search

nginx-proxy / acme-companion

Automated ACME SSL certificate generation for nginx-proxy
MIT License
7.41k stars 824 forks source link

Resolved(User Error): Two container setup, acme-companion fails to initialize with: "Error: can't get docker-gen container id" #872

Closed polarathene closed 3 years ago

polarathene commented 3 years ago

Bug description

Resolved. Accidentally was using nginx image and not nginx-proxy.. a good signal to take a break :sweat_smile:

acme-companion fails initialization complaining about a lack of docker-gen container id.

Docs have been looked through extensively, issues searched. I may have missed something, but AFAIK my configuration is correct. AFAIK no third container (docker-gen) should be required for this setup.

This is a fresh setup on a newly provisioned VPS instance.

acme-companion image version

Please provide the container version that should be printed to the first line of log at container startup:

Info: running acme-companion version v2.1.0-25-g7f1b754

nginx-proxy's Docker configuration

Please provide the configuration (either command line, compose file, or other) of your nginx-proxy stack and your proxied container(s).

version: '3.7'

services:
  backend:
    environment:
      - VIRTUAL_HOST=example.com
      - LETSENCRYPT_HOST=example.com
      - LETSENCRYPT_TEST=true

  nginx:
    image: nginx
    container_name: nginx-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./docker-data/nginx-proxy/html/:/usr/share/nginx/html/:rw
      - ./docker-data/nginx-proxy/vhost.d/:/etc/nginx/vhost.d/:rw
      - ./docker-data/nginx-proxy/certs/:/etc/nginx/certs/:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - ./docker-data/nginx-proxy/conf.d/:/etc/nginx/conf.d/

  acme-companion:
    image: nginxproxy/acme-companion
    container_name: nginx-proxy-acme
    volumes:
      - ./docker-data/nginx-proxy/html/:/usr/share/nginx/html/:rw
      - ./docker-data/nginx-proxy/vhost.d/:/etc/nginx/vhost.d/:rw
      - ./docker-data/nginx-proxy/certs/:/etc/nginx/certs/:rw
      - ./docker-data/nginx-proxy/acme.sh/:/etc/acme.sh/:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./docker-data/nginx-proxy/conf.d/:/etc/nginx/conf.d/
      - ./docker-data/nginx-proxy/standalone_certs.sh:/app/letsencrypt_user_data:ro
    environment:
      - NGINX_PROXY_CONTAINER=nginx-proxy
      - ACME_CA_URI=https://acme-staging-v02.api.letsencrypt.org/directory
      - DEBUG=1

rendered nginx configuration

Please provide the rendered nginx configuration:

docker exec name-of-the-nginx-container nginx -T
Expand for output ```conf nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful # configuration file /etc/nginx/nginx.conf: user nginx; worker_processes auto; error_log /var/log/nginx/error.log notice; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; keepalive_timeout 65; #gzip on; include /etc/nginx/conf.d/*.conf; } # configuration file /etc/nginx/mime.types: types { text/html html htm shtml; text/css css; text/xml xml; image/gif gif; image/jpeg jpeg jpg; application/javascript js; application/atom+xml atom; application/rss+xml rss; text/mathml mml; text/plain txt; text/vnd.sun.j2me.app-descriptor jad; text/vnd.wap.wml wml; text/x-component htc; image/png png; image/svg+xml svg svgz; image/tiff tif tiff; image/vnd.wap.wbmp wbmp; image/webp webp; image/x-icon ico; image/x-jng jng; image/x-ms-bmp bmp; font/woff woff; font/woff2 woff2; application/java-archive jar war ear; application/json json; application/mac-binhex40 hqx; application/msword doc; application/pdf pdf; application/postscript ps eps ai; application/rtf rtf; application/vnd.apple.mpegurl m3u8; application/vnd.google-earth.kml+xml kml; application/vnd.google-earth.kmz kmz; application/vnd.ms-excel xls; application/vnd.ms-fontobject eot; application/vnd.ms-powerpoint ppt; application/vnd.oasis.opendocument.graphics odg; application/vnd.oasis.opendocument.presentation odp; application/vnd.oasis.opendocument.spreadsheet ods; application/vnd.oasis.opendocument.text odt; application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; application/vnd.wap.wmlc wmlc; application/wasm wasm; application/x-7z-compressed 7z; application/x-cocoa cco; application/x-java-archive-diff jardiff; application/x-java-jnlp-file jnlp; application/x-makeself run; application/x-perl pl pm; application/x-pilot prc pdb; application/x-rar-compressed rar; application/x-redhat-package-manager rpm; application/x-sea sea; application/x-shockwave-flash swf; application/x-stuffit sit; application/x-tcl tcl tk; application/x-x509-ca-cert der pem crt; application/x-xpinstall xpi; application/xhtml+xml xhtml; application/xspf+xml xspf; application/zip zip; application/octet-stream bin exe dll; application/octet-stream deb; application/octet-stream dmg; application/octet-stream iso img; application/octet-stream msi msp msm; audio/midi mid midi kar; audio/mpeg mp3; audio/ogg ogg; audio/x-m4a m4a; audio/x-realaudio ra; video/3gpp 3gpp 3gp; video/mp2t ts; video/mp4 mp4; video/mpeg mpeg mpg; video/quicktime mov; video/webm webm; video/x-flv flv; video/x-m4v m4v; video/x-mng mng; video/x-ms-asf asx asf; video/x-ms-wmv wmv; video/x-msvideo avi; } ```

Containers logs

Please provide the logs of:

docker logs name-of-the-companion-container

acme-companion:

Attaching to nginx-proxy-acme
nginx-proxy-acme  | Info: running acme-companion version v2.1.0-25-g7f1b754
nginx-proxy-acme  | Error: can't get docker-gen container id !
nginx-proxy-acme  | If you are running a three containers setup, check that you are doing one of the following :
nginx-proxy-acme  |     - Set the NGINX_DOCKER_GEN_CONTAINER env var on the letsencrypt-companion container to the name of the docker-gen container.
nginx-proxy-acme  |     - Label the docker-gen container to use with 'com.github.jrcs.letsencrypt_nginx_proxy_companion.docker_gen'.
nginx-proxy-acme exited with code 1

nginx-proxy:

Attaching to nginx-proxy
nginx-proxy       | /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
nginx-proxy       | /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
nginx-proxy       | /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
nginx-proxy       | 10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf is not a file or does not exist
nginx-proxy       | /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
nginx-proxy       | /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
nginx-proxy       | /docker-entrypoint.sh: Configuration complete; ready for start up
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: using the "epoll" event method
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: nginx/1.21.3
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: built by gcc 8.3.0 (Debian 8.3.0-6) 
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: OS: Linux 5.11.0-17-generic
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: start worker processes
nginx-proxy       | 2021/09/23 03:22:30 [notice] 1#1: start worker process 22

Docker host

OS: Ubuntu 21.04 (Kernel 5.11, built May 2021)

docker-compose version:

docker-compose version 1.25.0, build unknown
docker-py version: 4.1.0
CPython version: 3.9.5
OpenSSL version: OpenSSL 1.1.1j  16 Feb 2021

docker version:

Client: Docker Engine - Community
 Version:           20.10.8
 API version:       1.41
 Go version:        go1.16.6
 Git commit:        3967b7d
 Built:             Fri Jul 30 19:53:57 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.8
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.6
  Git commit:       75249d8
  Built:            Fri Jul 30 19:52:06 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.9
  GitCommit:        e25210fe30a0a703442421b0f60afac609f950a3
 runc:
  Version:          1.0.1
  GitCommit:        v1.0.1-0-g4144b63
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
polarathene commented 3 years ago

Sorry.. this was a typo on my part from being tired. The image name is nginx not nginx-proxy..

Resolved: Troubleshooting the init scripts ## Related init logic Initialization fails on this conditional: https://github.com/nginx-proxy/acme-companion/blob/7f1b75460d2a4ba9aa81e6da06c3119b41ef94db/app/entrypoint.sh#L145-L161 Which calls the following functions: https://github.com/nginx-proxy/acme-companion/blob/7f1b75460d2a4ba9aa81e6da06c3119b41ef94db/app/functions.sh#L235-L286 --- I have deviated from the `volumes_from` approach, but followed the documentation to provide a `NGINX_PROXY_CONTAINER` ENV to identify `nginx-proxy` container. The docker label and some other content in the scripts still reference the previous project name, so the ENV seemed most appropriate. As the first conditional was not triggered, the ENV is working fine and moves onto the next conditional for Docker Gen. I have tried to follow the logic flow here but AFAIK, `[[ -z "$(get_docker_gen_container)" ]]` should evaluate to _false_ and `! is_docker_gen_container "$(get_nginx_proxy_container)"` would likewise return _false_ from `is_docker_gen_container`, resulting in `FALSE && TRUE`... I believe the initial `FALSE` would short-circuit, but either way this conditional statement should evaluate to _false_ and not trigger the failure about `docker-gen`? Clearly this is not the case. `get_docker_gen_container` must be returning a value that evaluates to _true_..
polarathene commented 3 years ago

That said, the main confusion that led to raising a bug report before realizing the actual problem, was that the check for NGINX_PROXY_CONTAINER doesn't care if the value is valid, there's no attempt to verify if that matches a valid nginx-proxy container instance, which was a bit misleading as I was under the impression that was working well.

Besides adding this validation into the init script, the bug report could also request the user to provide the nginx-proxy version output like it does for acme-companion, that would have also surfaced my mistake earlier! :)

buchdag commented 3 years ago

@polarathene I don't know if you can do a PR on the issue template, feel free to do so if it is possible, contributions like those are welcome 👍