[SOLVED] "Too many redirects" when DNS Proxy is enabled (CloudFlare)

Hi, I noticed something strange...

When I enable Proxy on CloudFlare DNS configuration, my services are not found with a "Too many redirects" error message.

Disabling Proxy from CloudFlare dashboard, they back active...

This is the Duplicati DNS configuration on CloudFlare, but duplicati.myurl.com it does not work:

This one, instead, it works:

Zitat von KM0201

Eventually just dropped it and just use swag/dns... works fine and everything seems secure.

I'm using also Swag (Reverse Proxy).

What do you mean by using swag/dns, exactly?

Mmmhhhhh...

Swag compose file is similar:

version: "2"
services:
  swag:
    image: ghcr.io/linuxserver/swag
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=100
      - TZ=Europe/Rome
      - URL=my-dns.it
      - SUBDOMAINS=wildcard
      - VALIDATION=dns
      - DNSPLUGIN=cloudflare
      - EMAIL=my@mail.com
    volumes:
      - /srv/dev-disk-by-label-RAID5/appdata/swag:/config
    ports:
      - 443:443
      - 80:80 #optional
    restart: unless-stopped

So, I suppose you're right about Cloudflare issues...

Zitat von KM0201

Also looking at your ports, I'm assuming you've moved OMV off port 80? Otherwise, that is going to conflict.

Yes, that's right.

Zitat von KM0201

If you look under "Validation and Setup", you'll see you have several options there..

https://hub.docker.com/r/linuxserver/swag

I obtain the same "502" error also when swag is configured with HTTP validation.

All services are working fine with both DNS and HTTP validation.

Only NetData is unreachable

It's the easiest possible (the standard one...).

I'm using netdata.mydns.it hostname

## Version 2021/05/18
# make sure that your dns has a cname set for netdata

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name netdata.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app netdata;
        set $upstream_port 19999;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

Zitat von Soma

Ok, first you say "duplicati...." doesn't work. Then you speak about "netdata...."

What doesn't work, after all????

You're right, of course: I mean NETDATA.

Zitat von Soma

Do you even have any access to any service via SWAG? In which context is the SWAG created? With what services? And are they accessible?

What OS are you running?

For you to reach the subdomains via SWAG, they have to be either on the same YAML (stack in Portainer although I had issues and only do it via CLI) or create a network and add ALL the services to that network.

I saw a good explanation by Morlan how to do this in here:

RE: SWAG, Let’s Encrypt and Web GUI

Alles anzeigen

Yes, I have access to any other service via SWAG, configured in the same way.

They are: duplicati, nextcloud, heimdall, tautulli, redis, ombi, mariadb and qbittorrent.

But... it's solved.

Simply, I forgot to link the same "swag_network" in the netdata YML, and I was checking it in the Duplicati YML

...

networks:
  default:
    external: true
    name: swag_default