ray
74 lines
2.3 KiB
Markdown
74 lines
2.3 KiB
Markdown
# Docker Port Binding and Tailscale Reachability
|
|
|
|
When Docker containers bind to `127.0.0.1` (loopback), they are only reachable from the host machine. Tailscale traffic arrives on the `tailscale0` interface and cannot reach `127.0.0.1`-bound ports.
|
|
|
|
## Detection
|
|
|
|
From the VPS via Tailscale:
|
|
|
|
```bash
|
|
# Port returns 000 (connection refused) — likely 127.0.0.1 binding
|
|
curl -s -o /dev/null -w '%{http_code}' --connect-timeout 2 http://100.93.253.36:9925/
|
|
# 000
|
|
```
|
|
|
|
On the home server, verify the binding:
|
|
|
|
```bash
|
|
docker inspect <container> --format '{{json .HostConfig.PortBindings}}' | python3 -m json.tool
|
|
# {"9000/tcp": [{"HostIp": "127.0.0.1", "HostPort": "9925"}]}
|
|
```
|
|
|
|
## Solutions
|
|
|
|
### Option A: Proxy through home nginx (preferred)
|
|
|
|
The home server's nginx already has SSL configs for these services on ports 3443-3450. From the VPS, proxy to the home nginx SSL endpoint with SNI:
|
|
|
|
```nginx
|
|
proxy_pass https://100.93.253.36:3449; # Mealie via home nginx
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name grajmedia.duckdns.org;
|
|
proxy_set_header Host grajmedia.duckdns.org;
|
|
```
|
|
|
|
This works because the home nginx listens on `0.0.0.0:3449` and proxies to `127.0.0.1:9925` locally.
|
|
|
|
### Option B: Rebind container to 0.0.0.0
|
|
|
|
Stop the container, recreate with `0.0.0.0` binding:
|
|
|
|
```bash
|
|
docker stop mealie
|
|
docker rm mealie
|
|
docker run -d --name mealie \
|
|
-p 0.0.0.0:9925:9000 \
|
|
... (rest of original options)
|
|
```
|
|
|
|
**Downside**: the service becomes accessible on the LAN without SSL. Only do this for services that don't need the home nginx SSL layer.
|
|
|
|
### Option C: SSH tunnel
|
|
|
|
As a last resort, create an SSH tunnel from VPS to home server:
|
|
|
|
```bash
|
|
ssh -L 9925:127.0.0.1:9925 -N -f 100.93.253.36
|
|
```
|
|
|
|
Then nginx on the VPS proxies to `http://127.0.0.1:9925`.
|
|
|
|
**Downside**: fragile, needs SSH keepalive, adds latency, requires SSH key setup.
|
|
|
|
## Services by binding type (rayserver)
|
|
|
|
| Service | Docker port | Binding | VPS approach |
|
|
|---------|------------|---------|-------------|
|
|
| Immich | 2283 | 0.0.0.0 | Direct HTTP |
|
|
| Paperless | 8010 | 0.0.0.0 | Direct HTTP |
|
|
| Home Assistant | 8123 | 0.0.0.0 (host net) | Direct HTTP |
|
|
| Mealie | 9925 | 127.0.0.1 | Home nginx HTTPS proxy |
|
|
| Audiobookshelf | 13378 | 0.0.0.0 | Direct HTTP |
|
|
| PocketBase | 8091 | 127.0.0.1 | Home nginx HTTPS proxy |
|