Repository: nginx-proxy/acme-companion

Issue #600: Cert renewals fail when nginx proxy runs in network mode "host"
Created: 2019-12-08T20:37:38Z
Hi,
I hope someone can point me to the right direction to fix this issue. The automatic renewal doesn't work for me, because I'm running jwilders nginx proxy in network mode "host". I have to do this, because the proxy fails to forward real user IPs without it.
The whole error message is:
ERROR:simp_le:1396: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/1622245421, https://acme-v02.api.letsencrypt.org/acme/authz-v3/1622245422
Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1370, in finalize_order
    finalized_order = client.poll_and_finalize(order)
  File "/usr/lib/python3.7/site-packages/acme/client.py", line 712, in poll_and_finalize
    orderr = self.poll_authorizations(orderr, deadline)
  File "/usr/lib/python3.7/site-packages/acme/client.py", line 736, in poll_authorizations
    raise errors.ValidationError(failed)
acme.errors.ValidationError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1443, in persist_new_data
    order = finalize_order(client, order)
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1397, in finalize_order
    raise Error('Challenge validation has failed, see error log.')
simp_le.Error: Challenge validation has failed, see error log.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1565, in main
    return main_with_exceptions(cli_args)
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1549, in main_with_exceptions
    persist_new_data(args, existing_data)
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1464, in persist_new_data
    chain=None,
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 1128, in persist_data
    plugin.save(new_data)
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 557, in save
    key = self.dump_key(data.key)
  File "/usr/lib/python3.7/site-packages/simp_le.py", line 455, in dump_key
    return OpenSSL.crypto.dump_privatekey(self.typ, data.wrapped).strip()
AttributeError: 'NoneType' object has no attribute 'wrapped'

Unhandled error has happened, traceback is above

Each time I want to renew the certificates, I have to recreate the container with the default network options. Is there a way to fix this? Running the companion in network mode "host" didn't.

Duplicate issue #746: "Host" Network containers
Created: 2021-01-05T10:32:11Z
Hello there !
More like a question than an issue.
I just deployed these awesome containers and everything works fine.
I have a question about networking configuration of containers.
Everything works fine for a "bridged" container when exposing his port as specified in the documentation.
My problem is that I have a container (Home Assistant), that needs to be running in "host" network mode to discover devices on the network.
I tried do deploy the container like this :
docker run --detach \ --name home-assistant \ --restart=always \ --expose=8123 \ --volume /var/run/docker.sock:/var/run/docker.sock:ro \ --volume /srv/dev-disk-by-label-data/docker/homeassistant:/config  \ --volume /etc/localtime:/etc/localtime:ro  \ --env "VIRTUAL_HOST=xxx.mydomain.com" \ --env "VIRTUAL_PORT=8123" \ --env "LETSENCRYPT_HOST=xxx.mydomain.com" \ --env "LETSENCRYPT_EMAIL=noc@mydomain.com" \ --net=host \ homeassistant/home-assistant:stable
As far as I can tell, certificate is okay. I can access the url and the Let's Encrypt Certificate is presented.
The issue is that nginx brings me a 502 bad gateway so I guess something is wrong with my ports or bindings...
Just to let you know, without the "--net=host", everything works fine (but HA can't discover devices).
I know it's more a Docker "question" and I'm sorry about that.
Thanks :)

Closing comment (2021-01-06T09:58:25Z): Hi @Jedediah04
Is your issue similar to #600 ?