Phoenix app in docker with ssl not receiving anything on port 443

How are you running the container? EXPOSE doesn’t do anything, really:

EXPOSE

EXPOSE <port> [<port>/<protocol>...]

The EXPOSE instruction informs Docker that the container listens on the specified network ports at runtime. You can specify whether the port listens on TCP or UDP, and the default is TCP if the protocol is not specified.

The EXPOSE instruction does not actually publish the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published. To actually publish the port when running the container, use the -p flag on docker run to publish and map one or more ports, or the -P flag to publish all exposed ports and map them to high-order ports.

This suggests that the TCP connection to the Phoenix app was established, but it was closed before any TLS handshake messages were sent by the server. This usually means there is a problem with your certificate/key files: Erlang’s :ssl does not verify the locations at startup, but only once the files are actually needed during the handshake. If it can’t read the files, the ssl socket crashes, and curl reports what you see.

So check if the env vars are correct, the files are present and readable and the private key is not encrypted (password protected).

Something else to think about is to let Nginx or other web server handle the SSL part, and proxy_pass requests to upstream. Then you can just run your Phoenix app on port 4000 and not worry about configuring ssl in Phoenix.

This is how I run my phoenix site with nginx in between.

upstream myapp {
  server localhost:4000;
}

server {
  server_name myapp.de;
  listen 443 ssl http2;
  listen [::]:443 ssl http2 ipv6only=on;

  ssl_certificate /etc/letsencrypt/live/myapp.de/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/myapp.de/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

  client_max_body_size 50m;

  location ~* \.(eot|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
  }

  location ~* ^.+\.(css|js|ico|jpg|jpeg|png|svg|woff|woff2)$ {
    root /var/www/apps/myapp.de/current/lib/myapp-0.1.0/priv/static;
    etag off;
    expires max;
    add_header Access-Control-Allow-Origin *;
    add_header Cache-Control public;
  }

  location ~ live/websocket {
    proxy_http_version 1.1;
    proxy_set_header Origin '';
    proxy_set_header X-Forwarded-Host $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_pass http://myapp;
    break;
  }

  location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://myapp;
    break;
  }
}

I agree with @egze.

That’s interesting to know! I genuinely thought it made a different, lack of reading on my part. But I am running the docker with:

docker run -it -p 80:80 -p 443:443 --entrypoint=bash --name example-app example:1.5

@voltone The ENV variables are being read. I’ve test the paths by making a typo and it crashes immediately. I am not sure how else I can try it out, but I am not getting any type of errors for guidance.

@egze This is interesting, iv’e been searching the web and seen this pop up several times. Thinking about resorting to this method. But then I ask myself, why even have the option to add SSL via Phoenix?

Because you can also use pure Erlang/Elixir to host your site if you want. SSL can certainly be done with pure Phoenix. Just that for me it’s not so practical. I host multiple sites on one box and I only have one 443 port

So have installed nginx and configured it to match the phoneix needs as much as I could, but now I keep getting a 400 bad request - Request Header Or Cookie Too Large. I went through the internet and tried all kinds of settings and I just can’t get it to work. (Excuse my skills, I am still new to devops related things)

My current configs are as follow (Without ssl for now, trying to make it work the normal way first to try and understand it):

etc/nginx/conf.d/default.conf

upstream phoenix {
  server localhost:4000;
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name localhost;

  large_client_header_buffers 4 16k;

  location ~ live/websocket {
    proxy_http_version 1.1;
    proxy_set_header Origin '';
    proxy_set_header X-Forwarded-Host $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_pass http://localhost;
    break;
  }

  location / {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://localhost;
    break;
  }
}

config.exs

config :myapp, myappWeb.Endpoint,
  url: [port: 4000]

Hard to say. Does it happen when curl-ing? Maybe you have some huge cookies saved in the browser.

Currently using chrome in incognito and doing a hard refresh

But try curl. Then you are sure