NPM, host and bridged network and real visitor IP

[Extarys]

Still trying to get real visitor IP from proxied container through NPM :/

Original
I'm trying to set up podman with NPM and Nextcloud. I'm having a hard time with podman or containers complaining about permissions but in the end it's a good thing...

With nextcloud, when I get a 500 error the IP shown is the IP of a container (quite hard to find which IP belongs to which container without inspecting each one of them):

Technical details

    Remote Address: 10.89.1.26

One suggestion that came up online was to use NPM with network_mode: host, but podman complains because there is multiple networks in the compose file.

Am I trying to set this up wrong? I want the ease of using container_name:port inside NPM and not have to worry about internal IPs.

I already have to expose all the ports I want, I thought at first I could just to ncweb:80 without exposing any ports to the host machine, but I guess this is a tradeoff of rootless and the ports need to be exposed.

version: "3.7"
services:
  npm:
    container_name: npm
    image: 'docker.io/jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./npm/data:/data:Z
      - /opt/secrets/letsencrypt:/etc/letsencrypt:Z
    network_mode: host

  # Based on https://github.com/nextcloud/docker/tree/master/.examples/docker-compose/with-nginx-proxy/postgres/fpm
  ncapp:
    image: nextcloud:fpm-alpine
    restart: always
    volumes:
      - ./nextcloud/html:/var/www/html:z
    environment:
      - POSTGRES_HOST=postgres
      - REDIS_HOST=redis
    networks:
      - pod-local

  ncweb:
    build: ./nextcloud/web
    restart: always
    volumes:
      - ./nextcloud/html:/var/www/html:ro
    environment:
      #- VIRTUAL_HOST=
    networks:
      - pod-local

networks:
  pod-local:
    external: true
  pod-public:
    external: true

Error is Error: cannot set multiple networks without bridge network mode, selected mode host: invalid argument

I'm new to podman and I know it isn't a drop in replacement for docker, although it could be true if I'd run it 100% rootfull. The docs and people's suggestion for an issue are often times for a different version or with using a whole stack of softwares.

I'm thinking about running Yacht rootfull and simply give this a try, but that's the easy way out 😂

Thanks for your time.

[Luap99]

Do you run as root or rootless? Do you use docker-compose or podman-compose?

Using network mode host is very likely not what you want. It just runs in your host network namespace. Specifying ports with host does not make sense.
If the containers are on the same network you should be able to communicate via containername:ip assuming you have dns enabled on the network.

[Extarys]

TLDR: For some obscure reason, today I can access containers' ports without exposing them 🤷‍♂️

Hi! Yeah sorry I now realize I could've made my thread clearer.
I'm currently trying rootless. I use a compose.yaml file inside a folder named frontend and use podman-compose up -d to create the containers.

I created my networks with:

• podman network create pod-local
• podman network create pod-public

And I originally attached both network to NPM. At first, if I didn't export any ports, nothing seemed to work, but I just retried it, and now it does? 😕 haha I'm very confused but glad.

I still get NPM IP inside Nextcloud. Current setup is NPM > Nginx (ncweb) > Nextcloud (ncapp).

I'm using this file. I change the upstream with:

upstream php-handler {
        server nextcloud:9000;
    }

and added those lines to the http block, just before the log_format:

    set_real_ip_from  10.89.1.0/24;
    real_ip_header X-Forwarded-For;

And last, those were tested inside NPM Proxy setting in the Advance Tab. Now that looks like an NPM issue more than a podman noob problem though. What bugs me is that I used the same "non working" compose file as yesterday and now it works... Whatever 😂

I appreciate you took the time to reply and I'll comment here again if I see any trouble with ports in the next few hours 😄

[Extarys]

Ok ok, this is why "host" is important. According to NPM: Incorrect request IP address received by proxy, the container would need the host network to detect the visitor's IP address, so it is not an NPM issue.

Using option 2 didn't give me any error, but I also don't see the visitor's IP.
Option 2 is to expose the specific ports to the host like so (apparently):

ports:
      - target: 443
        published: 443 # Outside port
        mode: host
        protocol: tcp
      - target: 80
        published: 80 # Outside port
        mode: host
        protocol: tcp
``