Connection refused on Step 8/9

PerrinWaldock commented 8 months ago

I am currently running Immich locally on port 2283.

I generated the JSON file with the grouped photo IDs, generated an API key, and executed the following command to start the duplicates browser:

docker container run \
                   --env IMMICH_URL=http://localhost:2283 \
                   --rm \
                   --publish 8080:80 \
                   ghcr.io/agross/immich-duplicates-browser

In my browser, I set the following: API endpoint URL: http://localhost:8080/api Base URL: http://localhost:2283/ API Key: (redacted>) JSON String: (too long to put in a bug report)

Then clicked "OK". No photos displayed on the duplicate browser, and my terminal printed the following error message for each photo ID in my JSON string:

2024/02/13 16:44:00 [error] 36#36: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 172.17.0.1, server: , request: "GET /api/asset/assetById/0e9c11d9-71d3-4558-83b0-8ab0fcb37a44 HTTP/1.1", upstream: "http://127.0.0.1:2283/api/asset/assetById/0e9c11d9-71d3-4558-83b0-8ab0fcb37a44", host: "localhost:8080", referrer: "http://localhost:8080/"

agross commented 8 months ago

Do you run Immich on localhost using docker?

The issue is the IMMICH_URL environment variable. By using localhost in its value you tell the immich-duplicates-browser docker container to talk to itself when trying to access the Immich API.

The best way to work around this is to run immich-duplicates-browser on the same network as immich-server:

docker container run --network=immich_default ...rest if the invocation above (just a guess, you need to docker network ls to find the network)

...and then pass --env IMMICH_URL=http://immich-server:2283.

It's an easy fix if you're experienced in container networking. Otherwise, please reply here.

PerrinWaldock commented 8 months ago

I'm very new to container networking -- most of my experience is with embedded systems. Thank you for the help!

I am running immich on localhost using docker, and am running immich-duplicates-browser on the same computer.

docker network ls confirmed that the network is immich_default:

NETWORK ID     NAME                 DRIVER    SCOPE
a05ca5256cf8   immich_default       bridge    local

I ran the following command to start the duplicate browser:

docker container run \
                   --env IMMICH_URL=http://immich-server:2283 \
                   --net=immich_default \
                   --rm \
                   --publish 8080:80 \
                   ghcr.io/agross/immich-duplicates-browser

Then entered API endpoint URL: http://localhost:8080/api Base URL: http://immich-server:2283/

However, I'm still seeing a very similar-looking error. Note that it isn't a timeout -- it's an explicit connection refused error: [error] 38#38: *493 connect() failed (111: Connection refused) while connecting to upstream, client: 172.21.0.1, server: , request: "GET /api/asset/assetById/b1f84c54-3239-4064-8bef-31270d65c1ee HTTP/1.1", upstream: "http://172.21.0.6:2283/api/asset/assetById/b1f84c54-3239-4064-8bef-31270d65c1ee", host: "localhost:8080", referrer: "http://localhost:8080/"

If I try to connect to http://172.21.0.6:2283/api/asset/ from my browser, I get an authentication error.

agross commented 8 months ago

To check whether the duplicates-browser can access the immich-server container you can run:

docker exec <name of the duplicates-browser container> curl http://immich-server:2283

Instead of curl you can try wget and the address could as well be an IP address.

I'm sorry, but I'm unable to reproduce your setup because I'm currently on vacation with limited and slow access to the internet. I'll be back at home at the beginning of March.

The basic idea is that because of browser security all calls to Immich's API need to be routed through the duplicates-browser's /api endpoint that will forward all requests to IMMICH_URL/api. The duplicate-browser uses the API to download the thumbnails to display when comparing duplicate. Which means that unless Browser -> duplicate-browser/api -> immich-server/api works you will not be able to the app.

Since the error you posted above is connection refused this would be the first issue to further check. If you want to see the IPs involved in cross-container networking docker inspect --format="{{json .NetworkSettings.Networks }}" <container name>. Both containers should be on the same network, i.e. sharing the IPAddress's network address.

agross commented 7 months ago

@PerrinWaldock Any feedback? Is this still an issue?

PerrinWaldock commented 7 months ago

Sorry, I moved house and am still getting all of my tech in order. I hope you had a good vacation, and I appreciate your help!

Your description of the stack makes sense. Unfortunately, it doesn't seem like the two containers are able to talk to eachother despite being on the same network.

I ran the immich container with the same command as above:

docker container run \
                   --env IMMICH_URL=http://immich-server:2283 \
                   --net=immich_default \
                   --rm \
                   --publish 8080:80 \
                   ghcr.io/agross/immich-duplicates-browser

which produced a container with the name sad_margulis. If I inspect it, I see

docker inspect --format="{{json .NetworkSettings.Networks }}" sad_margulis
{"immich_default":{"IPAMConfig":null,"Links":null,"Aliases":null,"MacAddress":"02:42:ac:15:00:07","NetworkID":"a05ca5256cf87de59663a6baaceb52ca043f21d8526ab75ee32d20c60704dc19","EndpointID":"919fa17ec75dd641e2547fa33896830248f1706f57f49900868b5f20fcdb9981","Gateway":"172.21.0.1","IPAddress":"172.21.0.7","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"DriverOpts":null,"DNSNames":["sad_margulis","9f3ffb894e6f"]}}

Meanwhile, inpsecting the immich server produces

docker inspect --format="{{json .NetworkSettings.Networks }}" immich_server
{"immich_default":{"IPAMConfig":null,"Links":null,"Aliases":["immich_server","immich-server"],"MacAddress":"02:42:ac:15:00:05","NetworkID":"a05ca5256cf87de59663a6baaceb52ca043f21d8526ab75ee32d20c60704dc19","EndpointID":"473efbda5161b16d3fead305a4de2495255883ef7c77f0404c63540a82dae34d","Gateway":"172.21.0.1","IPAddress":"172.21.0.5","IPPrefixLen":16,"IPv6Gateway":"","GlobalIPv6Address":"","GlobalIPv6PrefixLen":0,"DriverOpts":null,"DNSNames":["immich_server","immich-server","a20d6a2fdf09"]}}

They should be on the same subnet, but instead, I am not able to connect from the duplicates browser to the immich server:

docker exec sad_margulis curl http://172.21.0.5
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (7) Failed to connect to 172.21.0.5 port 80 after 0 ms: Couldn't connect to server

agross commented 7 months ago

Thanks for the additional information!

I think the issue is that curl tried to connect to port 80, but the Immich server listens on port 3001.

docker exec sad_margulis curl http://172.21.0.5:3001 should have worked.

Two things to make your life easier:

docker container run --name <name> to define the container's name (instead of sad_margulis)
Since both Immich and the browser are on the same network and every docker network gets DNS, you can talk to the Immich server using its name(s) "DNSNames":["immich_server","immich-server","a20d6a2fdf09"], e.g. curl http://immich_server:3001

PerrinWaldock commented 7 months ago

Ah, I missed that 2283 is the external port but 3001 is the internal port for my immich server.

I renamed the container to imdupes. docker exec imdupes curl http://immich-server:3001 connects to the immich server.

However, the immich duplicates web application is still not able to connect to the server. I set API Endpoint: http://localhost:8080/api Base URL: http://immich-server:3001

but still saw variants of the following error message when I hit the "OK" button on the duplicates browser page:

172.21.0.1 - - [22/Mar/2024:07:38:25 +0000] "GET /api/asset/assetById/e71fe723-f421-4f6b-9e62-bb71b8c93890 HTTP/1.1" 502 157 "http://localhost:8080/setup" "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0"
172.21.0.1 - - [22/Mar/2024:07:38:25 +0000] "GET /api/person/e71fe723-f421-4f6b-9e62-bb71b8c93890 HTTP/1.1" 502 157 "http://localhost:8080/setup" "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0"
2024/03/22 07:38:25 [error] 38#38: *221 connect() failed (111: Connection refused) while connecting to upstream, client: 172.21.0.1, server: , request: "GET /api/person/e71fe723-f421-4f6b-9e62-bb71b8c93890 HTTP/1.1", upstream: "http://172.21.0.5:2283/api/person/e71fe723-f421-4f6b-9e62-bb71b8c93890", host: "localhost:8080", referrer: "http://localhost:8080/setup"

agross commented 7 months ago

The issue is this bit from your logs: upstream: "http://172.21.0.5:2283/api/person/e71fe723-f421-4f6b-9e62-bb71b8c93890",

From the point of view of the browser container http://172.21.0.5:2283 is not accessible because 2283 is the public port (accessible to your host machine), but not the internal port 3001 that Immich listens on.

You need to pass --env IMMICH_URL=http://immich-server:3001 when you run the browser so the browser knows the target address for http://localhost:8080/api requests
Keep API Endpoint set to http://localhost:8080/api
The base URL needs to be accessible from your browser: http://localhost:2283/ You can check whether that's correct by pasting it directly into your browser's address bar

PerrinWaldock commented 7 months ago

Thanks, that fixed it!

agross / immich-duplicates

Connection refused on Step 8/9 #15