Cannot start lemonldap container: increase server_names_bucket_hash_size 32

[radokristof]

Hi all,

I'm receiving the following error when I try to start the container:
nginx: [emerg] could not build server_names_hash, you should increase server_names_hash_bucket_size: 32

As I read, this might mean that the domain names are too long. I have tried to shorten them, same error.
Also I have tried modifying nginx config in place temporarily, then error is gone, but lemonldap shows an error page after startup.

docker-compose.yml:

  lemonldap:
    image: tiredofit/lemonldap:2.0-alpine-latest
    container_name: auth_lemonldap
    volumes:
      - ./data/lemonldap/etc/lemonldap-ng:/etc/lemonldap-ng
      - ./data/lemonldap/var/lib/lemonldap-ng:/var/lib/lemonldap-ng
      - ./data/lemonldap/logs:/www/logs
      - ./data/lemonldap/assets/custom:/assets/custom
    labels:
      caddy: "*.sso.example.com, sso.example.com"
      caddy.reverse_proxy: "{{ upstreams 80 }}"
      caddy.tls.dns:
    networks:
      - default
      - caddy
    environment:
      - TIMEZONE=Europe/Budapest
      - CONTAINER_NAME=auth_lemonldap
      - SETUP_TYPE=AUTO
      - API_HOSTNAME=api.manager.sso.example.com
      - MANAGER_HOSTNAME=manager.sso.example.com
      - PORTAL_HOSTNAME=sso.example.com
      - HANDLER_HOSTNAME=handler.sso.example.com
      - LOG_TYPE=FILE
      - LOG_LEVEL=debug
      - NGINX_SET_REAL_IP_FROM=192.168.0.0/16
    restart: always
    depends_on:
      - openldap

[tiredofit]

Interesting you are seeing these errors.
I've just released 2.0.62 which contains some upstream updates from the http://github.com/tiredofit/docker-nginx repository. An environment variable can now be set for NGINX_SERVER_NAMES_HASH_BUCKET_SIZE to something higher than 32 if you encounter these errors.

[radokristof]

@tiredofit Thank you for your response. I have tried 2.0.62 and also latest as I saw that they are different (at least that's what Docker Hub says), I have configured NGINX_SERVER_NAMES_HASH_BUCKET_SIZE=64 as it is recommended to increase by doubling this parameter.
However the message is the same nginx: [emerg] could not build server_names_hash, you should increase server_names_hash_bucket_size: 32 and it seems that in nginx.conf this setting is not replicated.

daemon off;

user llng llng;
worker_processes auto;
worker_rlimit_nofile 100000;
pid /var/run/nginx.pid;

events {
    use epoll;
    worker_connections 1024;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    client_body_timeout 60;
    send_timeout 60;
    reset_timedout_connection on;

    keepalive_timeout  75;
    keepalive_requests 100000;

    client_max_body_size 2G;
    client_body_buffer_size 16k;

    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 32k;

    server_tokens off;
    more_clear_headers Server;

    include /etc/nginx/snippets/logging.conf;
    include /etc/nginx/snippets/reverse_proxy.conf;
    include /etc/nginx/snippets/open_file_cache.conf;
    include /etc/nginx/snippets/compression_gzip.conf;
    include /etc/nginx/snippets/compression_brotli.conf;
    include /etc/nginx/snippets/monitoring.conf;

    # Do not delete - Upstream Configuration

    include /etc/nginx/sites.enabled/*.conf;
    #include /etc/nginx/templates/maintenance.template;
}

[tiredofit]

Interesting, the entry should be just above the server_tokens off; statement. I'll diagnose and push a new build tomorrow - perhaps CI has gone on the fritz.

[radokristof]

Thank you :)

[tiredofit]

Alright, that was pretty messy and as it turns out, I'm not building the Nginx Alpine 3.17 variants for a couple months now. Makes total sense. Have restarted the builds of it and we have a new :latest and 2.0.62. They will be different hashes sadly as Github Actions is a bit wonky.

Should be finished within the next ~2 hours.

[radokristof]

Thank you for your help, error is now gone. I don't know if it is related to this or not, but portal still does not show up. I just get an error message:

Initialization failed! Enable debug logs, reload your web server and catch main error...

Logs seems to be not that helpful also. It just contains the same error. I did find some interesting log about nginx, that access is blocked by a rule. Do I need to set anything also to get this work?

[radokristof]

Logs:

2024-01-30 15:33:55 | LLNG[2595]: [error] Underlying object can't load conf (Lemonldap::NG::Portal::Main->reloadConf)
2024-01-30 15:33:55 | LLNG[2595]: [error] Initialization failed: Unable to protect this server ()
2024-01-30 15:33:55 | LLNG[2595]: [error] Initialization failed! Enable debug logs, reload your web server and catch main error... 

[radokristof]

@tiredofit Earlier versions (i checked 2.0.52 and 2.0.53) works correctly.

What should I check in this case, why the newer versions do not work for me?