Seafile Server 12.0.4 with SWAG nginx reverse proxy

[JvdMaat]

I am just getting started with seafile and after spending a few hours not being able to get v11 working with my existing SWAG reverse proxy decided to just go straight to 12 since the reverse proxy was pulled out of the base container.

I have a large docker stack, and looking to add seafile to this. However not able to get anywhere and unsure where I can find the logs needed to figure out where to go next.

Here’s what I have in my docker compose:

  seafile:
    image: seafileltd/seafile-mc:${SEAFILE_VERSION}
    container_name: seafile
    restart: unless-stopped
    ports:
      - "8282:80"
    volumes:
      - /opt/seafile/data:/shared   # Required, specifies the path to Seafile data persistent store.
      #- /mnt/seafile/data:/shared   # Required, specifies the path to Seafile data persistent store. Commented out as it's an NFS share with permissions issues for seafile.
    environment:
      #- PUID=${PUID}
      #- PGID=${GUID}
      - TZ=${TZ}
      - DB_HOST=${SEAFILE_MYSQL_DB_HOST}
      - DB_PORT=${SEAFILE_MYSQL_DB_PORT}
      - DB_ROOT_PASSWD=${INIT_SEAFILE_MYSQL_ROOT_PASSWORD}
      - DB_PASSWORD=${SEAFILE_MYSQL_DB_PASSWORD}
      - INIT_SEAFILE_ADMIN_EMAIL=admin@mydomain.com
      - INIT_SEAFILE_ADMIN_PASSWORD=asecret
      - SEAFILE_SERVER_HOSTNAME=seafile.mydomain.com
      - SEAFILE_SERVER_PROTOCOL=http
      - SITE_ROOT=/
      - NON_ROOT=false
      - JWT_PRIVATE_KEY=${SF_JWT_PRIVATE_KEY}
      - ENABLE_SEADOC=false
    depends_on:
      - mariadbsf
      - seafile-memcached

Running just that, I can connect over HTTP on port 8282 and get a login prompt. However entering the admin creds (or anything really, even bad user/pwd gives the same result) goes to URL http ://seafile.mydomain.com:8282/accounts/login/?next=/
But the page says:

Page unavailable

Sorry, but the requested page is unavailable due to a server hiccup.

Our engineers have been notified, so check back later.

I’m not sure why it’s not working. I checked the seafile.nginx.conf inside seafile and it looks ok:

# -*- mode: nginx -*-
# Auto generated at 12/16/2024 11:32:17
server {
listen 80;
server_name seafile.mydomain.com;

    client_max_body_size 10m;

    location / {
        proxy_pass http://127.0.0.1:8000/;

(Version 11 had seafile. example. com in there, which I’m sure did not help)

I also have a SWAG nginx reverse proxy running on seafile. mydomain. com with this in the seafile.subdomain.conf file:

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name seafile.*;
    include /config/nginx/ssl.conf;
    client_max_body_size 0;
    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        set $upstream_app seafile;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
    }
}

But I get a 400 Bad Request on that from nginx.

On the docker side, this is what seafile shows in the logs on startup:

*** Running /etc/my_init.d/01_create_data_links.sh…
*** Booting runit daemon…
*** Runit started as PID 20
*** Running /scripts/enterpoint.sh…
2024-12-16 12:39:10 Nginx ready
2024-12-16 12:39:10 This is an idle script (infinite loop) to keep container running.
/scripts/bootstrap.py:159: SyntaxWarning: invalid escape sequence ‘\ ’
call(’‘‘sed -i -e ‘/def validate_mysql_user_host(self, host)/a \ \ \ \ \ \ \ \ return host’ {}’’’
/scripts/bootstrap.py:162: SyntaxWarning: invalid escape sequence ‘\ ’
call(’‘‘sed -i -e ‘/def validate_mysql_host(self, host)/a \ \ \ \ \ \ \ \ return host’ {}’’’
[2024-12-16 12:39:11] Skip running setup-seafile-mysql.py because there is existing seafile-data folder.
[12/16/2024 12:39:11][upgrade]: The container was recreated, start fix the media symlinks
mv: not replacing ‘/shared/seafile/seahub-data/avatars/default-non-register.jpg’
mv: not replacing ‘/shared/seafile/seahub-data/avatars/default.png’
mv: not replacing ‘/shared/seafile/seahub-data/avatars/groups’
[12/16/2024 12:39:11][upgrade]: Done
Starting seafile server, please wait …
Seafile server started
Done.
Starting seahub at port 8000 …
Seahub is started
Done.

Where do I go from here?

[WhisperWarlord]

What was the problem with the v11 with SWAG I made a documentation to make it work with SWAG for version 12 I did not test because I am waiting for the stable version.

Here is the link to my tutorial for v11 with SWAG:

Deploying Seafile CE 11 with Docker and SWAG as a Reverse Proxy

After long days and countless hours of effort, I have finally found a configuration that allows Seafile to function seamlessly behind SWAG (Secure Web Application Gateway) as a reverse proxy. This guide is a message to the open-source community, sharing the fruits of my labor to help others achieve the same success. Environment Information Operating System: Ubuntu 24.04.1 LTS Docker Version: 27.3.1, build ce12230 Seafile Community Edition : 11 SWAG Network Name: swag_default Seafile Working Di…

[WhisperWarlord]

I’ve reviewed your setup in more detail, and I must point out that your current approach is not the recommended best practice for using Seafile with SWAG. Exposing a Docker container port directly is not ideal when working with SWAG. While it’s possible, it’s far from optimal.

The best practice is to connect your Seafile stack with your SWAG stack as described in my tutorial. To help you implement this correctly, here’s the proper way to set it up:

  seafile:
    image: seafileltd/seafile-mc:11.0-latest
    container_name: ${APP_NAME}
    restart: unless-stopped
    volumes:
      - ${SEAFILE_DATA_DIR}:/shared
    environment:
      - DB_HOST=${DB_HOST}
      - DB_ROOT_PASSWD=${MYSQL_ROOT_PASSWORD}
      - TIME_ZONE=${TIMEZONE}
      - SEAFILE_ADMIN_EMAIL=${SEAFILE_ADMIN_EMAIL}
      - SEAFILE_ADMIN_PASSWORD=${SEAFILE_ADMIN_PASSWORD}
      - SEAFILE_SERVER_HOSTNAME=${SEAFILE_SERVER_HOSTNAME}
      - SEAFILE_SERVER_LETSENCRYPT=${SEAFILE_LETSENCRYPT}
      - FORCE_HTTPS_IN_CONF=${FORCE_HTTPS}
    depends_on:
      - db
      - memcached
    networks:
      - seafile-net
      - swag_default

networks:
  seafile-net:
    driver: bridge
  swag_default:
    external: true

This configuration connects the Seafile stack to SWAG’s network, assuming SWAG’s network is named swag_default.

In your current setup, which is not recommended, you’d need to configure SWAG like this:

set $upstream_app 1.2.3.4;
set $upstream_port 8282;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;

1.2.3.4 is your public ip
8282 is the port you show in your docker compose

However, if you properly connect your Seafile stack with SWAG, you should use this configuration instead:

set $upstream_app seafile;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;

This assumes your Docker container is named “seafile” and uses the default port 80. This method keeps the reverse proxy within your infrastructure, avoiding external requests to your public IP. It also eliminates the need to expose an external port in your Docker Compose file:

ports:
  - "8282:80"

---

Note

The default docker compose by Seafile is already setup for this:

container_name: seafile

---

Regarding the error you’re encountering after logging in with the URL http://seafile.mydomain.com:8282/accounts/login/?next=/, I believe this is due to incorrect configuration. You should set up your configuration to use http://seafile.mydomain.com instead of http://seafile.mydomain.com:8282.

While it’s possible to modify the seahub_settings.py file to accommodate this, it’s not recommended and considered poor practice.

To verify if your two stacks are communicating properly, you can perform a simple ping test using the container name from either of the two containers.

NOTE:

And I made it clear in my guide not to put include /config/nginx/proxy.conf; in the swag configuration because it causes errors. I’ve updated my answer on my tutorial with a simple configuration and another advanced one.