Two containers under different subdomains

[tafk7]

I'm trying to setup two different docker containers hosted on the same server under different subdomains. I've gotten each container to work on its own, but when trying to run at the same time one of them consistently gives a 502 error. I've been troubleshooting this for a couple days and am rather confounded. Any help would be greatly appreciated.

docker_compose.yml

---
version: "3.8"

secrets:
  config_json_1:
    file: secrets1.json
  config_json_2:
    file: secrets2.json

services:
  foundry-1:
    image: felddy/foundryvtt:latest
    container_name: foundry-1
    hostname: foundry-1
    volumes:
      - ./fvttdata1:/data
    ports:
      - target: 30000
        published: 30001
        protocol: tcp
    restart: unless-stopped
    environment:
      - FOUNDRY_TELEMETRY=false
      - FOUNDRY_MINIFY_STATIC_FILES=true
      - CONTAINER_VERBOSE=true
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_HOSTNAME=one.example.com
    secrets:
      - source: config_json_1
        target: config.json
    networks:
      - network_1

  foundry-2
    image: felddy/foundryvtt:latest
    container_name: foundry-2
    hostname: foundry-2
    volumes:
      - ./fvttdata2:/data
    ports:
      - target: 30000
        published: 30002
        protocol: tcp
    restart: unless-stopped
    environment:
      - FOUNDRY_TELEMETRY=false
      - FOUNDRY_MINIFY_STATIC_FILES=true
      - CONTAINER_VERBOSE=true
      - FOUNDRY_PROXY_PORT=443
      - FOUNDRY_PROXY_SSL=true
      - FOUNDRY_HOSTNAME=two.example.com
    secrets:
      - source: config_json_2
        target: config.json
    networks:
      - network_2

  nginx:
    image: lscr.io/linuxserver/nginx:latest
    container_name: nginx
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - ./nginx:/config
      - /etc/letsencrypt:/config/keys
    ports:
      - 80:80
      - 443:443
    restart: unless-stopped
    networks:
      - network_1
      - network_2

networks:
  network_1:
    driver: bridge
  network_2:
    driver: bridge

Nginx configs

example1.conf

server {
    # Enter your fully qualified domain name or leave blank
    server_name             one.example.com;

    # Listen on port 443 using SSL certificates
    listen                  443 ssl;
    include                 /config/nginx/ssl-one.conf;

    # Sets the Max Upload size to 300 MB
    client_max_body_size 300M;

    # Proxy Requests to Foundry VTT
    location / {

        # Set proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # These are important to support WebSockets
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        # Make sure to set your Foundry VTT port number
        proxy_pass http://foundry-1:30000;
    }
}

# Optional, but recommend. Redirects all HTTP requests to HTTPS for you
server {
    if ($host = one.example.com) {
        return 301 https://$host$request_uri;
    }
    listen 80;
    listen [::]:80;
    server_name one.example.com;
    return 404;
}

example2.conf

server {
    # Enter your fully qualified domain name or leave blank
    server_name             two.example.com;

    # Listen on port 443 using SSL certificates
    listen                  443 ssl;
    include                 /config/nginx/ssl-2conf;

    # Sets the Max Upload size to 300 MB
    client_max_body_size 300M;

    # Proxy Requests to Foundry VTT
    location / {

        # Set proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # These are important to support WebSockets
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        # Make sure to set your Foundry VTT port number
        proxy_pass http://foundry-2:30002;
    }
}

# Optional, but recommend. Redirects all HTTP requests to HTTPS for you
server {
    if ($host = two.example.com) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    listen [::]:80;

    server_name two.example.com;
    return 404;
}

I'm running on an Azure VM with the port rules shown in the attached image

[tafk7]

As a note, both instances are accessible through http when running simultaneously, but not https. Attempting to reach each through https gives the following in nginx errors log:

2023/10/15 TIMESTAMP [error] 238#238: *24 connect() failed (111: Connection refused) while connecting to upstream, client: Y.Y.Y.Y server: one.example.com, request: "GET / HTTP/2.0", upstream: "http://X.X.X.2:30001/", host: "one.example.com"

2023/10/15 TIMESTAMP [error] 236#236: *9 connect() failed (111: Connection refused) while connecting to upstream, client: Y.Y.Y.Y, server: two.example.com, request: "GET / HTTP/2.0", upstream: "http://X.X.X.3:30002/", host: "two.example.com"

When running separately each container works fully through https.

[madereddy]

I am not familiar with Nginx, but I have two Foundry containers running with it being reverse proxied without issue. I also have it running behind Authelia as Foundry was being hit alot which is why you see the forward auth command.

foundry<EXAMPLE>.com {

	forward_auth 192.168.1.157:9097 {
		uri /api/verify?rd=https://auth.<EXAMPLE>.com/
		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email

		## This import needs to be included if you're relying on a trusted proxies configuration.
		import trusted_proxy_list
	}
	reverse_proxy 192.168.1.157:30000 {
		# Send the true remote IP
		import trusted_proxy_list
		header_up X-Real-IP {http.request.header.CF-Connecting-IP}
	}
}
foundrydev.<EXAMPLE>.com {

	forward_auth 192.168.1.157:9097 {
		uri /api/verify?rd=https://auth.<EXAMPLE>.com/
		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email

		## This import needs to be included if you're relying on a trusted proxies configuration.
		import trusted_proxy_list
	}
	reverse_proxy 192.168.1.157:30001 {
		# Send the true remote IP
		import trusted_proxy_list
		header_up X-Real-IP {http.request.header.CF-Connecting-IP}
	}
}

If you are reverse proxying through nginx you should need to open the Foundry ports at all on the Azure VM to any connections. You should only need to allow HTTP and HTTPS. In your example conf for 1 you also have the wrong port which Im guessing is a copy/paste error as you have it working by itself.

proxy_pass http://foundry-1:30000;