# 502 Bad Gateway for nginx

**URL:** <https://community.fly.io/t/502-bad-gateway-for-nginx/19630>\
**Category:** General\
**Tags:** login-only\
**Created:** [May 3, 2024, 11:55am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630 "2024-05-03T11:55:50Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 3, 2024, 11:55am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/1 "2024-05-03T11:55:51Z")

</div>

I have deployed two apps. One nginx app, config below and the other app is simple api with one endpoint (normal [fly.io](http://fly.io) app)

```auto
server {
  listen 80;
  server_name mydomain.com; 

  # Redirect HTTP to HTTPS
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name mydomain.com; 

  # SSL/TLS certificates
  ssl_certificate /etc/ssl/certs/server.crt;
  ssl_certificate_key /etc/ssl/private/server.key;

  # Additional SSL settings as needed (e.g., HSTS, TLS versions)

  location / {
    proxy_pass https://my-api.fly.dev;
    proxy_set_header Host $host;
  }

  location /static {
    # Serve static assets efficiently
    try_files $uri $uri/ /index.html;
    add_header Cache-Control "public, max-age=31536000"; # One year cache for static assets
  }
}

```

The certificates are correctly set up in [mydomain.com](http://mydomain.com) and nginx conf above.

The error I see in the nginx app logs is below

```auto
333#333: *1 no live upstreams while connecting to upstream, client: 172.16.157.122, 
server: mydomain.com, request: "GET / HTTP/1.1", upstream: "https://my-api.fly.dev/", host: "mydomain.com"

```

When I deploy, and check [mydomain.com](http://mydomain.com), I get a 502 bad gateway. What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![greg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/greg/32/2119_2.png) [@greg](https://community.fly.io/u/greg)\
**Post date:** [May 3, 2024, 12:07pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/2 "2024-05-03T12:07:52Z")

</div>

Hi,

A few things to check.

First, it looks like you are using `https://my-api.fly.dev` for your API. The nginx is failing to get a response back, resulting in the 502. Can you access `https://my-api.fly.dev` ? If you type `https://my-api.fly.dev` does that work?

If not, that explains the issue - if you can’t access it, nginx won’t be able to either. So you’d need to debug why the API app isn’t working. For example by running `flyctl logs` for _that_ app.

If the API is running but nginx can’t access it, perhaps you have `https://my-api.fly.dev`set to not respond to the public. No idea how that app is set up with its `fly.toml`. But if it is not set to respond to public requests with an exposed `443` from e.g from the `tls` handler provided by Fly, you would need to proxy to it from your nginx app using the _private_ .internal domain instead. For example:

```auto
proxy_pass http://my-api.internal:8080;

```

(or whatever its internal\_port value is set as).

The _other_ possible issue is setting the Host header `proxy_set_header Host $host` 🤔 Not sure that is needed. Again, it would depend on your API and what it’s expecting.

Then try connecting to each domain and check it works as expected.

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 3, 2024, 12:23pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/3 "2024-05-03T12:23:12Z")

</div>

Thanks Greg.

`https://my-api.fly.dev` works fine and responds to public. The `fly.toml` for this endpoint is below.

```auto
app = 'my-api'
primary_region = 'sin'

[build]

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = true
  auto_start_machines = true
  min_machines_running = 0
  processes = ['app']

[[vm]]
  memory = '1gb'
  cpu_kind = 'shared'
  cpus = 1

```

Does the `fly.toml` need to change? I will try `proxy_pass http://my-api.internal:3000;`

I will try removing `proxy_set_header Host $host`

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 3, 2024, 1:16pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/4 "2024-05-03T13:16:41Z")

</div>

So setting `proxy_pass http://my-api.internal:3000;` in nginx.conf works fine. But when all machines in `my-api` are suspended then, the `mydomain.com` times out with 504.

I changed the fly.toml to `min_machines_running = 1` Hope this solves it. Is there any other approach? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![greg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/greg/32/2119_2.png) [@greg](https://community.fly.io/u/greg)\
**Post date:** [May 3, 2024, 4:05pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/5 "2024-05-03T16:05:19Z")

</div>

Hi,

Ok, so it’s working, that’s good.

You can _either_ proxy using the public `name.fly.dev` or your private `name.internal` one. It depends how you want it to work, whether you want the API available to requests _not_ using `custom-domain.com` etc. That’s all up to you.

But yes, you will get a 502 or 504 (I always forget which is which) from nginx if it tries to proxy from the upstream (in this case the api) and doesn’t get a response within its expected time. It won’t wait forever and gives up. I would assume its request is hitting while there are 0 machines, and by the time one starts running, it has given up and returned an error code.

So yep, the solution to _that_ would either be to keep at least one api machine running at all times _or_ increase the nginx proxy timeout value to Xs (to allow time for one to start).

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 4, 2024, 4:01am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/6 "2024-05-04T04:01:16Z")

</div>

> [@greg](#):
>
> So yep, the solution to _that_ would either be to keep at least one api machine running at all times _or_ increase the nginx proxy timeout value to Xs (to allow time for one to start).

I will try increasing the nginx timeout. I noticed that the redirect through nginx results in a delayed response. Expected I suppose.

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 4, 2024, 4:02am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/7 "2024-05-04T04:02:37Z")

</div>

> [@greg](#):
>
> You can _either_ proxy using the public `name.fly.dev` or your private `name.internal` one. It depends how you want it to work, whether you want the API available to requests _not_ using `custom-domain.com` etc. That’s all up to you.

While `.internal` works using `name.fly.dev` results in a 502 Bad Gateway right away.

---

<div class="post-metadata">

**Author:** ![rubys](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/rubys/32/16907_2.png) [@rubys](https://community.fly.io/u/rubys)\
**Post date:** [May 4, 2024, 4:49am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/8 "2024-05-04T04:49:43Z")

</div>

[Flycast - Private Fly Proxy services](https://fly.io/docs/networking/private-networking/#flycast-private-fly-proxy-services) may help if you want to allow all machines to suspend.

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 5, 2024, 6:40am UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/9 "2024-05-05T06:40:07Z")

</div>

Yet to try Private Fly Proxy. Thanks for pointing me to the docs.

---

<div class="post-metadata">

**Author:** ![ragbadaskar](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/ragbadaskar/32/35572_2.png) [@ragbadaskar](https://community.fly.io/u/ragbadaskar)\
**Post date:** [May 6, 2024, 12:13pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/10 "2024-05-06T12:13:55Z")

</div>

Ok I tried [Flycast - Private Fly Proxy services](https://fly.io/docs/networking/private-networking/#flycast-private-fly-proxy-services)

Steps:

1. Created a private IPv6 for the app
2. Removed `force_https = true` from the `[http_service]` in `fly.toml`
3. Deployed the app

In the nginx.conf of reverse proxy, I did the following

```auto
server {
  listen 80;
  server_name mydomain.com;  

  # Redirect HTTP to HTTPS
  return 301 https://$host$request_uri;
}
server {
...other code
  location / {
    proxy_connect_timeout 90s;
    proxy_pass http://my-fly-api.flycast:3000; # also tried http://[IPv6]:3000
  }
...other code
}

```

With this setup back to 502 Bad Gateway

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/fly1/original/3X/6/e/6e8955d00cb218e186ebbe3a6ab06fefdce15290.svg) [@system](https://community.fly.io/u/system)\
**Post date:** [May 13, 2024, 12:14pm UTC](https://community.fly.io/t/502-bad-gateway-for-nginx/19630/11 "2024-05-13T12:14:06Z")

</div>

Closed on May 13, 2024, 12:14pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.