From a7a59c8f4f4b6193b2685895d717b0de533b1f5a Mon Sep 17 00:00:00 2001 From: Ash Brener Date: Mon, 20 Jul 2026 23:21:18 +0200 Subject: [PATCH] fix(docker): support IPv6 nameservers in nginx resolver derivation The entrypoint derives nginx's resolver from /etc/resolv.conf but wrote IPv6 nameserver addresses unbracketed. On hosts with an IPv6 resolver (e.g. Fly.io's fdaa::3) nginx fails at startup with [emerg] invalid port in resolver "fdaa::3" and the container crash-loops. Bracket any nameserver containing a colon so nginx parses it as an IPv6 address instead of host:port. Also drop the hardcoded ipv6=off, which prevented proxying to IPv6-only upstreams (e.g. Fly.io .flycast hosts) by discarding AAAA answers. --- docker/40-openconcho-config.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docker/40-openconcho-config.sh b/docker/40-openconcho-config.sh index 88656ca..a7499ed 100644 --- a/docker/40-openconcho-config.sh +++ b/docker/40-openconcho-config.sh @@ -15,9 +15,12 @@ EOF # proxy_pass resolves on BOTH user-defined networks (Docker embedded DNS at # 127.0.0.11) and the default bridge (host nameservers from /etc/resolv.conf). # Hardcoding 127.0.0.11 breaks `docker run` on the default bridge (no embedded DNS). -RESOLVERS=$(awk '/^nameserver/ { print $2 }' /etc/resolv.conf | tr '\n' ' ' | sed 's/ *$//') +# IPv6 nameservers (e.g. Fly.io's fdaa::3) must be bracketed, or nginx reads the +# text after the last colon as a port and dies: [emerg] invalid port in resolver. +RESOLVERS=$(awk '/^nameserver/ { print ($2 ~ /:/) ? "[" $2 "]" : $2 }' /etc/resolv.conf | tr '\n' ' ' | sed 's/ *$//') [ -z "$RESOLVERS" ] && RESOLVERS=127.0.0.11 -printf 'resolver %s ipv6=off valid=10s;\n' "$RESOLVERS" > /etc/nginx/conf.d/00-resolver.conf +# No ipv6=off here: IPv6-only upstreams (e.g. Fly.io .flycast) need AAAA answers. +printf 'resolver %s valid=10s;\n' "$RESOLVERS" > /etc/nginx/conf.d/00-resolver.conf # Render the SSRF allowlist into an nginx map for $allow_upstream. # Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the