Port configurable via environment

[zachwarner]

Hi. Apologies if this is a 🔴 very bad idea 🔴 , I'm still somewhat new to networking. But here goes:

I'm running a stack that binds various services to a VPN via network_mode: container:gluetun. Ideally I'd like my speed test provider to be similarly bound so that I can examine the speed I'm getting on the VPN. However, using this network mode means I can't manually specify ports in the speedtest-tracker service config in my docker compose yaml. And while I could expose 80:80/443:443 in the gluetun service config, that breaks my reverse-proxy setup (via SWAG).

Is it possible to make the port configurable via environment variable? I know some other containers allow this, and it would mean that I could configure the port for speedtest to not conflict with other ports being exposed via gluetun while preserving my reverse-proxy setup.

Thank you!

[alexjustesen]

While 80 and 443 are the internal ports you should (I don't run gluetun) be able to bind your ports to anything else like 8080:80 or 8443:443.

[zachwarner]

@alexjustesen Thank you for the quick reply. Apologies as I don't think I was clear in the initial request. Please let me provide a more concrete example using a pared-down, anonymized version of my code.

invocation

docker compose -f /path/to/docker-compose.yml up

docker-compose

name: MY_STACK
secrets:
    SPEEDTEST_APP_KEY:
        file: /opt/docker/_secrets/SPEEDTEST_APP_KEY
    SPEEDTEST_APP_URL:
        file: /opt/docker/_secrets/SPEEDTEST_APP_URL
    OPENVPN_USER:
        file: /opt/docker/_secrets/OPENVPN_USER
    OPENVPN_PASSWORD:
        file: /opt/docker/_secrets/OPENVPN_PASSWORD
include:
    - ./services/speedtest-tracker.yml
    - ./services/swag.yml
    - ./services/gluetun.yml

service configs

swag

services:
    swag:
        image: lscr.io/linuxserver/swag:latest
        container_name: swag
        cap_add:
            - NET_ADMIN
        env_file:
            - ../MYENV.ENV
        environment:
            - URL=EXAMPLE.COM
            - VALIDATION=dns
            - CERTPROVIDER=zerossl
            - SUBDOMAINS=wildcard
            - DNSPLUGIN=cloudflare
            - PROPAGATION=30
            - [email protected]
        volumes:
            - /opt/docker/swag:/config
        ports:
            - 443:443
        restart: unless-stopped

gluetun

services:
    gluetun:
        image: qmcgaw/gluetun
        container_name: gluetun
        cap_add:
            - NET_ADMIN
        secrets:
            - OPENVPN_USER
            - OPENVPN_PASSWORD
        env_file:
            - ../MYENV.ENV
        environment:
            - VPN_SERVICE_PROVIDER=MYVPNPROVIDER
            - VPN_TYPE=openvpn
            - SERVER_COUNTRIES=United States
            - OPENVPN_USER_SECRETFILE=/run/secrets/OPENVPN_USER
            - OPENVPN_PASSWORD_SECRETFILE=/run/secrets/OPENVPN_PASSWORD
        devices:
            - /dev/net/tun:/dev/net/tun
        volumes:
            - /opt/docker/gluetun:/gluetun
        ports:
            - 8443:8443 # speedtest-tracker
        restart: always

speedtest-tracker

services:
    speedtest-tracker:
        image: lscr.io/linuxserver/speedtest-tracker:latest
        container_name: speedtest-tracker
        network_mode: container:gluetun
        depends_on:
            gluetun:
                condition: service_healthy
        secrets:
            - SPEEDTEST_APP_KEY
            - SPEEDTEST_APP_URL
        env_file:
            - ../MYENV.ENV
        environment:
            - FILE__APP_KEY=/run/secrets/SPEEDTEST_APP_KEY
            - FILE__APP_URL=/run/secrets/SPEEDTEST_APP_URL
            - SPEEDTEST_SCHEDULE=0 4 * * *
            - DISPLAY_TIMEZONE=America/Chicago
            - PRUNE_RESULTS_OLDER_THAN=90
        volumes:
            - /opt/docker/speedtest-tracker/data:/config

speedtest-tracker.subdomain.conf (for reverse proxy)

Relevant portion, adapted from template here.

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name speedtest-tracker.*;
    ...
    location / {
        ...
        set $upstream_app gluetun;
        set $upstream_port 8443;
        ...
    }
}

discussion

For any container not on 80:80/443:443, this setup works -- e.g., for radarr, we can add 7878:7878 to the ports exposed by gluetun, because they are the radarr defaults. That gives us a container exposed at https://radarr.EXAMPLE.COM by the reverse-proxy (including, e.g., Authelia 2FA, though I haven't included it here), where the container exists in the VPN network set up by gluetun. But for speedtest-tracker, because we're on 80:80/443:443, it breaks the reverse-proxy which is also utilizing those ports.

If I read your suggestion correctly, you're saying I should just

services:
    speedtest-tracker:
        image: lscr.io/linuxserver/speedtest-tracker:latest
        container_name: speedtest-tracker
        network_mode: container:gluetun
        depends_on:
            gluetun:
                condition: service_healthy
        ...
        ports:
           - 8443:8443

but this is not valid docker syntax and throws a runtime error. (Mentioned in docker docs here and here).

Since services like gluetun are increasingly popular, I'm seeing docker services increasingly allowing for ports to be specified as an environment variable, which is valid docker syntax. An example would be the QBT_WEBUI_PORT flag for for qBittorrent-nox.

final thoughts

Thanks for reading through all this. I appreciate the work you put into this service, this issue notwithstanding. For what it's worth, I have searched a number of speed test services; this one seems the most feature-complete and actively maintained. I'd really love to use it going forward, and the ability to get it working inside the VPN+reverse-proxy framework would be icing on the cake.

[svenvg93]

The nginx webserver is part of the docker image build by LSIO. We cannot control which port is used on the inside of the container, I don't think they have a env for setting the port.

I looked around in the container. There is an /config/nginx/site-confs/default.conf file which hold this config. You could try to make the same file with the other port numbers and map it as a volume. I haven't tried this but it might be worth a shoot.

[zachwarner]

Apologies, it's probably my brainrot after staring at this stuff for the past few days, but could you please expand on what you mean re: the default.conf option?

FWIW another example I'm using right now is LSIO's qbittorrent image WEBUI_PORT env var.

[svenvg93]

No worries happy to explain more 😄

The speedtest tracker is just a Web Application that uses NGINX webserver to serve the pages.
The /config/nginx/site-confs/default.conf is the configuration for the webserver part, there is defined to use port 80 and 443 on the inside of the container.
You can copy the content of that configuration file and place it in a default.conf at the same place as your docker-compose.yml file.

The in the default.conf. You can change the port number to which ever you want. In you docker-compose.yml you make volume like

volumes:
  - ./defualt.conf:/config/nginx/site-confs/default.conf

With that said the docker image and NGINX web server config is maintained by LSIO. It might a good idea to ask on their repro if this would work without any problems.

[zachwarner]

Very belated, but thank you so much! That works like a charm.

For anyone who comes to this thread in the future, I kept the setup I described above exactly the same, then just manually edited /config/nginx/site-confs/default.conf per @svenvg93 's instructions. Specifically, the lines

    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

we just swap 80 and 443 for the http and https ports we want, respectively. (The line in speedtest-tracker.subdomain.conf then has to be updated to select the right protocol and port to match whatever you put here.) The dashboard was then accessible at speedtest-tracker.EXAMPLE.COM, running on the VPN.

Thanks again!