I have three local domains for my Nginx Proxy Manager running on a VPS, for my self-hosted Nextcloud and my Proxmox-WebGUI both running on my local Homeserver. They follow the scheme service.dataprolet.duckdns.org.
Now I use Uptime-Kuma to monitor my services including the three domains and for some reason those three domains constantly time out after 48 seconds. I already set up the retries to 3, but to no avail.
I also use Pi-hole and Unbound and thought, that might be an issue, but testing my DNS using dig, mtr, traceroute, nslookup and host all returned normal values and no errors.
Does anybody have any idea what could cause this? I’m kind of clueless at this point. Thanks in advance!
EDIT: I don’t get it.
I can’t ping duckdns.org on my home server. I only get 100 % packet loss. I can open the website in my browser though. I also can’t ping www.duckdns.org, which redirects to appservers-duckdns-prod-1630339571.ca-central-1.elb.amazonaws.com. Also gets 100 % packet loss.
I’ve added duckdns.org to my Uptime-Kuma and it got flagged as down because timeout of 48000ms exceeded but my other domains using DuckDNS were unaffected.
I added another local domain to Uptime-Kuma to see the differences of having ignoring SSL errors tuned on or off and the number of retries:
Nextcloud
Ignore SSL error = false
Retries = 2
Proxmox
Ignore SSL error = true
Retries = 1
VPS
Ignore SSL error = false
Retries = 1
Homepage
Ignore SSL error = true
Retries = 2
Throughout the day only the newly added Homepage got flagged as down for 5 times. The 3 others were up the whole time.
What do you mean by tracker? I’m monitoring local domains, that point to local services and their respective web interfaces like Proxmox or Nextcloud. The local domains have a wildcard SSL certificate via DuckDNS.
Which one of those. You pick one when adding something new to monitor. Actually just send a screenshot of the uptime-kuma settings of one of the services that are giving you problems.
Well you keep saying monitor a domain, in that case a DNS monitor would make more sense than HTTP(s) since that’s for monitoring a service. That’s why I was a bit confused. But yeah try to enable the ignore SSL option and see if that changes anything. You didn’t include a screenshot of the settings which makes a bit difficult to diagnose the problem so I will leave it here.
seems like your DNS works fine but your certs doesn’t. Are you able to connect to your services on your browser normally, with SSL?
Edit: please also try curl -4 and curl -6 to your services from within the uptime kuma container to see if theres an ipv4/v6 issue
Another edit: seems like there is a dataprolet URL in your post and a datenprolet URL in your comments. It might just be a typo so also check that too.
Yeah, it works fine through my browser. Sometimes the websites load a little longer. I feel like it’s an issue with DuckDNS as it’s seemingly random when it works and when not.
IPv6 doesn’t work:
docker exec -it Uptime-Kuma curl -6 proxmox.datenprolet.duckdns.org
curl: (6) Could not resolve host: proxmox.datenprolet.duckdns.org
Besides that the issue has disappeares since last night. I automatically restart all containers at night and moved from uptime-kuma:1 to uptime-kuma:latest. That shouldn’t make a difference, but maybe it did?
And it’s not a typo in my config, but in my post. But good catch. ;)
Then I guess you only define an A record in the DuckDNS panel. That’s fine.
A while back I ran a somewhat similar Wireguard tunnel and can’t connect. Turns out some MTU settings were lower than the docker’s MTU and that breaks big packets like SSL handshakes. Restarting makes it work fine until things start congesting again.
Suffice to say this would be something I’ll look at if the SSL errors reoccurs
So the MTU of Tailscale is actually 1280, but is the connection even going through the VPN or rather through my VPS, when Uptime-Kuma is trying to connect to my local domain?
Thanks, since I access my home network and server through the public IPv4 of a VPS via Tailscale this could actually be the issue. I’ll look into it, when I find the time.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
If you ping the domain from inside the container, does it succeed?
Yep
Sorry I’m a bit confused. What kind of tracker are you using in uptime-kuma and what address is it pointing to?
What do you mean by tracker? I’m monitoring local domains, that point to local services and their respective web interfaces like Proxmox or Nextcloud. The local domains have a wildcard SSL certificate via DuckDNS.
It’s HTTPS, what else should it be, when I monitor a domain?
Well you keep saying monitor a domain, in that case a DNS monitor would make more sense than HTTP(s) since that’s for monitoring a service. That’s why I was a bit confused. But yeah try to enable the ignore SSL option and see if that changes anything. You didn’t include a screenshot of the settings which makes a bit difficult to diagnose the problem so I will leave it here.
Not sure how this helps, but here you go.
seems like your DNS works fine but your certs doesn’t. Are you able to connect to your services on your browser normally, with SSL?
Edit: please also try
curl -4andcurl -6to your services from within the uptime kuma container to see if theres an ipv4/v6 issueAnother edit: seems like there is a
dataproletURL in your post and adatenproletURL in your comments. It might just be a typo so also check that too.Yeah, it works fine through my browser. Sometimes the websites load a little longer. I feel like it’s an issue with DuckDNS as it’s seemingly random when it works and when not.
IPv6 doesn’t work:
Besides that the issue has disappeares since last night. I automatically restart all containers at night and moved from uptime-kuma:1 to uptime-kuma:latest. That shouldn’t make a difference, but maybe it did?
And it’s not a typo in my config, but in my post. But good catch. ;)
Then I guess you only define an A record in the DuckDNS panel. That’s fine.
A while back I ran a somewhat similar Wireguard tunnel and can’t connect. Turns out some MTU settings were lower than the docker’s MTU and that breaks big packets like SSL handshakes. Restarting makes it work fine until things start congesting again.
Suffice to say this would be something I’ll look at if the SSL errors reoccurs
So the MTU of Tailscale is actually 1280, but is the connection even going through the VPN or rather through my VPS, when Uptime-Kuma is trying to connect to my local domain?
It shouldn’t go through the VPN although idk how to verify that. Do you still have the timeout errors in your monitors? What do those errors say?
After changing the MTU to 1200 I have no timeouts anymore, but a lot of
read ECONNRESETerrors. -.-I just changed the Docker’s MTU to 1200 and will observe the change.
Thanks, since I access my home network and server through the public IPv4 of a VPS via Tailscale this could actually be the issue. I’ll look into it, when I find the time.