward settings

Dog KnifeOP•4w ago

hold up hetrixtools said a host is now up https://agh.ryglassman.com is now up https://ryglassman.com is redirecting

David Wang•4w ago

Nice

Dog KnifeOP•4w ago

oh it has nothing set oops

David Wang•4w ago

Yea

Dog KnifeOP•4w ago

i have no idea what happened...

David Wang•4w ago

Proxy being turned off kicked in

Dog KnifeOP•4w ago

oh so its a certificate issue

David Wang•4w ago

But how is it https 🤔 Yea b/c your host doesn't have a cert

Dog KnifeOP•4w ago

i thought cloudflare was giving me certs through google?

David Wang•4w ago

We established that ssl is set to flexible, right? Yes, but not when not proxied

Dog KnifeOP•4w ago

i changed it to full for testing purposes should i change it back to flexibl

David Wang•4w ago

Yea B/c your origin server doesn't have certs Unless you use certbot on it to install certs

Dog KnifeOP•4w ago

oh when i previously didnt use certbot i didnt need to tho? cloudflare provided https for me when it was proxied

David Wang•4w ago

Yes. That's normal When proxied, the A Record for yoru domain is set to CF's servers So when I request ryglassman.com, I look up ryglassman.com in DNS and I get CF's servers, then the computer makes the request to CF's servers, then the CF servers apply filtering rules and other rules then forwards my request to your server (called origin host) When unproxied, the CF servers are completely bypassed So CF's https is between me and CF's servers, and from CF server to your server is http when flexble. When on full, it's https on both segments, but that requires you to have a cert installed on your server for each domain and for port 443 to be forwarded

Dog KnifeOP•4w ago

ohh ok i turned proxy back on

David Wang•4w ago

Ok good Ssl is back to flexible?

Dog KnifeOP•4w ago

yea i dont know what happened honestly i only added a dns entry

David Wang•4w ago

Also try again in an hour or two, and check nginx error.log if it still throws 522

Dog KnifeOP•4w ago

alright i get notified when downtimes occur via hetrixtools thats how i was told agh.ryglassman.com was up

David Wang•4w ago

Ah nice. Ok I should look into that

Dog KnifeOP•4w ago

https://hetrixtools.com

Free Uptime Monitor & Blacklist Monitor- HetrixTools

The simple and effective solution for Uptime Monitoring and Blacklist Monitoring.

Dog KnifeOP•4w ago

its free i love it

David Wang•4w ago

Have you tried uptime kuma?

Dog KnifeOP•4w ago

no https://status.ryglassman.com

David Wang•4w ago

Tha's what i'm using currently

Dog KnifeOP•4w ago

idk if that wants to load but if it does you can see the monitors

David Wang•4w ago

Not loading :/

Dog KnifeOP•4w ago

one second i needed to turn off proxy status.ryglassman.com is the only one not working but thats just a CNAME record

Dog KnifeOP•4w ago

https://master.status.ryglassman.com works

Master Status - Powered by HetrixTools

Master Status - Uptime Status

David Wang•4w ago

Nice. I may have to play around with this

Dog KnifeOP•4w ago

everything is apparently up according to hetrixtools just going to reconfigure everything

David Wang•4w ago

Hm So even with proxy it's fine?? Seems like it Can hetrix be selfhosted?

Dog KnifeOP•4w ago

no i dont think that'd be possible because of how it works alright now everythings mostly up but im getting error 404. user is currently www-data and i gave the following permissions in the /home/control/sites directory

Dog KnifeOP•4w ago

i was told this will help with solving permission errors

Dog KnifeOP•4w ago

David Wang•4w ago

Yea fair. Uptimekima is selfhosted. Unfortunately I'd probably use it too much to qualify for the free tier You have to set 755 perms for every directory in the path, not just the sites directory

Dog KnifeOP•4w ago

nope free users get 15 monitors

David Wang•4w ago

Oh i'll pass 15 for sure Just the # of services i have in docker across 3 VPSs will surpass 15

Dog KnifeOP•4w ago

its not going too well

Dog KnifeOP•4w ago

i think i got it

Dog KnifeOP•4w ago

David Wang•4w ago

Ok run ls -l in home, control, and sites and make sure control, sites, and www all are 755

Dog KnifeOP•4w ago

oh wait they all have to be that? there we go everything is up thank you so much for your assistance. i genuinely have no idea what caused all this

David Wang•4w ago

Yea i wouldn't recurse it to everthing, just those specific folders Sure. It seems to have been a coincidence Have you added virtual servers for the other domains in sites-enabled yet? And also, if you want to try out the docker again, i'm here

Dog KnifeOP•4w ago

oh oops uhh lemme fix rq fixed that yep everythings running correctly

David Wang•4w ago

Good

Dog KnifeOP•4w ago

im updating the host before i install docker

David Wang•4w ago

👍

Dog KnifeOP•4w ago

i got filestash installed and docker installed. i'm trying to use nginx to allow me to use filestash.ryglassman.com

Dog KnifeOP•4w ago

David Wang•4w ago

This, but http://localhost, and change the port after that and also change the server_name According to this it's port 8334

Dog KnifeOP•4w ago

server {
    listen 80;
    listen [::]:80;

    server_name  filestash.ryglassman.com;

    location / {
        proxy_pass https://127.0.0.1:8334;
        include proxy_params;
    }
}

server {
    listen 80;
    listen [::]:80;

    server_name  filestash.ryglassman.com;

    location / {
        proxy_pass https://127.0.0.1:8334;
        include proxy_params;
    }
}

oops it needs to be http

Dog KnifeOP•4w ago

solidsnake•7d ago

Alguem ja pegou esse erro só acontece quando sai no colo do Rio de janeiro se tentar em outra maquina funciona normal, porem quando bate Rio de janeiro ele da o erro 522 Obs acessando por IP vai normal o acesso entao o problema não seria pelo Host

solidsnake•7d ago

Has anyone ever encountered this error, it only happens when you go to Rio de Janeiro, if you try on another machine it works normally, but when you hit Rio de Janeiro it gives error 522 Observe by IP whether access is normal or the problem would not be due to the Host

David Wang•7d ago

Don't hijack threads. Create your own

Gaming

Programming

522 timeout