search

weserv / images

Source code of wsrv.nl (formerly images.weserv.nl), to be used on your own server(s).
https://wsrv.nl/
BSD 3-Clause "New" or "Revised" License
1.97k stars 193 forks source link

Self-hosted: The hostname of the origin is unresolvable (DNS) or blocked by policy. #392

Closed gjongenelen closed 11 months ago

gjongenelen commented 11 months ago

On a self-hosted instance (docker) we get the following error after a nameserver migration:

The hostname of the origin is unresolvable (DNS) or blocked by policy.

When executing a curl from within the container, the target url is reachable and responding with the correct image. The target url does not have a IPv6 (AAAA) record, but just to be sure, I added resolver 1.1.1.1 ipv6=off;. This did not fix the issue.

How can I troubleshoot this issue?

kleisauke commented 11 months ago

The various error logs usually provide more details, see https://github.com/weserv/images/issues/206#issuecomment-567015037.

nslookup can also be used to troubleshoot such issues. Within the Docker container, you could do the following:

# Check the DNS settings (ought to be inherited from the host when Docker's default bridge network is used)
$ cat /etc/resolv.conf | grep nameserver
# Install bind-utils for nslookup
$ dnf install -y bind-utils
# Try to resolve using the default DNS server(s) (specified in /etc/resolv.conf)
$ nslookup google.com
# ... and with Google's open DNS server
$ nslookup google.com 8.8.8.8
# ... and with Docker's embedded DNS server (when using a user-defined bridge)
$ nslookup google.com 127.0.0.11

I added resolver 1.1.1.1 ipv6=off;

In which file did you make this change? The pre-built Docker image requires changing /etc/nginx/imagesweserv.conf instead of ngx_conf/imagesweserv.conf (since the nginx configuration was 'deployed' during the image build).

Note that specifying the ipv6=off parameter is not always desirable, since there are a numerous hosts that only support IPv6 and/or provide broken IPv4 fallbacks.

gjongenelen commented 11 months ago

Thanks for your reply. It did some digging and found out about the second resolver definition in the imagesweserv.conf.

I did add my custom resolver definition to this file, but it was overwritten by the standard definition. Although the origin server did not have an AAAA record, it still seems to try to connect via IPv6?

After adding the ipv6=off to the other definition, it works.