Could not check origin for Phoenix.Socket transport

[LucasZapico]

@ruslandoga Opening a new discussion as per your comment

Story

Just dumping information here as I'm not sure where I messed up the configuration. I have my domain managed by cloudflare with a zero trust tunnel pointed to nginx proxy manger with web sockets enabled and ssl validated with letsencrypt. I am able to get to the dashboard when I point the proxy to https://192.168.1.444:5479. But the data from the site isn't showing up which I believe has to do with the error in the docker logs.

Could not check origin for Phoenix.Socket transport. 

Orgin of request: https://192.168.1.444:5479

This happens when you are attempting a socket connection to a different host than the one configured in you config files. For example, in development the host is configured to "localhost" but you may be trying to access it from "127.0.0.1". To fix this issue, you may either: 

1. update [url: [host: ...]} to your actual host in the config file for your current environment (recommended) 
2. path the :check_origin option when configuring your endpoint or when configuring the transport in your UserSocket module, explicitly outlining which origins are allowed: 

check_origin: ["https://example.com", "//another.com:888", "other.com"]

Architecture

• cloudflare zero trust
• nginx proxy manger
• ubuntu server

Configs

Using the base community compose with docker override as per docs.

BASE_URL=https://analytics.foo.com
SECRET_KEY_BASE="11pldLJ1kxqalr1ahucy/+sx1poD0iuyqhwxT32pXsw=
" # generated for discussion
HTTP_PORT=80
HTTPS_PORT=443

services:
  plausible:
      ports:
      - 5478:${HTTP_PORT}
      - 5479:${HTTPS_PORT}

services:
  plausible_db:
    image: postgres:16-alpine
    restart: always
    volumes:
      - db-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postgres
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      start_period: 1m
        # networks:
        #- caddy

  plausible_events_db:
    image: clickhouse/clickhouse-server:24.3.3.102-alpine
    restart: always
    volumes:
      - event-data:/var/lib/clickhouse
      - event-logs:/var/log/clickhouse-server
      - ./clickhouse/logs.xml:/etc/clickhouse-server/config.d/logs.xml:ro
      # This makes ClickHouse bind to IPv4 only, since Docker doesn't enable IPv6 in bridge networks by default.
      # Fixes "Listen [::]:9000 failed: Address family for hostname not supported" warnings.
      - ./clickhouse/ipv4-only.xml:/etc/clickhouse-server/config.d/ipv4-only.xml:ro
      # This makes ClickHouse consume less resources, which is useful for small setups.
      # https://clickhouse.com/docs/en/operations/tips#using-less-than-16gb-of-ram
      - ./clickhouse/low-resources.xml:/etc/clickhouse-server/config.d/low-resources.xml:ro
    ulimits:
      nofile:
        soft: 262144
        hard: 262144
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 -O - http://127.0.0.1:8123/ping || exit 1"]
      start_period: 1m
        #networks:
        #- caddy

  plausible:
    image: ghcr.io/plausible/community-edition:v2.1.4
    restart: always
    command: sh -c "/entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run"
    depends_on:
      plausible_db:
        condition: service_healthy
      plausible_events_db:
        condition: service_healthy
    volumes:
      - plausible-data:/var/lib/plausible
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    environment:
      - ERL_FLAGS=+sbwt none +sbwtdcpu none +sbwtdio none
      - TMPDIR=/var/lib/plausible/tmp
      # required: https://github.com/plausible/community-edition/wiki/configuration#required
      - BASE_URL=${BASE_URL}
      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
      # optional: https://github.com/plausible/community-edition/wiki/configuration#optional
      # registration: https://github.com/plausible/community-edition/wiki/configuration#registration
      - TOTP_VAULT_KEY
      - DISABLE_REGISTRATION
      - ENABLE_EMAIL_VERIFICATION
      # web: https://github.com/plausible/community-edition/wiki/configuration#web
      - HTTP_PORT
      - HTTPS_PORT
      # databases: https://github.com/plausible/community-edition/wiki/configuration#database
      - DATABASE_URL
      - CLICKHOUSE_DATABASE_URL
      # Google: https://github.com/plausible/community-edition/wiki/configuration#google
      - GOOGLE_CLIENT_ID
      - GOOGLE_CLIENT_SECRET
      # geolocation: https://github.com/plausible/community-edition/wiki/configuration#ip-geolocation
      - IP_GEOLOCATION_DB
      - GEONAMES_SOURCE_FILE
      - MAXMIND_LICENSE_KEY
      - MAXMIND_EDITION
      # email: https://github.com/plausible/community-edition/wiki/configuration#email
      - MAILER_ADAPTER
      - MAILER_EMAIL
      - MAILER_NAME
      - SMTP_HOST_ADDR
      - SMTP_HOST_PORT
      - SMTP_USER_NAME
      - SMTP_USER_PWD
      - SMTP_HOST_SSL_ENABLED
      - POSTMARK_API_KEY
      - MAILGUN_API_KEY
      - MAILGUN_DOMAIN
      - MAILGUN_BASE_URI
      - MANDRILL_API_KEY
      - SENDGRID_API_KEY
        #networks:
        #- caddy
     
volumes:
  db-data:
  event-data:
  event-logs:
  plausible-data:

Conclusion

Thank you for you help. Also appropriate the opportunity to see where my understanding is lacking on how all this is supported to lock in.

[ruslandoga]

👋 @LucasZapico

If you access your dashboard at https://192.168.1.444:5479 then your BASE_URL needs to be https://192.168.1.444:5479 and not https://analytics.foo.com

[LucasZapico]

Doesn't that throw an error on build because Plausible can't get a valid cert for an IP? Also I'll rebuild my container with you suggestion and see if the issue is resolved. Also noticed that the dashboard is not receiving data. IDK. Thank you for the response

[LucasZapico]

Just tried it and it's gives the expected error;

Runtime terminating during boot ({#message=><<"Connot generate TLS certificates for IP address "192.168.144"">....elixir error

[ruslandoga]

That's right. You would need to use something else to generate the certificates. The default setup doesn't assume using Zero Trust tunnels so you need to find your own workarounds to make it work.

[LucasZapico]

Hey just wanted to circle on this. It is my understanding that using proxies(zero trust) should have no effect on this. The setup is the same as pointing a domain to an IP on Linode, Hetzner, etc. The problems would persist as the app(Plausible) is using :. I'm unclear on how you are supposed to handle this.

Thank you

[ruslandoga]

I suggest to keep things simple and use the default setup, i.e. a FQDN to reach the dashboards instead of Zero Trust tunnels.