Properly Nginx template for reverse proxy?

[satonotdead]

I wonder if someone can share this, because I'm getting 500 errors on my side (can't GET/POST to the dockerized libremdb).

That's the current template I was trying out:

server {
        listen 443 ssl http2;
        server_name movies.mydomain.tld;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.conf;

        location / {
                proxy_pass http://127.0.0.1:PORT;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
#    proxy_set_header X-Forwarded-Port $server_port;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

        }

#        add_header Access-Control-Allow-Origin movies.mydomain.tld;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    ssl_certificate /etc/letsencrypt/live/movies.mydomain.tld/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/movies.mydomain.tld/privkey.pem; # managed by Certbot
}

[zyachel]

what dockerfile are you using? did you modify the .env.local before running the image?

[satonotdead]

Dockerfile

# Thanks @yordis on Github! https://github.com/vercel/next.js/discussions/16995#discussioncomment-132339

# Install dependencies only when needed
FROM node:lts-alpine AS deps

WORKDIR /opt/app
COPY package.json pnpm-lock.yaml ./
RUN npm install -g pnpm
RUN pnpm install --frozen-lockfile

# Rebuild the source code only when needed
# This is where because may be the case that you would try
# to build the app based on some `X_TAG` in my case (Git commit hash)
# but the code hasn't changed.
FROM node:lts-alpine AS builder

ENV NODE_ENV=production
WORKDIR /opt/app
RUN npm install -g pnpm
COPY . .
COPY --from=deps /opt/app/node_modules ./node_modules
RUN pnpm build

# Production image, copy all the files and run next
FROM gcr.io/distroless/nodejs18-debian11 AS runner
ARG X_TAG
WORKDIR /opt/app
ENV NODE_ENV=production
COPY --from=builder /opt/app/next.config.mjs ./
COPY --from=builder /opt/app/public ./public
COPY --from=builder /opt/app/.next ./.next
COPY --from=builder /opt/app/node_modules ./node_modules
ENV HOST=0.0.0.0
ENV PORT=3000
CMD ["./node_modules/next/dist/bin/next", "start"]

.env

################################################################################
### PLEASE FILL/ENABLE REQUIRED VARS AT LEAST BEFORE RUNNING THE APPLICATION ###
################################################################################

################################################################################
### 1. REQUIRED VARS(site may not work as expected without these).
################################################################################
## used for meta tags. e.g: 'https://libremdb.iket.me'. don't add end slash.
NEXT_PUBLIC_URL=https://movies.domain.tld
## used when fetching data from IMDb. not adding these could result in not getting any response.
## example useragent header: 'Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0'
AXIOS_USERAGENT='Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0'
## example accept header: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'
AXIOS_ACCEPT='text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'

################################################################################
### 2. OPTIONAL VARS(enabling these is encouraged)
################################################################################
## for forcing a certain language for data we get from imdb. Useful when you don't want your IP to determine the preferred language.
# AXIOS_LANGUAGE='en-US,en;q=0.5'
## comment it out if you wish to enable nextjs stats collection. more at https://nextjs.org/telemetry
NEXT_TELEMETRY_DISABLED=1

################################################################################
### 3. REDIS CONFIG(optional if you don't need redis)
################################################################################
## enables caching of api routes as well as media
USE_REDIS=true
## in case you don't want to cache media but only api routes
# USE_REDIS_FOR_API_ONLY=true
## ttl for media and api
REDIS_CACHE_TTL_API=3600
REDIS_CACHE_TTL_MEDIA=3600
## for docker, just set the domain to the container name, default is 'libremdb_redis'
REDIS_URL=libremdb-redis

################################################################################
### 4. INSTANCE META FIELDS(not required but good to have)
################################################################################
## example: 'https://iket.me'. 
NEXT_PUBLIC_INSTANCE_MAIN_URL=https://domain.tld
## eg: 'zyachel'
NEXT_PUBLIC_INSTANCE_NAME=movies-domain

docker-compose.yml

services:
  libremdb:
    container_name: libremdb
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "127.0.0.1:3333:3000"
    env_file: .env
    depends_on:
      - libremdb-redis
    restart: always
    user: 65534:65534 # equivalent to the nobody user
    read_only: true
    tmpfs:
      - /opt/app/.next/cache/:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
#    networks:
#      - libremdb

  libremdb-redis:
    container_name: libremdb-redis
    image: redis
    # FOR DEBUGGING ONLY
    # ports:
    #   - "6379:6379"
    restart: always
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /data:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
    cap_drop:
      - ALL
#    networks:
#      - libremdb

#networks:
#  libremdb:

The /API/event POST call shows 400 error and the page displays 500 (on GET).

Trying to build shows this, so it could probably related. Perhaps I need to start from the scratch? I did not touched more files than .env, docker-compose.yml and Dockerfile.

=> ERROR [libremdb deps 5/5] RUN pnpm install --frozen-lockfile                                                 1.6s
------                                                                                                                
 > [libremdb deps 5/5] RUN pnpm install --frozen-lockfile:                                                            
1.342  ERR_PNPM_LOCKFILE_BREAKING_CHANGE  Lockfile /opt/app/pnpm-lock.yaml not compatible with current pnpm
1.342 
1.342 Run with the --force parameter to recreate the lockfile.

[zyachel]

i suppose you're on a lower version of pnpm. does replacing RUN pnpm install --frozen-lockfile with RUN pnpm install --frozen-lockfile --force in the Dockerfile solve it?

Also, can you change this line in src/components/error/ErrorInfo.tsx:

-const isDev = process.env.NODE_ENV === 'development';
+const isDev = true;

That'll show you full stack trace in the UI. if it's a DNS issue, try editing docker daemon config.

[satonotdead]

Hey @zyachel thanks for your reply. I wonder if my issue could be related to be using docker-compose.yml file?

On my src/components/error/ErrorInfo.tsx there is no:
-const isDev = process.env.NODE_ENV === 'development';

Already tried the change about RUN pnpm install --frozen-lockfile --force and my instance stills with 500 errors while trying to enter to movie links.