Yesterday, I built a docker image for greencal and tried deploying it, but it didn't work. On the same day, I posted the following question in the LinuxServer.io:

I'm running the lscr.io/linuxserver/swag:5.7.0-ls475 image with docker compose on Ubuntu 26.04 LTS.

I already have several subdomains working with a wildcard SSL cert from zerossl. I've decided to start hosting a new service at the subdomain live.*. I created my own subdomain nginx config file using the config for the existing services as a reference point. However, when I try connecting to the service, I get an SSL error in Firefox and Chrome. If I try connecting with curl, I get TLS internal error 592.

I'm not really sure what to do, since I haven't found much about this error online. All of the other subdomains are still working and use very similar configurations; just about the only things that are different in my config are the subdomain, container name, and port number. I also don't see any lines in the nginx access or error logs for the service when i try accessing the live.* subdomain.

I also shared this:

This is the subdomain that isn't working:

$ cat config/nginx/proxy-confs/greencal.subdomain.conf
server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name live.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app greencal;
        set $upstream_port 8000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

This is a subdomain that IS working:

$ cat config/nginx/proxy-confs/forgejo.subdomain.conf
## Version 2024/07/16
# make sure that your forgejo container is named forgejo
# make sure that your dns has a cname set for forgejo
# edit the following parameters in /data/forgejo/conf/app.ini or set as ENV vars in your container
# [server]
# SSH_DOMAIN       = forgejo.example.com
# ROOT_URL         = https://forgejo.example.com/
# DOMAIN           = forgejo.example.com

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name git.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app forgejo;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }

    location ~ (/forgejo)?/info/lfs {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app forgejo;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}

Docker Compose

The SWAG docker compose configuration:

networks:
  moonlight:
    external: true

services:
  swag:
    image: lscr.io/linuxserver/swag:5.7.0-ls475
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - URL=tsuki.games
      - SUBDOMAINS=wildcard
      - VALIDATION=dns
      - DNSPLUGIN=namecheap
      - CERTPROVIDER=zerossl
      - EMAIL=usagi@tsuki.games
      - ONLY_SUBDOMAINS=true
    volumes:
      - ./config:/config
    extra_hosts:
      - host.docker.internal:host-gateway
    networks:
      - moonlight
    ports:
      - '80:80'
      - '443:443'
    restart: unless-stopped

The docker compose configuration for the service that I want to reach at live.*

networks:
  moonlight:
    external: true

services:
  greencal:
    image: git.tsuki.games/exodrifter/greencal:latest
    container_name: greencal
    networks:
      - moonlight
    volumes:
      - ./secret:/opt/greencal/secret
      - ./greencal.db:/opt/greencal/greencal.db
    restart: unless-stopped

Debugging

curl -v 'https://live.tsuki.games':

* Host live.tsuki.games:443 was resolved.
* IPv6: (none)
* IPv4: 65.109.54.48
*   Trying 65.109.54.48:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
* TLSv1.3 (IN), TLS alert, internal error (592):
* TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
* closing connection #0
curl: (35) TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error

openssl s_client -connect live.tsuki.games:443:

Connecting to 65.109.54.48
CONNECTED(00000003)
4074DEDA897F0000:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_s3.c:918:SSL alert number 80
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 7 bytes and written 1558 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
4074DEDA897F0000:error:0A000197:SSL routines:SSL_shutdown:shutdown while in init:ssl/ssl_lib.c:2804:

I didn't get any useful responses that night, but I did notice that I got the error on that subdomain regardless of whether or not the service was up.

The next day I decided to try changing the subdomain to something else, like cal. This worked! I reported this to the thread I had open and someone suggested that I probably have a DNS entry for live.* that was pointing to some other address.

I had forgotten that I had pointed live.* to an IP address... and this IP address was the wrong one. After correcting the DNS config and waiting for changes to propogate, the server started working properly.