fix(Grafana x nginx): resolved grafana upstream under podman (with sc…

[jacobscuzzi]

Fix: Grafana 502 behind nginx on rootless podman

Problem

The /grafana/ locations use runtime DNS resolution (resolver directive + variable in proxy_pass) so nginx survives a missing grafana container. The resolver was hardcoded to 127.0.0.11 — that's Docker's embedded DNS and doesn't exist under rootless podman (school setup), where aardvark-dns listens on a network-dependent address instead (e.g. 10.89.0.1).

Result: every /grafana/ request returned 502, while frontend/API kept working — their upstream {} blocks resolve at startup via resolv.conf, which is correct under both runtimes.

Fix

New entrypoint drop-in nginx/10-podman-resolver.sh, executed via the official nginx image's /docker-entrypoint.d/ mechanism before nginx starts:

• reads the actual nameserver from the container's resolv.conf
• patches it into all nginx configs
• exits early (no-op) when the nameserver already is 127.0.0.11, i.e. under Docker

The nginx config files themselves are unchanged — 127.0.0.11 stays in as the Docker default. Two lines added to nginx/Dockerfile (COPY + chmod +x).

How to test (podman / school setup)

# .env: HTTPS_PORT=8443 must be set
make fclean && make up
resolver should show the podman dns address (10.89.x.x), not 127.0.0.11
podman exec nginx grep -rn resolver /etc/nginx/
Then open https://localhost:8443/grafana/ and log in with the credentials from .env.
On Docker at home, everything behaves as before (https://localhost/grafana/) — the script detects 127.0.0.11 and does nothing.
Files changed



File
Change




nginx/10-podman-resolver.sh
new — entrypoint drop-in patching the resolver address


nginx/Dockerfile
edit — COPY the script into /docker-entrypoint.d/, make it executable


EXPLAIN_10-podman-resolver.sh.md
new — explanation sheet