From ae1d9fa4db7dc16b7c341e215f291d113f22db8b Mon Sep 17 00:00:00 2001 From: hsiegeln <37154749+hsiegeln@users.noreply.github.com> Date: Sat, 25 Apr 2026 09:13:39 +0200 Subject: [PATCH] fix(docker): add extra_hosts so Logto can reach itself via public hostname MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Logto validates M2M tokens by fetching its own JWKS from the ENDPOINT URL (e.g. https://app.cameleer.io/oidc/jwks). Behind a Cloudflare tunnel, that hostname resolves to Cloudflare's IP and the container can't route back through the tunnel — the fetch times out (ETIMEDOUT), causing all Management API calls to return 500. Adding extra_hosts maps AUTH_HOST to host-gateway so the request goes to the Docker host, which has Traefik on :443, which routes back to Logto internally. This hairpin works because NODE_TLS_REJECT=0 accepts the self-signed cert. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker-compose.yml | 2 ++ installer/templates/docker-compose.saas.yml | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 25d1757..3be0ba5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -85,6 +85,8 @@ services: SMTP_USER: ${SMTP_USER:-} SMTP_PASS: ${SMTP_PASS:-} SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-noreply@cameleer.io} + extra_hosts: + - "${AUTH_HOST:-localhost}:host-gateway" healthcheck: test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/oidc/.well-known/openid-configuration', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\" && test -f /data/logto-bootstrap.json"] interval: 10s diff --git a/installer/templates/docker-compose.saas.yml b/installer/templates/docker-compose.saas.yml index 239d756..5b95e2b 100644 --- a/installer/templates/docker-compose.saas.yml +++ b/installer/templates/docker-compose.saas.yml @@ -32,6 +32,11 @@ services: SMTP_USER: ${SMTP_USER:-} SMTP_PASS: ${SMTP_PASS:-} SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-noreply@cameleer.io} + extra_hosts: + # Logto validates M2M tokens by fetching its own JWKS from ENDPOINT. + # Route the public hostname back to the Docker host (Traefik on :443) + # so the container can reach itself without going through the tunnel. + - "${AUTH_HOST:-localhost}:host-gateway" healthcheck: test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/oidc/.well-known/openid-configuration', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))\" && test -f /data/logto-bootstrap.json"] interval: 10s