FCan you expand the error you see?
Ehey, i kinda have the same compose setup and also struggle to get the reverse proxy to work, when called, i get a 502 error as Caddy fails to proxy, any ideas what it could be? I followed the guide in the docs but no luck
caddy file:
caddy file:
dev-auth.mydomain.com {
tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/dev-auth.mydomain.com/dev-auth.mydomain.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/dev-auth.mydomain.com/dev-auth.mydomain.com.key
reverse_proxy h2c://zitadel:8089
}dev-auth.mydomain.com {
tls /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/dev-auth.mydomain.com/dev-auth.mydomain.com.crt /data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/dev-auth.mydomain.com/dev-auth.mydomain.com.key
reverse_proxy h2c://zitadel:8089
}zitadel compose
services:
zitadel:
image: 'ghcr.io/zitadel/zitadel:latest'
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode external'
restart: unless-stopped
networks:
- 'infra'
environment:
ZITADEL_DATABASE_POSTGRES_HOST: db
ZITADEL_DATABASE_POSTGRES_PORT: 5432
ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
###
ZITADEL_EXTERNALSECURE: true
ZITADEL_EXTERNALPORT: 443
ZITADEL_TLS_ENABLED: false
ZITADEL_EXTERNALDOMAIN: dev-auth.mydomain.com
ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED: true
###
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: true
healthcheck:
test: ["CMD", "/app/zitadel", "ready"]
interval: '10s'
timeout: '5s'
retries: 5
start_period: '10s'
ports:
- '8089:8080'
depends_on:
db:
condition: 'service_healthy'
db:
restart: 'always'
image: postgres:16-alpine
environment:
PGUSER: postgres
POSTGRES_PASSWORD: postgres
healthcheck:
test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
interval: '10s'
timeout: '30s'
retries: 5
start_period: '20s'
networks:
- 'infra'
volumes:
- 'data:/var/lib/postgresql/data:rw'
networks:
infra:
name: infra
external: true
driver: bridge
volumes:
data:services:
zitadel:
image: 'ghcr.io/zitadel/zitadel:latest'
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode external'
restart: unless-stopped
networks:
- 'infra'
environment:
ZITADEL_DATABASE_POSTGRES_HOST: db
ZITADEL_DATABASE_POSTGRES_PORT: 5432
ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
###
ZITADEL_EXTERNALSECURE: true
ZITADEL_EXTERNALPORT: 443
ZITADEL_TLS_ENABLED: false
ZITADEL_EXTERNALDOMAIN: dev-auth.mydomain.com
ZITADEL_LOGSTORE_ACCESS_STDOUT_ENABLED: true
###
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: true
healthcheck:
test: ["CMD", "/app/zitadel", "ready"]
interval: '10s'
timeout: '5s'
retries: 5
start_period: '10s'
ports:
- '8089:8080'
depends_on:
db:
condition: 'service_healthy'
db:
restart: 'always'
image: postgres:16-alpine
environment:
PGUSER: postgres
POSTGRES_PASSWORD: postgres
healthcheck:
test: ["CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres"]
interval: '10s'
timeout: '30s'
retries: 5
start_period: '20s'
networks:
- 'infra'
volumes:
- 'data:/var/lib/postgresql/data:rw'
networks:
infra:
name: infra
external: true
driver: bridge
volumes:
data:error:
{"level":"error","ts":1738058946.9949577,"logger":"http.log.error","msg":"dial tcp 172.18.0.5:8089: connect: connection refused","request":{"remote_ip":"157.90.15.254","remote_port":"46556","client_ip":"157.90.15.254","proto":"HTTP/1.1","method":"GET","host":"dev-auth.yqapp.net","uri":"/","headers":{"Connection":["close"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3"],"Accept-Language":["en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7"],"Cache-Control":["no-cache"],"Pragma":["no-cache"],"Sec-Fetch-Site":["cross-site"],"Sec-Fetch-User":["?1"],"Referer":["https://www.google.com/"],"Sec-Fetch-Mode":["navigate"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"dev-auth.yqapp.net"}},"duration":0.002731377,"status":502,"err_id":"9i9th0qsq","err_trace":"reverseproxy.statusError (reverseproxy.go:1269)"}{"level":"error","ts":1738058946.9949577,"logger":"http.log.error","msg":"dial tcp 172.18.0.5:8089: connect: connection refused","request":{"remote_ip":"157.90.15.254","remote_port":"46556","client_ip":"157.90.15.254","proto":"HTTP/1.1","method":"GET","host":"dev-auth.yqapp.net","uri":"/","headers":{"Connection":["close"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3"],"Accept-Language":["en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7"],"Cache-Control":["no-cache"],"Pragma":["no-cache"],"Sec-Fetch-Site":["cross-site"],"Sec-Fetch-User":["?1"],"Referer":["https://www.google.com/"],"Sec-Fetch-Mode":["navigate"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"dev-auth.yqapp.net"}},"duration":0.002731377,"status":502,"err_id":"9i9th0qsq","err_trace":"reverseproxy.statusError (reverseproxy.go:1269)"}ok nevermind it was a skill issue on my side, apparently caddy forwards to the inside port of the container, not the exposed outside one 
this is the fixed version
this is the fixed version
reverse_proxy h2c://zitadel:8080reverse_proxy h2c://zitadel:8080