Need help on how to run portainer behind existing NGINX reverse proxy server

[feicipet]

Ask a Question!

Hi,

I want to run portainer behind an NGINX RP, and I've read the documentation here: https://docs.portainer.io/advanced/reverse-proxy/nginx

But I already have a running NGINX on the same docker host as another container and I want to reuse that as a common reverse proxy for all my other services running on that host.

So I figured that I would try to run the portainer container without SSL on port 9000 and configure my NGINX to point to it instead.

Using runlike, I managed to extract out the docker run command for my current running portainer:

docker run --name=portainer --hostname=XXXXXXXXXX --mac-address=xx:xx:xx:xx:xx:xx --env=PORTAINER_LICENSE_KEY=xxxxxx 
  --volume=/var/run/docker.sock:/var/run/docker.sock 
  --volume=portainer_data:/data 
  --network=bridge --workdir=/ 
  -p 8000:8000 --expose=9000 -p 9443:9443 
  --restart=always 
  --runtime=runc --detach=true 
  portainer/portainer-ee:2.21.4

According to the documentation for running NGINX + portainer as a docker compose bundle, I would need to export 9000 and also add a couple of environment variables:

docker run --name=portainer --hostname=XXXXXXXXXX --mac-address=xx:xx:xx:xx:xx:xx --env=PORTAINER_LICENSE_KEY=xxxxxx 
  --env=VIRTUAL_HOST=portainer.mydomain.com --env=VIRTUAL_PORT=9000
  --volume=/var/run/docker.sock:/var/run/docker.sock 
  --volume=portainer_data:/data 
  --network=bridge --workdir=/ 
  -p 8000:8000 -p 9000:9000 -p 9443:9443
  --restart=always 
  --runtime=runc --detach=true 
  portainer/portainer-ee:2.21.4  

But for the NGINX portion of the docker compose file, I'm confused on why there's a need for this volume:

    volumes:
      - "/var/run/docker.sock:/tmp/docker.sock:ro"

Is is really necessary for NGINX to have this volume? Is it OK if I skip this? And it would be impossible to implement if my NGINX is residing on another host anyway.

Would there be any other steps that I need to execute in order to achieve what I want?

Thanks
Wong

[shalafi99]

Hi @feicipet
Do you already have a docker compose file prepared for this, which has both services (portainer and nginx)?
If so, could you please share it here? For now, what I can mention in terms of what you want to accomplish would be:

1. If you run nginx and portainer inside the same stack (using the same network for both) you do not need to expose any ports for the portainer container anymore in the docker host, if nginx will act as reverse proxy (nginx would use that "shared" network to forward received traffic to portainer). If they are not in the same stack, including this one "shared" network for them both would suffice.

2. nginx definitely does not need a volume mapping for /var/run/docker.sock, only portainer does. Nginx should have some other mapping to persist its own configuration, though.

[feicipet]

No, I do not have a single docker compose file with both portainer and nginx.

Rather, I have a separate running nginx with this docker compose file:

version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
      # Add any other Stream port you want to expose
      # - '21:21' # FTP

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

and my portainer wasn't actually created from a docker compose file. It was actually created from a single docker run command that I copied off from https://docs.portainer.io/start/install-ce/server/docker/linux, and later on I upgraded to Business Edition by buying a Home / Student license and that's why I had to use runlike to reverse engineer what would be the docker run command to re-run my portainer in my original post above.

My original idea was not to run nginx + portainer as a pair under the same docker compose file, but rather to use a common nginx reverse proxy to proxy to multiple containers / services, one of them being portainer. So the "shared" network where nginx can forward received traffic to portainer would actually be portainer's docker host where I have exposed portainer's ports on and not the internal docker network. Does that make sense? Would there be a problem if I do it like that?

Visually, what I'm trying to do would probably look like this:

I understand that this looks a bit weird, but what I was thinking of was that I would eventually move nginx out to another "DMZ" machine / network where it would look like this:

That's the reason why I didn't want to combine both nginx and portainer into a single docker compose file. Would that be possible?

Thank you,
Wong

[shalafi99]

You indeed do not need to have portainer and nginx included inside the same stack (apologies if my initial questions might have implied something like that was strictly needed).

So the "shared" network where nginx can forward received traffic to portainer would actually be portainer's docker host where I have exposed portainer's ports on and not the internal docker network

Considering that both containers (portainer and NPM) are connected to a given one network in common.
(I hope you do not mind, I took a screenshoot of your diagram and hacked it a little bit)

You mentioned that this same NPM acts/will act as reverse proxy for other containers, in that case you could have NPM "join" the portainer network.

relevant sections of npm stack compose file:

networks:
  npm:
    name: npm
    driver: bridge
  portainer:
    external: true
services:
  app:
    image: docker.io/jc21/nginx-proxy-manager:latest
    ports:
      - 80:80
      - 443:443
      - 81:81
    networks:
      - npm
      - portainer

Where I wrote "portainer" for the network, you include the name for network currently being used by portainer.

Since NPM is communicating with portainer using a common network they both are connected to (portainer in this case), for the portainer proxy host you would use the portainer container name as the forward destination (http://portainer:9000 for example).
As it turns out, for portainer you would not even need the 9000 port mapping (port mappings not needed for container to container traffic over a "shared" network) unless you wanted a fallback method to connect to portainer if NPM is down/etc.

I understand that this looks a bit weird, but what I was thinking of was that I would eventually move nginx out to another "DMZ" machine

For your second diagram, since it is traffic between the docker host where NPM is and the docker host where portainer is the port mapping to the docker host becomes mandatory but nothing else of note to mention (except you would have unencrypted http traffic flowing over your local network).

P.S.: I know it's off-topic but you could consider using docker compose file also for portainer itself, you can reuse that existing portainer_data volume with it - but since it is an existing volume not created by the compose stack which would manage portainer you would need to declare it as "external" in the compose file:

volumes:
  portainer_data:
    external: true

[feicipet]

Thank you very much, I'll try this out and report back if it works. Thanks again!