{"action":"created","issue":{"url":"https://api.github.com/repos/ehazlett/interlock/issues/201","repository_url":"https://api.github.com/repos/ehazlett/interlock","labels_url":"https://api.github.com/repos/ehazlett/interlock/issues/201/labels{/name}","comments_url":"https://api.github.com/repos/ehazlett/interlock/issues/201/comments","events_url":"https://api.github.com/repos/ehazlett/interlock/issues/201/events","html_url":"https://github.com/ehazlett/interlock/issues/201","id":179479613,"number":201,"title":"Interlock + NGINX 502","user":{"login":"nhester1","id":19860771,"avatar_url":"https://avatars.githubusercontent.com/u/19860771?v=3","gravatar_id":"","url":"https://api.github.com/users/nhester1","html_url":"https://github.com/nhester1","followers_url":"https://api.github.com/users/nhester1/followers","following_url":"https://api.github.com/users/nhester1/following{/other_user}","gists_url":"https://api.github.com/users/nhester1/gists{/gist_id}","starred_url":"https://api.github.com/users/nhester1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nhester1/subscriptions","organizations_url":"https://api.github.com/users/nhester1/orgs","repos_url":"https://api.github.com/users/nhester1/repos","events_url":"https://api.github.com/users/nhester1/events{/privacy}","received_events_url":"https://api.github.com/users/nhester1/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-09-27T12:30:36Z","updated_at":"2016-09-27T15:46:09Z","closed_at":null,"body":"If Interlock and NGINX are running on the same node as an application in UCP that application will experience a 502 Bad Gateway. If NGINX and Interlock are moved to a new node the problem stops. The problem occurs for all of our applications. We are running NGINX 1.11.4 and Interlock 1.2.0. We also experience the issue with NGINX 1.11.3 and Interlock 1.1.3. We didn't experience this issue until a few days ago and it only occurs in our Non Production cluster. The only difference that we can see between the Production and Non Production cluster is that the Non Production cluster has engine version 1.11.2-cs5, build d364ea1 and the Production cluster has engine version 1.11.2-cs4, build 7d4e626."},"comment":{"url":"https://api.github.com/repos/ehazlett/interlock/issues/comments/249906189","html_url":"https://github.com/ehazlett/interlock/issues/201#issuecomment-249906189","issue_url":"https://api.github.com/repos/ehazlett/interlock/issues/201","id":249906189,"user":{"login":"nhester1","id":19860771,"avatar_url":"https://avatars.githubusercontent.com/u/19860771?v=3","gravatar_id":"","url":"https://api.github.com/users/nhester1","html_url":"https://github.com/nhester1","followers_url":"https://api.github.com/users/nhester1/followers","following_url":"https://api.github.com/users/nhester1/following{/other_user}","gists_url":"https://api.github.com/users/nhester1/gists{/gist_id}","starred_url":"https://api.github.com/users/nhester1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nhester1/subscriptions","organizations_url":"https://api.github.com/users/nhester1/orgs","repos_url":"https://api.github.com/users/nhester1/repos","events_url":"https://api.github.com/users/nhester1/events{/privacy}","received_events_url":"https://api.github.com/users/nhester1/received_events","type":"User","site_admin":false},"created_at":"2016-09-27T15:46:09Z","updated_at":"2016-09-27T15:46:09Z","body":"We are mostly using anapsix/alpine-java:8_jdk_unlimited with Spring Boot apps that have embedded tomcat servers. The labels look roughly like the following:\r\n\r\n    - 'interlock.hostname=myapp'\r\n    - 'interlock.domain=mydomain.com'\r\n    - 'interlock.ssl=true'\r\n    - 'interlock.ssl_only=true'\r\n    - 'interlock.ssl_cert=/etc/docker/cert.pem'\r\n    - 'interlock.ssl_cert_key=/etc/docker/key.pem'\r\n    - 'com.docker.swarm.reschedule-policies=[\"on-node-failure\"]' \r\n\r\nThe only change I have made to the nginx.conf.template is the addition of:\r\n\r\n    proxy_pass_request_headers      on;\r\n    underscores_in_headers on;\r\n\r\nOur interlock + nginx compose file looks like this:\r\n\r\ninterlock:\r\n    image: our.docker.repo/dckrucp/our-interlock:1.0\r\n    command: -D run\r\n    tty: true\r\n    ports:\r\n        - 8080\r\n    environment:\r\n        INTERLOCK_CONFIG: |\r\n            ListenAddr = \":8080\"\r\n            DockerURL = \"${SWARM_HOST}\"\r\n            TLSCACert = \"/etc/docker/ca.pem\"\r\n            TLSCert = \"/etc/docker/cert.pem\"\r\n            TLSKey = \"/etc/docker/key.pem\"\r\n\r\n            [[Extensions]]\r\n            Name = \"nginx\"\r\n            ConfigPath = \"/etc/nginx/nginx.conf\"\r\n            PidPath = \"/etc/nginx/nginx.pid\"\r\n            TemplatePath = \"/etc/interlock/nginx.conf.template\"\r\n            MaxConn = 1024\r\n            Port = 80\r\n            SSLCertPath = \"\"\r\n            SSLPort = 443\r\n            User = \"www-data\"\r\n            WorkerProcesses = 2\r\n            RLimitNoFile = 65535\r\n            ProxyConnectTimeout = 600\r\n            ProxySendTimeout = 600\r\n            ProxyReadTimeout = 600\r\n            SendTimeout = 600\r\n            SSLCiphers = \"HIGH:!aNULL:!MD5\"\r\n            SSLProtocols = \"SSLv3 TLSv1 TLSv1.1 TLSv1.2\"\r\n    volumes:\r\n        - ucp-node-certs:/etc/docker\r\n    labels:\r\n        - 'com.docker.swarm.constraints=[\"node==mynode..com\"]'\r\n    restart: always\r\n\r\nnginx:\r\n    image: nginx:latest\r\n    entrypoint: nginx\r\n    command: -g \"daemon off;\" -c /etc/nginx/nginx.conf\r\n    ports:\r\n        - 80:80\r\n        - 443:443\r\n    volumes:\r\n        - ucp-node-certs:/etc/docker\r\n    labels:\r\n        - \"interlock.ext.name=nginx\"\r\n        - 'com.docker.swarm.constraints=[\"node==mynode.mydomain.com\"]'\r\n    restart: always\r\n\r\nThe issue also seems to occur when using the interlock directly from docker hub.\r\n"}}
{"actor":{"display_login":"nhester1"}}