I'm trying to set up a domain to more easily access my services on my home network, using a vanity URL instead of IP:port. With my current setup, my browser is not able to see the server ('we can't connect to the server' at e.g. plex.mydomain.xyz).
I registered the domain through Cloudflare. In Cloudflare, I set up my DNS records (A - mydomain.xyz - content = 192.168.x.x; A - www; CNAME - *), and got my API token. Nginx is running in Docker (as are the services I am trying to access), using the jc21 container and their docker compose template. I used the API token to generate an SSL certificate in NPM with *.mydomain.xyz as the domain, then added a proxy host using the URL mentioned above as the Domain Name, the IP of the server that's running all my containers for the forward hostname/IP, and the appropriate port for forward port. Then in the SSL tab told it to force SSL and HTTP/2.
I'm not sure what I'm doing incorrectly, the only thing I have running that might interfere with the network service is a PiHole, and it appears to be sending the request on. Also tried using localhost (127.0.0.1) to no avail. I've seen some others say they had to restart NPM a few times, so I've tried that as well. Thanks for any help!
*Edit: My router had DNS rebind protection enabled which was blocking the local address. I discovered this by using NSLOOKUP on my home network, where I got a 'No internal type for both IPv4...' error (in Windows command prompt) and outside my home network, where it resolved correctly. Thanks to those who commented, appreciate your time.
I'm still very much in a learning mode here, so forgive my ignorance - which logs? Nginx? I'm seeing a fallback_error and fallback_access (which has nothing interesting). There are also some empty files for the host I have set up (proxy-host-1_access/error)
2025/09/01 12:34:54 [error] 193#193: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.1.181, server: nginxproxymanager, request: "GET /api/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "192.168.1.196:81", referrer: "http://192.168.1.196:81/nginx/certificates"
Where, presumably obviously, 196 is the server and 181 is a laptop. FWIW I don't see the directory it's mentioning, /nginx/certificates, but I'm looking at the host's directory rather than in the container.
The upstream refused the connection. You have it there as 127.0.0.1, but for inter-container communication usually you'd use the name. 127.0.0.1 would refer to the same container.
Docker (and other container platform) networking is a bit tricky and I'll admit I don't fully understand how it works, because it doesn't work like regular networking. But a simple scenario like yours shouldn't be difficult.
Docker also has its own LAN IP address, in my experience it's 172.17.0.1 instead of 127.0.0.1. And yes, between containers the container name is used, e.g. plexserver:2736, and it's good practice to manually give them names.
Yes, there is the internal subnet, but it's not something you're supposed to use directly.
Even without full understanding, I think you're a few steps ahead of me! I was also under the impression that it would be fairly straightforward, but getting lessons in how to troubleshoot (and I appreciate them!)
I was testing with 127.0.0.1 earlier, so that's makes sense on one level, but not port 3000.
Is my understanding correct that the upstream connection was refused means that it went to Cloudflare who then sent it back to my server, and it was rejected there?
If your request is showing up in nginx's log, it means you can reach nginx. The upstream is where nginx is going to get the content you want. In your case, that should be the other containers.
Yep, that makes sense. Thank you!