Gateway timeout when used behind reverse proxy

[danepowell]

Steps To Reproduce

Install Bitwarden Unified according to the instructions for Docker Compose. I'm using essentially the example docker-compose.yml file, plus a few labels to expose 8080 to Traefik. Traefik terminates SSL and serves content on 443.

Everything works fine initially. But wait some period of time (I haven't found a clear trigger, other than "wait"), then try to access any domain served by the container (https://{your-bitwarden-domain}, https://{your-bitwarden-domain}/api/config, etc...)

Expected Result

Bitwarden is available on the specified admin domain.

Actual Result

Accessing the admin domain results in 504 gateway timeouts from Traefik and no associated errors (or any entries at all) in /var/log/ in the Bitwarden container, even with a 100 s timeout.

Screenshots or Videos

No response

Additional Context

I'm wondering how to debug this further. Traefik shows the incoming request and 504 timeout, so the problem must lie with Bitwarden. But no logs I can find in the Bitwarden container even show a request being made, much less an error.

Clearing the Bitwarden data directories "fixes" the problem temporarily but it always comes back after a few minutes.

Githash Version

Can't access API, the Docker digest is sha256:20421b822cf77c7187f60485fd0ddd08b187dfa1892840c6e26c847199078485

Environment Details

Ubuntu, Docker

Database Image

mariadb:10

Issue-Link

#2480

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[kspearrin]

Can you wget or curl the bitwarden endpoints from your Traefik instance? Can you just expose Bitwarden to the host and try to hit the endpoints directly to see what they return when things go down?

[kspearrin]

Also, you can check to see if the services are still running on the Bitwarden container. Check docker exec -it bitwarden supervisorctl status

[danepowell]

I figured it out! Thanks, your tip to try pinging Bitwarden from Traefik got me on the right track.

The problem is that I had the Bitwarden container on two networks, one for web access and one internal to keep the db off the web. This requires setting traefik.docker.network: web, which is what I had neglected. This became apparent when I pinged Bitwarden from within Traefik and noticed the IP was different than what Traefik listed for the service.

This is entirely a PEBCAK / Traefik issue, I don't think Bitwarden could do anything to help here.