Trying to deploy container with internal port 80

1

Hi,

Trying to deploy an instance of Seq using their docker image, which uses port 80 internally for the web UI it serves and doesn’t seem to allow configuration of that.

Although my deploy is successful I am getting “Error”:“Forbidden” browsing to the fly.dev url for the app, I am wondering if it is a mis-configuration of the services in the fly.toml? Any help gratefully received!

# fly.toml file generated for newco-seq on 2022-09-23T10:05:05-07:00

app = "newco-seq"
kill_signal = "SIGINT"
kill_timeout = 5
processes = []

[build]
  image = "datalust/seq"

[mounts]
source="newco_seq_data"
destination="/data"

[env]
  ACCEPT_EULA="Y"

[experimental]
  allowed_public_ports = []
  auto_rollback = true

[[services]]
  http_checks = []
  internal_port = 80
  processes = ["app"]
  protocol = "tcp"
  script_checks = []
  [services.concurrency]
    hard_limit = 25
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    force_https = true
    handlers = ["http"]
    port = 80

  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"

[[services]]
  http_checks = []
  internal_port = 5341
  processes = ["app"]
  protocol = "tcp"
  script_checks = []
  [services.concurrency]
    hard_limit = 25
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    force_https = true
    handlers = ["http"]
    port = 5431

  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"
2

I gave your fly.toml a try. It looks like your both your [[services]] sections are mapped to port 443 so the second one is handling it and that is returning the “Forbidden” response.

Once I got the app deployed, I used fly ssh console to log into the app instance and then I tried running curl to both ports. The 80 port worked fine and returned HTML and the 5341 port returned the Forbidden status.

Do you need the 5341 port public? If not, you can remove that second [[services]] section.

3

Unfortunately yes it does need the 5341 port public for log ingestion

4

Your diagnosis is right though! Without the second [[services]] section the web UI loads without error

5

I think you just need to remove this part from your second [[services]] block so that only the internal port 80 is mapped to 443. You still have port 5341 mapped externally for that [[services]] section so it should be publicly accessible through that port.

6

Success! I removed the 443 part from the second services block, and also had to remove the force_https and add tls to the handlers. Final second block was:

[[services]]
  http_checks = []
  internal_port = 5341
  processes = ["app"]
  protocol = "tcp"
  script_checks = []
  [services.concurrency]
    hard_limit = 25
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    handlers = ["tls", "http"]
    port = 5341

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"

Logs viewable in UI:

Screen Shot 2022-09-23 at 3.47.57 PM
Screen Shot 2022-09-23 at 3.47.57 PM2000×1450 184 KB

Thanks so much for your help!