Configuring Seq HTTPS on Docker with haproxy

[nikimarchin]

Hello,
We want to deploy and use Seq on Docker to collect logs and monitor a number of .Net applications that we have. At the moment we are having problems in configuring Seq to serve on HTTPS. We are using a docker-compose.yml file for the Seq's docker container:

version: '3'
services:
  seq-dev:
    image: datalust/seq:5.1
    container_name: seq-dev
    restart: unless-stopped
    #ports:
    #  - "5341:80"
    #  - "45341:443"
    volumes:
      - ./data:/data
      #- ./itrservices.eu.pem:/data/Certificates/443.pem
    environment:
      ACCEPT_EULA: "Y"
    networks:
      - seq-dev
networks:
  seq-dev:
    driver: bridge
    ipam:
        driver: default
        config:
        - subnet: 172.16.***.0/24

For a reverse proxy we are using Haproxy that handles incoming requests and redirects traffic to specific containers:

version: '3'
services:    
  haproxy:
    image: haproxy:1.8
    container_name: haproxy
    hostname: haproxy
    restart: always
    volumes:
      - "./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg"
      - "../timeaway/timeaway.eu.pem:/etc/ssl/******.eu.pem"
      - "../keycloak/gtmgroup.bg.pem:/etc/ssl/******.bg.pem"
      - "../seq/itrservices.eu.pem:/etc/ssl/******.eu.pem"
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    networks:
       - signo_signo_tomcat
       - seq_seq-dev
       
       
networks:
  signo_signo_tomcat:
    external: true
  seq_seq-dev:
    external: true

I will also provide the Haproxy configuration file:

.......
.......

frontend stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 30s
    stats auth **************


frontend http-in
    bind *:80
	bind *:443 ssl crt /etc/ssl/timeaway.eu.pem crt /etc/ssl/gtmgroup.bg.pem

	http-request redirect scheme https unless { ssl_fc }
        #default_backend timeaway_itr
	http-request set-header X-Forwarded-Proto https if { ssl_fc }
	http-request set-header X-Forwarded-Proto http if !{ ssl_fc }


#	redirect scheme https code 301 if !{ ssl_fc }

		acl host_signo_tomcat					hdr(host) -i signo.********.bg
		acl host_devlogs						hdr(host) -i devlogs.******.bg
		
		use_backend signo_tomcat				if host_signo_tomcat
		use_backend devlogs						if host_devlogs

		
backend signo_tomcat
		server signo-tomcat signo-tomcat:8080 check init-addr last,libc,none
		
backend devlogs
		server seq-dev seq-dev:80 check init-addr last,libc,none

Our haproxy server redirects the request successfully but it turns out that on seq-dev:80 there is nothing and we get a 503 status code. If we expose the ports in the Seq's docker compose we are able to access Seq on http://devlogs.******.bg:5341 for example and we assume that the container works.

Also in addition should we be seeing the ssl ports (443 and 45341) in the container when we start it?

We are wondering is there something else that we should configure on the Seq's side? There is no example in the documentation for a reverse proxy approach so any help will be appreciated.

Thank you for your time!

[nblumhardt]

Hi Nikolay, thanks for your message.

image: datalust/seq:5.1

This is a very old Seq image; 2024.3 is the current release.

    #ports:
    #  - "5341:80"
    #  - "45341:443"

If you want to access Seq on 80 and 443, try expose, which should make those ports available to services on the same network without binding ports on the host machine:

    expose:
      - "80"
      - "443"

I'm not especially familiar with Docker Compose and the differences between its major versions so you may need to dig around in the Compose docs for this.

To get 443 to be served on the Seq side, you'll need to mount that PEM file into the /data/Certificates directory in the container.

Hope this helps,
Nick