Closed Morethanevil closed 4 months ago
I don't quite follow what the issue is - you say you found some configurations that work, right? Binding to localhost
is never expected to work with external connections.
The issue is that now the server listens on 127.0.0.1:3001. The reverse proxy connects via IPV6 into the immich server container and this does not work anymore, because Immich only listens on IPV4. localhost:3001 would be better. But when I set HOST="localhost"
via ENV it does not work either, but server log shows binding on [::1]:3001.
Binding on [::1]:3001 via HOST="::1" does not work too, but [::]:3001 binds to [::1]:3001. IPV6 connections worked without issues before v1.102
I need to bind to :: which is like 0.0.0.0. The IPV6 localhost ::1 does not work like 127.0.0.1 in Immich.
Logs with HOST="::1"
Logs with HOST="localhost"
Logs with HOST="::"
As you can see, only here is a connection possible and all three ways show the same listening. That is strange. The standard HOST="127.0.0.1" ignores all IPV6 traffic as expected.
I'm new to immich but i can confirm that the issue exists. If I don't set anything for HOST the server will listen on 127.0.0.1. If i put 0.0.0.0 there it will also listen on 127.0.0.1. If i put a static IP (10.214.xx.xx) it will claim to listen there but not answer requests. What i discovered when putting a "*" there is that i got a DNS resolution error which leads me to believe that the service is actually trying to resolve whatever was given before actually using it to bind.
I can confirm that my setup broke, the host setting to HOST='::'
fixed it for me
Do we just need better documentation for this or do we need to revert the recent change where we add a dedicated host environment variable?
Both would be acceptable. But would it be possible to get the old behavior if the variable is not set? If not documentation about this wild be great, I only discovered the New variable through this issue.
I mean the host variable provides additional freedom for different setups, so i would appreciate if it would stay.
I it possible to use the old behavior if the variable is not set? Otherwise documentation is appreciated. That's at least what I think. There are maybe different opinions. I am ok with almost anything as long as ipv6 works and I know how to set it up with a Container if special configuration is necessary.
The PR for this was made because of security reasons. Everyone on his network can access immich via IP. This could be fixed with pointing the reverse proxy directly into the container and commenting out the port in docker-compose.yml. I am doing exactly this, plus my container gets a static IP.
The HOST ENV is a good addition for those who need it. But why is ::1 not working? It is the same as 127.0.0.1 for IPV4 🤔 This problem stays at the moment.
I would revert to the old behavior and let those use the ENVs who needs them. For security reasons it is better to read about docker networking and commenting out ports.
NGINX Proxy Manager is mostly used by beginners. They can point to the container name immich_server and port 3001.
I for instance run all of my containers via MACVLAN Adapters in order to be able to do a couple of things (Moving between Hosts, Mounting NFS, ...). The current behavior does not allow me to expose the port directly on the MACVLan interface as i cannot get it to stop from listening to local only. I personally would prefer the option to be available but in a working condition. Default behavior being 127.0.0.1 is completely ok and would also allow the "default" use cases like port exposure on the host or a builtin proxy.
The default behavior of specifically binding to 127.0.0.1 is different from omitting the host argument entirely. The documentation clearly states it will bind to ipv6 by default if it is available when host is omitted. I don't see any reason to change that behavior.
https://nodejs.org/api/net.html#serverlistenport-host-backlog-callback
The bug
Since the latest update, the binding adress is 127.0.0.1:3001 I used the new env "HOST" to connect via IPV6 as always via my reverse proxy.
I tried
HOST="::1"
but I can not connect via my reverse proxyLog says: LOG [ImmichServer] Immich Server is listening on http://[::1]:3001/ [v1.102.0] [PRODUCTION]
Then I tried
HOST="::"
<- all interfaces including IPV6 - worksLog says exactly the same, but it works now:
LOG [ImmichServer] Immich Server is listening on http://[::1]:3001/ [v1.102.0] [PRODUCTION]
I use the static IPV6 "fd00:112::2" for immich, the reverse proxy is installed on the host, so I need static adresses. I tried
HOST="fd00:112::2"
and it works too, as expected, the log then says correctly:LOG [ImmichServer] Immich Server is listening on http://[fd00:112::2]:3001/ [v1.102.0] [PRODUCTION]
I tried
HOST="localhost"
too, it does not work either for IPV6.Log exactly the same :)
LOG [ImmichServer] Immich Server is listening on http://[::1]:3001/ [v1.102.0] [PRODUCTION]
The OS that Immich Server is running on
Fedora 39 KDE
Version of Immich Server
v1.102.0
Version of Immich Mobile App
v1.102.0
Platform with the issue
Your docker-compose.yml content
Your .env content
Reproduction steps
Relevant log output
Additional information
No response