{"action":"opened","issue":{"url":"https://api.github.com/repos/zodern/meteor-up/issues/957","repository_url":"https://api.github.com/repos/zodern/meteor-up","labels_url":"https://api.github.com/repos/zodern/meteor-up/issues/957/labels{/name}","comments_url":"https://api.github.com/repos/zodern/meteor-up/issues/957/comments","events_url":"https://api.github.com/repos/zodern/meteor-up/issues/957/events","html_url":"https://github.com/zodern/meteor-up/issues/957","id":330996082,"node_id":"MDU6SXNzdWUzMzA5OTYwODI=","number":957,"title":"Nginx 503 Temporarily Unavailable showing after fresh deployment with reverse proxy & ssl","user":{"login":"Ziinc","id":22714384,"node_id":"MDQ6VXNlcjIyNzE0Mzg0","avatar_url":"https://avatars2.githubusercontent.com/u/22714384?v=4","gravatar_id":"","url":"https://api.github.com/users/Ziinc","html_url":"https://github.com/Ziinc","followers_url":"https://api.github.com/users/Ziinc/followers","following_url":"https://api.github.com/users/Ziinc/following{/other_user}","gists_url":"https://api.github.com/users/Ziinc/gists{/gist_id}","starred_url":"https://api.github.com/users/Ziinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ziinc/subscriptions","organizations_url":"https://api.github.com/users/Ziinc/orgs","repos_url":"https://api.github.com/users/Ziinc/repos","events_url":"https://api.github.com/users/Ziinc/events{/privacy}","received_events_url":"https://api.github.com/users/Ziinc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-10T19:35:48Z","updated_at":"2018-06-10T19:35:48Z","closed_at":null,"author_association":"NONE","body":"<!-- Love meteor-up? Please consider supporting our collective:\r\n👉  https://opencollective.com/meteor-up/donate -->\r\n\r\n<!-- You only need to answer the questions if this is a bug reports. -->\r\n\r\nMup version (`mup --version`): 1.4.4\r\n\r\nMup config\r\n<!-- Use `mup validate --show --scrub` to remove most of the sensitive information -->\r\n```js\r\n{\r\n  \"servers\": {\r\n    \"one\": {\r\n      \"host\": \"1.2.3.4\",\r\n      \"username\": \"ubuntu\",\r\n      \"pem\": \"~/.ssh/pem\",\r\n      \"opts\": {\r\n        \"port\": 22\r\n      }\r\n    }\r\n  },\r\n  \"proxy\": {\r\n    \"domains\": \"123.123.com\",\r\n    \"ssl\": {\r\n      \"letsEncryptEmail\": \"123@123.com\"\r\n    },\r\n    \"shared\": {\r\n      \"envLetsEncrypt\": {\r\n        \"DEBUG\": true\r\n      }\r\n    }\r\n  },\r\n  \"app\": {\r\n    \"name\": \"my-app\",\r\n    \"path\": \"../\",\r\n    \"servers\": {\r\n      \"one\": {}\r\n    },\r\n    \"buildOptions\": {\r\n      \"serverOnly\": true\r\n    },\r\n    \"env\": {\r\n      \"ROOT_URL\": \"123\",\r\n      \"MONGO_URL\": \"123\",\r\n      \"MONGO_OPLOG_URL\": \"123\",\r\n      \"VIRTUAL_HOST\": \"123.123.com\",\r\n      \"HTTPS_METHOD\": \"noredirect\",\r\n      \"HTTP_FORWARDED_COUNT\": 1,\r\n      \"LETSENCRYPT_HOST\": \"123.123.com\",\r\n      \"LETSENCRYPT_EMAIL\": \"123@123.com\"\r\n    },\r\n    \"docker\": {\r\n      \"image\": \"abernix/meteord:node-8.9.4-base\"  // error occurs regardless of which meteord image is used\r\n    },\r\n    \"enableUploadProgressBar\": true,\r\n    \"type\": \"meteor\"\r\n  }\r\n}\r\n```\r\n\r\nMeteor app is successfully deployed and validated after runing `mup deploy`\r\n\r\nWith this config, after `mup setup` and `mup deploy`, an nginx 503 temporarily unavailable page gets shown.\r\n\r\n![image](https://user-images.githubusercontent.com/22714384/41205530-4ec66ec6-6cf5-11e8-9cd8-3a7b28291b06.png)\r\n\r\nI've attempted to investigate this further, and `mup proxy logs-le` shows the following:\r\n```\r\n[11.11.11.11]Info: Custom Diffie-Hellman group found, generation skipped.\r\n[11.11.11.11]2018/06/10 19:21:39 Generated '/app/letsencrypt_service_data' from 2 containers\r\n[11.11.11.11]2018/06/10 19:21:39 Running '/app/signal_le_service'\r\n[11.11.11.11]2018/06/10 19:21:39 Watching docker events\r\n[11.11.11.11]2018/06/10 19:21:40 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/signal_le_service'\r\n[11.11.11.11]Sleep for 3600s\r\n[11.11.11.11]2018/06/10 19:22:07 Received event start for container 75fa33c09d00\r\n[11.11.11.11]2018/06/10 19:22:22 Debounce minTimer fired\r\n[11.11.11.11]2018/06/10 19:22:22 Generated '/app/letsencrypt_service_data' from 3 containers\r\n[11.11.11.11]2018/06/10 19:22:22 Running '/app/signal_le_service'\r\n[11.11.11.11]/etc/nginx/certs/123.123.com /app\r\n[11.11.11.11]Reloading nginx proxy (mup-nginx-proxy)...\r\n[11.11.11.11]Q2018/06/10 19:22:22 Generated '/etc/nginx/conf.d/default.conf' from 3 containers\r\n[11.11.11.11];2018/06/10 19:22:22 [notice] 53#53: signal process started\r\n[11.11.11.11]Creating/renewal 123.123.com certificates... (123.123.com)\r\n[11.11.11.11]2018-06-10 19:22:24,585:INFO:simp_le:1479: Generating new certificate private key\r\n[11.11.11.11]2018-06-10 19:22:26,202:ERROR:simp_le:1446: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v01.api.letsencrypt.org/acme/authz/ouS3d1nWa3yTF6OpDjaIsFYX2gagf9zJCsnaoBet-ys\r\n[11.11.11.11]Challenge validation has failed, see error log.\r\n[11.11.11.11]\r\n[11.11.11.11]Debugging tips: -v improves output verbosity. Help is available under --help.\r\n[11.11.11.11]/app\r\n[11.11.11.11]Sleep for 3600s\r\n```\r\n\r\nThere seems to be an issue with the certificates passing the validation challenge.\r\n  "}}
{"actor":{"display_login":"Ziinc"}}