immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 26 Packages Projects Releases 10 Wiki Activity

caddy docker compose reverse proxy problems #2173

New Issue
Closed
opened 2026-02-05 05:28:02 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 05:28:02 +03:00
Owner
Copy Link

Originally created by @ruvido on GitHub (Feb 17, 2024).

The bug

Dear all,
thanks a lot for keeping up this wonderful project. I have average experience with docker and caddy.

I am unable to have a full dockerized setup including caddy as a reverse proxy and immich.
I tested the example found in the documentation and it works only when caddy is launched from the cli (not from a container)

On my vps, caddy is already working, reverse proxying other services with success.

Tried several modifications to the official immich docker compose file without success.

Suggestion: A full example with reverse proxy docker compose in the documentation would be very useful

The OS that Immich Server is running on

Ubuntu 22.04

Version of Immich Server

v1.94.1

Version of Immich Mobile App

not tested

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

services:
  immich-server:
    hostname: immich
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: [ "start.sh", "immich" ]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - 2283:3001
    depends_on:
      - redis
      - database
    restart: always
    networks:
      - caddy_reverse_proxy
      - internal

immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/hardware-transcoding
    #   file: hwaccel.transcoding.yml 
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    command: [ "start.sh", "microservices" ]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    depends_on:
      - redis
      - database
    restart: always
    networks:
      - internal

immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    networks:
      - internal

    redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:afb290a0a0d0b2bd7537b62ebff1eb84d045c757c1c31ca2ca48c79536c0de82
    restart: always
    networks:
      - internal

  database:
    container_name: immich_postgres
    image: tensorchord/pgvecto-rs:pg14-v0.1.11@sha256:0335a1a22f8c5dd1b697f14f079934f5152eaaa216c09b61e293be285491f8ee
    env_file:
      - .env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always
    networks:
      - internal

volumes:
  pgdata:
  model-cache:

networks:
  caddy_reverse_proxy:
    external: true
  internal:

Your .env content

UPLOAD_LOCATION=/home/jdoe/photos
IMMICH_VERSION=release
DB_PASSWORD=xyz
DB_HOSTNAME=immich_postgres
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

REDIS_HOSTNAME=immich_redis

Reproduction steps

I usually run caddy on a container with a Caddyfile reverse proxying the container service hostname, eg:

Caddyfile:

whoami.{$MY_DOMAIN} {
    reverse_proxy whoami:80
}

whoami - docker-compose.yml:

services:

  whoami:
    image: "containous/whoami"
    container_name: "whoami"
    hostname: "whoami"

networks:
  default:
    name: caddy_reverse_proxy
    external: true

caddy - docker-compose.yml

services:

  caddy:
    image: caddy
    container_name: caddy
    hostname: caddy
    restart: unless-stopped
    env_file: .env
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy_config:/config
      - ./caddy_data:/data

networks:
  default:
    name: caddy_reverse_proxy
    external: true

but trying to have the default immich docker-compose.yml to work with this schema seems to be challenging

  1. simplying adding the networks section to the immich file breaks the app (missing internal network connections I guess)
  2. adding an internal network to every immich service plus the caddy_reverse_proxy to immich-server boots up the container but immich is unreachable from outside using something like:
photos.example.com {
       reverse_proxy immich:2283
}
  1. same thing if I use reverse_proxy localhost:2283, the only thing working for me is reverse_proxy http://<vps ip>:2283

Using for immich the docker-compose.yml file pasted above gives the following error in caddy:

caddy  | {"level":"error","ts":1708168618.960038,"logger":"http.log.error","msg":"dial tcp 172.28.0.5:2283: connect: connection refused","request":{"remote_ip":"151.46.179.173","remote_port":"1698","client_ip":"151.46.179.173","proto":"HTTP/2.0","method":"GET","host":"photos.5p2p.it","uri":"/","headers":{"User-Agent":["curl/8.6.0"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"photos.example.com"}},"duration":0.001077259,"status":502,"err_id":"nerucqg63","err_trace":"reverseproxy.statusError (reverseproxy.go:1267)"}

strange enough I dunno where these 172.28.0.5 and 151.46.179.173 come from...

Originally created by @ruvido on GitHub (Feb 17, 2024). ### The bug Dear all, thanks a lot for keeping up this wonderful project. I have average experience with docker and caddy. I am unable to have a full dockerized setup including caddy as a reverse proxy and immich. I tested the example found in the documentation and it works only when caddy is launched from the cli (not from a container) On my vps, caddy is already working, reverse proxying other services with success. Tried several modifications to the official immich docker compose file without success. Suggestion: A full example with reverse proxy docker compose in the documentation would be very useful ### The OS that Immich Server is running on Ubuntu 22.04 ### Version of Immich Server v1.94.1 ### Version of Immich Mobile App not tested ### Platform with the issue - [X] Server - [x] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML services: immich-server: hostname: immich container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} command: [ "start.sh", "immich" ] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro env_file: - .env ports: - 2283:3001 depends_on: - redis - database restart: always networks: - caddy_reverse_proxy - internal immich-microservices: container_name: immich_microservices image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/hardware-transcoding # file: hwaccel.transcoding.yml # service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding command: [ "start.sh", "microservices" ] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /etc/localtime:/etc/localtime:ro env_file: - .env depends_on: - redis - database restart: always networks: - internal immich-machine-learning: container_name: immich_machine_learning # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag. # Example tag: ${IMMICH_VERSION:-release}-cuda image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration # file: hwaccel.ml.yml # service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable volumes: - model-cache:/cache env_file: - .env restart: always networks: - internal redis: container_name: immich_redis image: redis:6.2-alpine@sha256:afb290a0a0d0b2bd7537b62ebff1eb84d045c757c1c31ca2ca48c79536c0de82 restart: always networks: - internal database: container_name: immich_postgres image: tensorchord/pgvecto-rs:pg14-v0.1.11@sha256:0335a1a22f8c5dd1b697f14f079934f5152eaaa216c09b61e293be285491f8ee env_file: - .env environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} volumes: - pgdata:/var/lib/postgresql/data restart: always networks: - internal volumes: pgdata: model-cache: networks: caddy_reverse_proxy: external: true internal: ``` ### Your .env content ```Shell UPLOAD_LOCATION=/home/jdoe/photos IMMICH_VERSION=release DB_PASSWORD=xyz DB_HOSTNAME=immich_postgres DB_USERNAME=postgres DB_DATABASE_NAME=immich REDIS_HOSTNAME=immich_redis ``` ### Reproduction steps I usually run caddy on a container with a Caddyfile reverse proxying the container service hostname, eg: Caddyfile: ``` whoami.{$MY_DOMAIN} { reverse_proxy whoami:80 } ``` whoami - docker-compose.yml: ``` services: whoami: image: "containous/whoami" container_name: "whoami" hostname: "whoami" networks: default: name: caddy_reverse_proxy external: true ``` caddy - docker-compose.yml ``` services: caddy: image: caddy container_name: caddy hostname: caddy restart: unless-stopped env_file: .env ports: - "80:80" - "443:443" - "443:443/udp" volumes: - ./Caddyfile:/etc/caddy/Caddyfile - ./caddy_config:/config - ./caddy_data:/data networks: default: name: caddy_reverse_proxy external: true ``` but trying to have the default immich docker-compose.yml to work with this schema seems to be challenging 1) simplying adding the `networks` section to the immich file breaks the app (missing internal network connections I guess) 2) adding an `internal` network to every immich service plus the `caddy_reverse_proxy` to `immich-server` boots up the container but immich is unreachable from outside using something like: ``` photos.example.com { reverse_proxy immich:2283 } ``` 3) same thing if I use `reverse_proxy localhost:2283`, the only thing working for me is `reverse_proxy http://<vps ip>:2283` Using for immich the `docker-compose.yml` file pasted above gives the following error in caddy: ``` caddy | {"level":"error","ts":1708168618.960038,"logger":"http.log.error","msg":"dial tcp 172.28.0.5:2283: connect: connection refused","request":{"remote_ip":"151.46.179.173","remote_port":"1698","client_ip":"151.46.179.173","proto":"HTTP/2.0","method":"GET","host":"photos.5p2p.it","uri":"/","headers":{"User-Agent":["curl/8.6.0"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"photos.example.com"}},"duration":0.001077259,"status":502,"err_id":"nerucqg63","err_trace":"reverseproxy.statusError (reverseproxy.go:1267)"} ``` strange enough I dunno where these `172.28.0.5` and `151.46.179.173` come from...
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#2173
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?