Images not showing on new install

[mattschie]

Hello everyone,

i have an issue with my new, clean install of Tandoor.
I am running it on docker swarm, the files are sitting in an nfs mount. Everything is local only, nothing is accessible from the internet.

here's my stack configuration:

services:
db_recipes:
restart: always
image: postgres:16-alpine
volumes:
- /nfs/DockerRemote/Tandoor/data:/var/lib/postgresql/data
deploy:
replicas: 1
restart_policy:
condition: on-failure
placement:
constraints:
- node.labels.database == true
networks:
- tandoor-internal
environment:
- SECRET_KEY=ASDFASDF
- TZ=Europe/Berlin
- DB_ENGINE=django.db.backends.postgresql
- POSTGRES_HOST=db_recipes
- POSTGRES_DB=tandoor
- POSTGRES_PORT=5432
- POSTGRES_USER=tandoor
- POSTGRES_PASSWORD=tandoor

web_recipes:
restart: always
image: vabene1111/recipes
deploy:
replicas: 1
restart_policy:
condition: on-failure
placement:
constraints:
- node.labels.database != true
environment:
- SECRET_KEY=ASDFASDF
- TZ=Europe/Berlin
- DB_ENGINE=django.db.backends.postgresql
- POSTGRES_HOST=db_recipes
- POSTGRES_DB=tandoor
- POSTGRES_PORT=5432
- POSTGRES_USER=tandoor
- POSTGRES_PASSWORD=tandoor
- ALLOWED_HOSTS=*
- CSRF_TRUSTED_ORIGINS = []
- CORS_ALLOW_ALL_ORIGINS = True
- USE_X_FORWARDED_HOST=True
networks:
- tandoor-internal
- swarm-ipvlan
ports:
- 8080:80
volumes:
- /nfs/DockerRemote/Tandoor/static:/opt/recipes/staticfiles
- /nfs/DockerRemote/Tandoor/media:/opt/recipes/mediafiles
depends_on:
- db_recipes

networks:
tandoor-internal:
driver: overlay
swarm-ipvlan:
external: true

Which is working, except for the images that do not load. They are being stored in /media folder but accessing them gives me a 403 Forbidden by nginx.

Everything I found online is related to the old config where nginx is deployed separately from the recipes, I could not find any workaround to get this running.
As you can see above, I already tried adding ALLOWED_HOSTS and CSRF_TRUSTED_ORIGINS. I also tried using GUNICORN_MEDIA which also didn't work.

Here's the output of the header under /system:

Gunicorn Media: False
Sqlite: Falsch
PostgreSQL: 16
Debug: False

SERVER_PROTOCOL:HTTP/1.0
REMOTE_ADDR:
SERVER_PORT:8080

HTTP_HOST:192.168.170.160:8080
HTTP_X_FORWARDED_FOR:10.0.0.112
HTTP_CONNECTION:close
HTTP_USER_AGENT:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
HTTP_UPGRADE_INSECURE_REQUESTS:1
HTTP_ACCEPT:text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
HTTP_ACCEPT_LANGUAGE:de-DE,de;q=0.9
HTTP_PRIORITY:u=0, i
HTTP_ACCEPT_ENCODING:gzip, deflate

The IP 192.168.170.160 is my floating ip for the docker swarm. Accessing it directly via the ipvlan address changes nothing except the HTTP_X_FORWARDED_FOR is not the internal docker IP but my computers.

Can anyone point me in the right direction here?