Can't access application

[insaneness]

Hello,
I'm trying to dockerise an existing symfony application, without success yet.
Here are the edited for my needs files :

Dockerfile

#syntax=docker/dockerfile:1

# Versions
FROM dunglas/frankenphp:1-php8.3 AS frankenphp_upstream

# The different stages of this Dockerfile are meant to be built into separate images
# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
# https://docs.docker.com/compose/compose-file/#target


# Base FrankenPHP image
FROM frankenphp_upstream AS frankenphp_base

WORKDIR /app

VOLUME /app/var/

# persistent / runtime deps
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
	acl \
	file \
	gettext \
	git \
    libnss3-tools \
	&& rm -rf /var/lib/apt/lists/*

RUN set -eux; \
	install-php-extensions \
		@composer \
		apcu \
		intl \
		opcache \
		zip \
        memcached \
        amqp \
        gd \
        exif \
        gmp \
        pdo_mysql \
	;

# https://getcomposer.org/doc/03-cli.md#composer-allow-superuser
ENV COMPOSER_ALLOW_SUPERUSER=1

ENV PHP_INI_SCAN_DIR=":$PHP_INI_DIR/app.conf.d"

###> recipes ###
###< recipes ###

COPY --link frankenphp/conf.d/10-app.ini $PHP_INI_DIR/app.conf.d/
COPY --link --chmod=755 frankenphp/docker-entrypoint.sh /usr/local/bin/docker-entrypoint
COPY --link frankenphp/Caddyfile /etc/caddy/Caddyfile

ENTRYPOINT ["docker-entrypoint"]

HEALTHCHECK --start-period=60s CMD curl -f http://localhost:2019/metrics || exit 1

CMD [ "frankenphp", "run", "--config", "/etc/caddy/Caddyfile" ]

# Dev FrankenPHP image
FROM frankenphp_base AS frankenphp_dev

ENV APP_ENV=dev XDEBUG_MODE=off

RUN mv "$PHP_INI_DIR/php.ini-development" "$PHP_INI_DIR/php.ini"

RUN set -eux; \
	install-php-extensions \
		xdebug \
	;

COPY --link frankenphp/conf.d/20-app.dev.ini $PHP_INI_DIR/app.conf.d/

CMD [ "frankenphp", "run", "--config", "/etc/caddy/Caddyfile", "--watch" ]

# Prod FrankenPHP image
FROM frankenphp_base AS frankenphp_prod

ENV APP_ENV=prod
ENV FRANKENPHP_CONFIG="import worker.Caddyfile"

RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"

COPY --link frankenphp/conf.d/20-app.prod.ini $PHP_INI_DIR/app.conf.d/
COPY --link frankenphp/worker.Caddyfile /etc/caddy/worker.Caddyfile

# prevent the reinstallation of vendors at every changes in the source code
COPY --link composer.* symfony.* ./
RUN set -eux; \
	composer install --no-cache --prefer-dist --no-dev --no-autoloader --no-scripts --no-progress

# copy sources
COPY --link . ./
RUN rm -Rf frankenphp/

RUN set -eux; \
	mkdir -p var/cache var/log; \
	composer dump-autoload --classmap-authoritative --no-dev; \
	composer dump-env prod; \
	composer run-script --no-dev post-install-cmd; \
	chmod +x bin/console; sync;

compose.yaml

services:
  php:
    image: ${IMAGES_PREFIX:-}app-php
    restart: unless-stopped
    depends_on:
      - memcached
      - database
    environment:
      SERVER_NAME: ${SERVER_NAME:-localhost}, php:80
      MERCURE_PUBLISHER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      MERCURE_SUBSCRIBER_JWT_KEY: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      # Run "composer require symfony/orm-pack" to install and configure Doctrine ORM
      DATABASE_URL: mysql://${MYSQL_USER:-app}:${MYSQL_PASSWORD:-root_psw}@database:3306/${MYSQL_DATABASE:-app}?serverVersion=${MYSQL_VERSION:-8}&charset=${MYSQL_CHARSET:-utf8mb4}
      DB_DATABASE: app
      DB_USERNAME: app
      DB_PASSWORD: root_psw
      DB_HOST: database
      # Run "composer require symfony/mercure-bundle" to install and configure the Mercure integration
      MERCURE_URL: ${CADDY_MERCURE_URL:-http://php/.well-known/mercure}
      MERCURE_PUBLIC_URL: ${CADDY_MERCURE_PUBLIC_URL:-https://${SERVER_NAME:-localhost}:${HTTPS_PORT:-443}/.well-known/mercure}
      MERCURE_JWT_SECRET: ${CADDY_MERCURE_JWT_SECRET:-!ChangeThisMercureHubJWTSecretKey!}
      # Memcached
      MEMCACHED_ENDPOINT: memcached:11211
      MEMCACHED_USERNAME: ""
      MEMCACHED_PASSWORD: ""
    volumes:
      - caddy_data:/data
      - caddy_config:/config
    ports:
      # HTTP
      - target: 80
        published: ${HTTP_PORT:-80}
        protocol: tcp
      # HTTPS
      - target: 443
        published: ${HTTPS_PORT:-443}
        protocol: tcp
      # HTTP/3
      - target: 443
        published: ${HTTP3_PORT:-443}
        protocol: udp
      - "2019:2019"

# Mercure is installed as a Caddy module, prevent the Flex recipe from installing another service
###> symfony/mercure-bundle ###
###< symfony/mercure-bundle ###

  database:
    image: mysql:${MYSQL_VERSION:-8}
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE:-app}
      # You should definitely change the password in production
      MYSQL_RANDOM_ROOT_PASSWORD: "true"
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-root_psw}
      MYSQL_USER: ${MYSQL_USER:-app}
    healthcheck:
      test: [ "CMD", "mysqladmin" ,"ping", "-h", "localhost" ]
      timeout: 5s
      retries: 5
      start_period: 60s
    volumes:
      - database_data:/var/lib/mysql:rw
    ports:
      - "3306:3306"

  memcached:
    image: memcached:latest
    container_name: memcached
    restart: always
    ports:
      - "11211:11211"
    command: ["memcached", "-m", "64"]

volumes:
  caddy_data:
  caddy_config:
###> symfony/mercure-bundle ###
###< symfony/mercure-bundle ###
###> doctrine/doctrine-bundle ###
  database_data:
###< doctrine/doctrine-bundle ###

Caddyfile

{
	{$CADDY_GLOBAL_OPTIONS}

	frankenphp {
		{$FRANKENPHP_CONFIG}
	}
}

{$CADDY_EXTRA_CONFIG}

{$SERVER_NAME:localhost} {
	log {
		{$CADDY_SERVER_LOG_OPTIONS}
		# Redact the authorization query parameter that can be set by Mercure

		output file /var/log/caddy/access.log
		#format json

		format filter {
			request>uri query {
				replace authorization REDACTED
			}
		}
	}

	root /app/public
	encode zstd br gzip
	tls internal

	mercure {
		# Transport to use (default to Bolt)
		transport {$MERCURE_TRANSPORT_URL:bolt /data/mercure.db}
		# Publisher JWT key
		publisher_jwt {env.MERCURE_PUBLISHER_JWT_KEY} {env.MERCURE_PUBLISHER_JWT_ALG}
		# Subscriber JWT key
		subscriber_jwt {env.MERCURE_SUBSCRIBER_JWT_KEY} {env.MERCURE_SUBSCRIBER_JWT_ALG}
		# Allow anonymous subscribers (double-check that it's what you want)
		anonymous
		# Enable the subscription API (double-check that it's what you want)
		subscriptions
		# Extra directives
		{$MERCURE_EXTRA_DIRECTIVES}
	}

	vulcain

	{$CADDY_SERVER_EXTRA_DIRECTIVES}

	# Disable Topics tracking if not enabled explicitly: https://github.com/jkarlin/topics
	header ?Permissions-Policy "browsing-topics=()"

	@phpRoute {
		not path /.well-known/mercure*
		not file {path}
	}
	rewrite @phpRoute index.php

	@frontController path index.php
	php @frontController

	file_server {
        hide *.php
    }
}

# Explicit metrics endpoint for health check
:2019 {
    metrics
}

Exposed port 2019 here to handle heathcheck done in Dockerfile

Other files remain unchanged

The Caddy server seems up, i can access localhost:2019 that displays some configs and metrics

If i try to access http://localhost, i am redirected to https://localhost which is the wanted behavior. I accept the browser alert and access unsafe https anyway, but there it loads infinitely.

I run this docker command to launch containers :
SERVER_NAME=localhost \ APP_SECRET=ChangeMe \ CADDY_MERCURE_JWT_SECRET=ChangeThisMercureHubJWTSecretKey \ docker compose -f compose.yaml -f compose.prod.yaml up -d --wait

I must have missed something but can't figure out what... Any help will be appreciated

[maxhelias]

Hello,
It's unreadable, please format it correctly or create a reproducer.
Otherwise, “localhost” as server name, I'm not sure it's authorized by let's encrypt which provides the ssl certificate.

[insaneness]

You're right, i re formatted the files. Sorry about that.
I tried with another server name than 'localhost' but result is the same

[maxhelias]

I don't know what you missing. You'd have to isolate the problem if it's the caddy or symfony configuration and tell us.

I don't think that's the issue but, tls internal in the Caddyfile isn't not necessary, caddy's default TLS settings are secure.

[insaneness]

Thank you for you reply.
I think the problem is with the caddy configuration since symfony commands (cache:clear or other commands) run correctly inside the container.
I added tls internal to avoid an error message i saw in the caddy logs. I can see that certificate for my server name is correctly generated in those same logs.
Once i try to access server name, i am redirected to https wich is fine, but then it hangs forever. No other logs