immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Incorrect dns resolving of server URL in Android mobile app #5194

New Issue
Closed
opened 2026-02-05 11:14:10 +03:00 by OVERLORD · 3 comments
OVERLORD commented 2026-02-05 11:14:10 +03:00
Owner
Copy Link

Originally created by @LinFor on GitHub (Jan 23, 2025).

The bug

I found that the presence of CNAME entries in the hostname resolution chain breaks the connection to the server from the mobile app.
I use dynamic IP addresses, so I use CNAME entries to simplify the IP change. In particular, there was the following setup for Immich:

photos.******.***.     86400   IN      CNAME   _ingress.sakharova.******.***.
_ingress.sakharova.******.***. 86400 IN   A       172.28.155.10

It works great in browsers, ACME, and so on... But not in the Immich mobile app.
In Immich, I received a refusal to accept the entered server URL and a confusing error in the log:
ApiException 400: Socket operation failed: GET /server/ping (Inner exception: ClientException with SocketException: Failed host lookup: 'photos.******.***' (OS Error: No address associated with hostname, errno = 7), uri=https://photos.******.***/api/server/ping)
At the same time, everything worked fine in the browsers (Chrome and Android webview) from the same device.

In an unobvious way, but I managed to get the mobile app to connect when I replaced the CNAME record with a direct A record, that is:

photos.******.***.     86400   IN   A       172.28.155.10

And the mobile app magically started working. A check return to the CNAME confirmed that this is the problem.

Although I can use direct A-records on the internal network, I cannot use the same workaround on the external network, as my public IP is constantly changing and managing several dozen direct records will be a real challenge.

The OS that Immich Server is running on

Docker on Ubuntu 24.04.1 LTS

Version of Immich Server

v1.124.2

Version of Immich Mobile App

1.124.2 Google Play (on Huawei P60 Pro v14.2.0.160)

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

I guess it doesn't matter. In short, I deployed Immich in Docker and published it via Traefik, with authentication configured via Authelia and TLS certificates from Let's Encrypt.

Your .env content

I guess it doesn't matter.

Reproduction steps

  1. Make any DNS record with the CNAME type pointing to the A record from the Immich server IP.
  2. Reset the DNS cache on the device in any way, for example by turning off and on Wi-Fi.
  3. Specify this entry as the hostname for the Immich mobile app.
  4. The mobile application indicates that the server is unavailable, with an error in the log "OS Error: No address associated with hostname, errno = 7", the full error from Stacktrace is below.

Also, you can check my public deployment on https://photos.******.*** that currently not working with mobile app, but working great in web browser (Authentication will stop you, but the mobile app doesn't even reach it).

Relevant log output

ApiException 400: Socket operation failed: GET /server/ping (Inner exception: ClientException with SocketException: Failed host lookup: 'photos.******.***' (OS Error: No address associated with hostname, errno = 7), uri=https://photos.******.***/api/server/ping)

#0      IOClient.send (package:http/src/io_client.dart:154)
<asynchronous suspension>
#1      BaseClient._sendUnstreamed (package:http/src/base_client.dart:93)
<asynchronous suspension>
#2      ApiClient.invokeAPI (package:openapi/api_client.dart:101)
<asynchronous suspension>
#3      ServerApi.pingServer (package:openapi/api/server_api.dart:492)
<asynchronous suspension>
#4      Future.timeout.<anonymous closure> (dart:async/future_impl.dart:963)
<asynchronous suspension>
#5      ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:107)
<asynchronous suspension>
#6      ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:88)
<asynchronous suspension>
#7      ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:70)
<asynchronous suspension>
#8      AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:51)
<asynchronous suspension>
#9      LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100)
<asynchronous suspension>

Additional information

No response

Originally created by @LinFor on GitHub (Jan 23, 2025). ### The bug I found that the presence of CNAME entries in the hostname resolution chain breaks the connection to the server from the mobile app. I use dynamic IP addresses, so I use CNAME entries to simplify the IP change. In particular, there was the following setup for Immich: ``` photos.******.***. 86400 IN CNAME _ingress.sakharova.******.***. _ingress.sakharova.******.***. 86400 IN A 172.28.155.10 ``` It works great in browsers, ACME, and so on... But not in the Immich mobile app. In Immich, I received a refusal to accept the entered server URL and a confusing error in the log: `ApiException 400: Socket operation failed: GET /server/ping (Inner exception: ClientException with SocketException: Failed host lookup: 'photos.******.***' (OS Error: No address associated with hostname, errno = 7), uri=https://photos.******.***/api/server/ping)` At the same time, everything worked fine in the browsers (Chrome and Android webview) from the same device. In an unobvious way, but I managed to get the mobile app to connect when I replaced the CNAME record with a direct A record, that is: ``` photos.******.***. 86400 IN A 172.28.155.10 ``` And the mobile app magically started working. A check return to the CNAME confirmed that this is the problem. Although I can use direct A-records on the internal network, I cannot use the same workaround on the external network, as my public IP is constantly changing and managing several dozen direct records will be a real challenge. ### The OS that Immich Server is running on Docker on Ubuntu 24.04.1 LTS ### Version of Immich Server v1.124.2 ### Version of Immich Mobile App 1.124.2 Google Play (on Huawei P60 Pro v14.2.0.160) ### Platform with the issue - [ ] Server - [ ] Web - [x] Mobile ### Your docker-compose.yml content ```YAML I guess it doesn't matter. In short, I deployed Immich in Docker and published it via Traefik, with authentication configured via Authelia and TLS certificates from Let's Encrypt. ``` ### Your .env content ```Shell I guess it doesn't matter. ``` ### Reproduction steps 1. Make any DNS record with the CNAME type pointing to the A record from the Immich server IP. 2. Reset the DNS cache on the device in any way, for example by turning off and on Wi-Fi. 3. Specify this entry as the hostname for the Immich mobile app. 4. The mobile application indicates that the server is unavailable, with an error in the log "OS Error: No address associated with hostname, errno = 7", the full error from Stacktrace is below. Also, you can check my public deployment on `https://photos.******.***` that currently not working with mobile app, but working great in web browser (Authentication will stop you, but the mobile app doesn't even reach it). ### Relevant log output ```shell ApiException 400: Socket operation failed: GET /server/ping (Inner exception: ClientException with SocketException: Failed host lookup: 'photos.******.***' (OS Error: No address associated with hostname, errno = 7), uri=https://photos.******.***/api/server/ping) #0 IOClient.send (package:http/src/io_client.dart:154) <asynchronous suspension> #1 BaseClient._sendUnstreamed (package:http/src/base_client.dart:93) <asynchronous suspension> #2 ApiClient.invokeAPI (package:openapi/api_client.dart:101) <asynchronous suspension> #3 ServerApi.pingServer (package:openapi/api/server_api.dart:492) <asynchronous suspension> #4 Future.timeout.<anonymous closure> (dart:async/future_impl.dart:963) <asynchronous suspension> #5 ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart:107) <asynchronous suspension> #6 ApiService.resolveEndpoint (package:immich_mobile/services/api.service.dart:88) <asynchronous suspension> #7 ApiService.resolveAndSetEndpoint (package:immich_mobile/services/api.service.dart:70) <asynchronous suspension> #8 AuthService.validateServerUrl (package:immich_mobile/services/auth.service.dart:51) <asynchronous suspension> #9 LoginForm.build.getServerAuthSettings (package:immich_mobile/widgets/forms/login/login_form.dart:100) <asynchronous suspension> ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 11:14:12 +03:00
Author
Owner
Copy Link

@bo0tzz commented on GitHub (Jan 23, 2025):

I use a CNAME for my own deployment and it works without issues. I think it's more likely you're having problems properly resolving the DNS or such, rather than a bug in Immich specific to resolving CNAMES - especially because we don't have any code to resolve things ourselves, we just call out to the platform libraries which are certainly well tested.

@bo0tzz commented on GitHub (Jan 23, 2025): I use a CNAME for my own deployment and it works without issues. I think it's more likely you're having problems properly resolving the DNS or such, rather than a bug in Immich specific to resolving CNAMES - especially because we don't have any code to resolve things ourselves, we just call out to the platform libraries which are certainly well tested.
OVERLORD commented 2026-02-05 11:14:14 +03:00
Author
Owner
Copy Link

@whistlerofficial commented on GitHub (May 27, 2025):

Looks Like i got the same issue here.
Did someone fixed it?

@whistlerofficial commented on GitHub (May 27, 2025): Looks Like i got the same issue here. Did someone fixed it?
OVERLORD commented 2026-02-05 11:14:14 +03:00
Author
Owner
Copy Link

@barthy-koeln commented on GitHub (Oct 18, 2025):

I ran into the same issue and fixed it for my specific setup, although I'm not 100% clear how the error message relates.

Disabling "Private DNS", which is a systemwide setting that would under circumstances bypass my custom DNS, yielded a different error similar to "invalid SSL certificate".

Paired with the error message from another app, “Trust Anchor not found for Android SSL Connection” I figured the solution was to use a full-chain cert (root CA + intermediate) as the cert in my reverse proxy.

I turned “Private DNS” back to “automatic” and tried again successfully.

@barthy-koeln commented on GitHub (Oct 18, 2025): I ran into the same issue and fixed it for my specific setup, although I'm not 100% clear how the error message relates. Disabling "Private DNS", which is a systemwide setting that would under circumstances bypass my custom DNS, yielded a different error similar to "invalid SSL certificate". Paired with the error message from another app, “Trust Anchor not found for Android SSL Connection” I figured the solution was to use a full-chain cert (root CA + intermediate) as the cert in my reverse proxy. I turned “Private DNS” back to “automatic” and tried again successfully.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#5194
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?