Cannot Get Domain Working with Soft-Serve & Docker

[yottoya]

Cannot Get Domain Working with Soft-Serve & Docker

Hello! I've got no idea what I could possibly be doing wrong, and as usual, it's probably something very small I'm missing here...

• I beleive I have everything set up correct, as I outline below, and the goal is to do the equivalent of ssh git.charm.sh but with ssh git.mydomain.com :)

Soft-Serve Server Docker Config:

• I created a folder for soft-serve in ~/mydockerApps/soft-serve, and created a docker-compose.yml exactly as in the example docker-compose.yml.

---
version: "3.1"
services:
  soft-serve:
    image: charmcli/soft-serve:latest
    container_name: soft-serve
    volumes:
      - ./data:/soft-serve
    ports:
      - 23231:23231
      - 23232:23232
      - 23233:23233
      - 9418:9418
    restart: unless-stopped

• After running docker compose up -d && docker compose logs -f, it looks like it all starts perfectly
• I tested it out locally with ssh -p 23231 192.168.1.101, I can access the newly created server's terminal GUI.

---

Ngnix Proxy Manager (NPM)

• I created a new proxy host in Ngnix, and set it to point to my host @ port 23232 since that is the where soft-serve is listening for HTTP.
• Now, I also know that I must create a "TCP forwarding Stream" for each port so that when a request is made for ssh or http(s), NPM can route the traffic via the right stream, and send me to the right place.
• (Screenshots below for my NPM set up for soft-serve.
  • Proxy Host:
    • 
  • Streams:
    • 23232
      • 
    • 23231
      • 

---

Port forwarding on my router

My Router

• After doing the first 2 sections, I then ensured I had port forwarding enabled on my home-server to allow my router to listen for connections to 23231 & 23232.
• Ports 443 and 80 are already exposed for NPM.

Cloudflare DNS

• I have my dns settings with cloudflare, and have an A record to point to my home server.
• I set a wildcard * CNAME record to mydomain.com, so NPM will handle all the rest.

---

Soft-Serve Server Config:

• After all the above, I went to my soft-serve's data folder, and edited the config as such to reflect the NPM setup I did:

# Soft Serve Server configurations

# The name of the server.
# This is the name that will be displayed in the UI.
name: "My Git Repo"

# Logging configuration.
log:
  # Log format to use. Valid values are "json", "logfmt", and "text".
  format: "text"
  # Time format for the log "timestamp" field.
  # Should be described in Golang's time format.
  time_format: "2006-01-02 15:04:05"
  # Path to the log file. Leave empty to write to stderr.
  #path: ""

# The SSH server configuration.
ssh:
  # The address on which the SSH server will listen.
  listen_addr: ":23231"

  # The public URL of the SSH server.
  # This is the address that will be used to clone repositories.
  public_url: "ssh://git.mydomain.com"
  # Default was:
  #     public_url: "ssh://localhost:23231"

  # The path to the SSH server's private key.
  key_path: ssh/soft_serve_host_ed25519

  # The path to the server's client private key. This key will be used to
  # authenticate the server to make git requests to ssh remotes.
  client_key_path: ssh/soft_serve_client_ed25519

  # The maximum number of seconds a connection can take.
  # A value of 0 means no timeout.
  max_timeout: 0

  # The number of seconds a connection can be idle before it is closed.
  # A value of 0 means no timeout.
  idle_timeout: 600

# The Git daemon configuration.
git:
  # The address on which the Git daemon will listen.
  listen_addr: ":9418"

  # The public URL of the Git daemon server.
  # This is the address that will be used to clone repositories.
  public_url: "git://localhost"

  # The maximum number of seconds a connection can take.
  # A value of 0 means no timeout.
  max_timeout: 0

  # The number of seconds a connection can be idle before it is closed.
  idle_timeout: 3

  # The maximum number of concurrent connections.
  max_connections: 32

# The HTTP server configuration.
http:
  # The address on which the HTTP server will listen.
  listen_addr: ":23232"

  # The path to the TLS private key.
  # tls_key_path: 

  # The path to the TLS certificate.
  # tls_cert_path: 

  # The public URL of the HTTP server.
  # This is the address that will be used to clone repositories.
  # Make sure to use https:// if you are using TLS.
  public_url: "https://git.mydomain.com"
  # Default was:
  #   public_url: "http://localhost:23232"

# The stats server configuration.
stats:
  # The address on which the stats server will listen.
  listen_addr: "localhost:23233"

# The database configuration.
db:
  # The database driver to use.
  # Valid values are "sqlite" and "postgres".
  driver: "sqlite"
  # The database data source name.
  # This is driver specific and can be a file path or connection string.
  # Make sure foreign key support is enabled when using SQLite.
  data_source: "soft-serve.db?_pragma=busy_timeout(5000)&_pragma=foreign_keys(1)"

# Git LFS configuration.
lfs:
  # Enable Git LFS.
  enabled: true
  # Enable Git SSH transfer.
  ssh_enabled: false

# Cron job configuration
jobs:
  mirror_pull: "@every 10m"

# Additional admin keys.
#initial_admin_keys:
#  - "ssh-rsa AAAAB3NzaC1yc2..."

## Custom Settings:
anon-access: read-only
allow-keyless: true

users:
  - name: myname
    admin: true
    public-keys:
      - ssh-rsa ABCD1234

(NOTE:) I created and added the "#Custom Settings" lines to the bottom of the above config because I thought it would help; I placed my ssh-rsa.pub in there perfectly as well.

---

• After all that, I saved it, restarted the docker container by running docker compose up -d && docker compose logs -f, and it started up perfectly again with no errors (according to the start up logs).
• I can still ssh into the git server locally, perfectly via ssh -p 23231 192.168.1.101, but still not via ssh git.mydomain.com.

[yottoya]

Hello 👋 I wanted to know if there is any way to get some assistance on this? Or if there are any plans to get to this issue at a later time? If not, I can close it out so it doesn't clutter/annoy the maintainers of this repo.

Thanks,

[aymanbagabas]

Hi @yottoya, from what I can tell this is probably a firewall problem. Make sure you allow communication for these ports through the network. Also make sure you have your internet IP address up to date and synced with your domain.

[yottoya]

Thanks for your response @aymanbagabas - I am finally getting back to this project to set up on my home server.

After returning to this with more experience, I still cannot get it working.

The scenario is still as such:

• I cloudlfare dns pointing a catch-all record *.mydomain.com pointing to my home-ip address.
• On my home-network, I only have ports 80 and 443 open
• My mainserver has nginx-proxy-manager running on it, so nginx handles every request coming in
• Soft-serve is setup with 100% default settings, default ports, etc. inside a docker-container

I set a stream in nginx-proxy-manager so that when someone reaches https://soft.mydomain.com on port 2222, it will forward to 192.168.6.23:23231

However, still not working 😅

I would like to ask: How is "git.charm.sh" setup to work? Are you guys using traefik or something entirely different? Would LOVE to see how you have it officially set up.

However, if you cannot do this, no worries! And if you cannot help with my issue, no worries either. I have a VPN server with which I can tunnel into my home-network to access my soft-serve server - It would just be nice to set up my own soft.mydomain.com.

[aymanbagabas]

Soft Serve uses 3 protocols to serve its repositories. You have HTTP(s), SSH, and the Git TCP protocol. HTTP runs on port 80, and HTTPS uses port 443. Since you're using Nginx Proxy Manager, you need to handle the TLS termination on that level, and then redirect the traffic to your Soft Serve instance.

SSH and the Git protocol on the other hand also need to be exposed on your home-network to get cloning from git@soft.mydomain.com:repo.git and git://soft.mydomain.com/repo.git to work. I don't know if Nginx Proxy Manager also manages Layer 4 TCP routing, but this is essentially what you want. You could bypass NPM and port forward port 22 (SSH) and port 9418 (Git) to your Soft Serve instance directly in your home-network and that should give you what you want.

On git.charm.sh, we have 3 services running. We use certbot for TLS and certificates, a simple Go HTTP to HTTPS router running on port 80, and Soft Serve running HTTPS (using the certbot certificates) on port 443, SSH on port 22, and Git on port 9418. Nothing fancy 🙂

[shankar]

It should be accessible with ssh -p 23231 git.mydomain.com.

if you want ssh git.mydomain.com to work you should let nginx listen to port 22 and forward it to port 23231 of soft-serve container. Also no other ssh server should be listening in that port

You shouldn't bind the soft-serve docker ports to the host . Instead nginx should be listening to the ports and forwarding the request to the soft-serve container

[yottoya]

Thanks for your response @shankar

After reviewing what you stated, apologies but I do not follow...

If I do not bind the soft-serve docker ports to the host, then how can soft-serve ever be communicated to?

Becuase when setting up with docker-compose.yaml, you HAVE to add a "host-port:inner-container-port". So, I am having some trouble understanding youe comment.

[xjwllmsx]

Hi @yottoya, did you ever get this resolved? I've been using soft serve for almost two years now and I haven't been able to SSH into it using my domain name.