New User: HTTP works but HTTPS 502 Bad Gateway

[nova magnet]

Hi all,

Just getting started with Authentik. I have an auth.mydomain.tld subdomain setup for Authentik (using the docker installation path)

I copied the nginx conf from https://docs.goauthentik.io/docs/install-config/reverse-proxy

I then modified the server_name fields to my subdomain, and the server line in the upstream to the same.

The only configuration change was to use ports 9000 and 9444 (instead of 9443) for SSL (I have another service using 9443). The site conf for this subdomain is dedicated to Authentik -- there's no other rules in the conf.

I updated the compose file field:

    ports:
      - "${COMPOSE_PORT_HTTP:-9000}:9000"
      - "${COMPOSE_PORT_HTTPS:-9444}:9444"

Only changing 9443 to 9444,
and updated the .env file to include:

#Alternate web port numbers
COMPOSE_PORT_HTTP=9000
COMPOSE_PORT_HTTPS=9444

tl;dr I am able to access authentik on 9000 but get a 502 Bad Gateway on SSL proxy pass, and I am unable to access it directly on 9444, or even locally on SSL/443 (typing in https://auth.mydomain.tld, local or remote).

I can do configuration on the non-SSL, but I'd like to disable that port.

Initially I thought I would need to enable SSL somewhere in the Admin Panel, but I don't see any options for that.

Would also appreciate help figuring out how to disable the non-SSL port, aside from just closing the firewall on it

[rugged knoll]

Be sure your containers can connect together by using this command :
docker exec -it <proxy_container_name> ping <authentik_container_name>

For my part, I was a little careless which made me lose a lot of time. 😅

[nova magnet]

I mean the web interface is working fine on insecure port 9000. I don't think that's the issue.

The reverse proxy I'm using is nginx and it's working with dozens of other containers

[rugged knoll]

I mean, are your sure ngnix can see other containers ?? With Docker, your container may not be able to connect to each other if you not explicitly allow them. This is why I suggest you to use the command above.
Docker network and local network are two different things.

[nova magnet]

Yes. I resolved the issue by pointing the nginx reverse proxy to the http (port 9000). Since it's forwarding internally within the system, I think it should remain secure, and it's still reverse proxying off a domain that is SSL-secured

If that's not secure or there's a better way to do it, would love to be corrected.

basically https://mydomain -> nginx -> internal proxy to port 9000