API HTTPs.

[sledzik1984]

I am trying to deploy Inbox Zero within Portainer Stack and have problems with that...

App starts, I can login to interface using public domain but docker logs show:

No pending migrations to apply.
✅ Database migrations completed successfully
✅ Configuration complete. Starting server...
▲ Next.js 15.5.6

• Local: http://1fb97fca97fc:3000
• Network: http://1fb97fca97fc:3000
  ✓ Starting...
  ✓ Ready in 1434ms
  [setLastEmailAccount]: Calling action {
  "requestId": "a0b9e47f-4ab2-41ff-a72a-c6162eba5990",
  "userId": "cmiep6bwe000101mz3dkj6ij7",
  "userEmail": "piotr.gorski@domain.pl"
  }
  [user/rules]: Unhandled error {
  "error": "fetch failed"
  } {
  "requestId": "90e79a9c-982a-4913-b5c8-cc15b0ed17d3",
  "url": "https://1fb97fca97fc:3000/api/user/rules"
  }

My compose file looks like that:

`name: inbox-zero-services
services:
db:
image: postgres:16
restart: always
container_name: inbox-zero
environment:
- POSTGRES_USER=${POSTGRES_USER:-postgres}
- POSTGRES_DB=${POSTGRES_DB:-inboxzero}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-password}
healthcheck:
test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-postgres}']
interval: 10s
timeout: 5s
retries: 5
volumes:
- /opt/inbox-zero/postgres:/var/lib/postgresql/data/
ports:
- 5432:5432
networks:
- inbox-zero-network
#Wyłączamy profile
#profiles:
# - local-db
# - all

redis:
image: redis:7
ports:
- 6380:6379
volumes:
- /opt/inbox-zero/redis:/data
networks:
- inbox-zero-network
restart: always
#profiles:
# - local-redis
# - all

serverless-redis-http:
ports:
- "${REDIS_HTTP_PORT:-8079}:80"
image: hiett/serverless-redis-http:latest
env_file:
- stack.env
environment:
SRH_MODE: env
SRH_TOKEN: ${UPSTASH_REDIS_TOKEN}
SRH_CONNECTION_STRING: "redis://redis:6379" # Using redis hostname since they're in the same Docker network.
networks:
- inbox-zero-network
restart: always
#profiles:
# - local-redis
# - all

web:
image: ghcr.io/elie222/inbox-zero:latest
pull_policy: if_not_present
# The pre-built image will be used by default. For local development,
# use 'docker compose build web' to build from source instead.
#build:
# context: .
# dockerfile: ./docker/Dockerfile.prod
env_file:
- stack.env
depends_on:
db:
condition: service_healthy
required: false
redis:
condition: service_started
required: false
ports:
- 3015:3000
networks:
- inbox-zero-network
environment:
NEXT_PUBLIC_BASE_URL: ${NEXT_PUBLIC_BASE_URL:-http://localhost:3000}

  #DATABASE_URL: ${DATABASE_URL:-postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-inboxzero}?schema=public}
  #DIRECT_URL: ${DIRECT_URL:-postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-inboxzero}?schema=public}
  #UPSTASH_REDIS_URL: ${UPSTASH_REDIS_URL:-http://serverless-redis-http:80}
  #UPSTASH_REDIS_TOKEN: "${UPSTASH_REDIS_TOKEN}"
restart: always

volumes:
database-data:

networks:
inbox-zero-network:

and stack.env:

DATABASE_URL="postgresql://postgres:password@db:5432/inboxzero?schema=public"
DIRECT_URL="postgresql://postgres:password@db:5432/inboxzero?schema=public"
NEXT_PUBLIC_BASE_URL=https://inboxzero.domain.pl
AUTH_SECRET=150a5f2f45fdd08b9c8e196121d79b3d1f7a01facd2858635f7a6c49b3c88c22
EMAIL_ENCRYPT_SECRET=200e4a538f5fabc4a3e2b55305202c1a3d1db111fc98f741d480c6878cfcbdc8
EMAIL_ENCRYPT_SALT=c3ceb1bd0d3202fc5d59adab2f869f99
GOOGLE_CLIENT_ID=237229878744-ce4glfkf95faa2s6r0h72fq3vh6mro17.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=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
GOOGLE_PUBSUB_TOPIC_NAME="projects/abc/topics/xyz"
GOOGLE_PUBSUB_VERIFICATION_TOKEN=ffe77d2e17877b2181a673452cace0cabb87c6daa690670efab7d8b771c0c375
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_WEBHOOK_CLIENT_STATE=
NEXT_PUBLIC_BYPASS_PREMIUM_CHECKS=true
DEFAULT_LLM_PROVIDER=openrouter
DEFAULT_LLM_MODEL=anthropic/claude-sonnet-4.5
ECONOMY_LLM_PROVIDER=openrouter
ECONOMY_LLM_MODEL=anthropic/claude-haiku-4.5
OPENROUTER_API_KEY=
INTERNAL_API_KEY=257ca3c1778d50c25ba0d9c8dfea5275bd5e58a961b7fa149c64ecbcbb5f034b
API_KEY_SALT=2ac0831400261c8dc48bb99339161524dcfc9d93b8a1b10d804b0d142559f544
UPSTASH_REDIS_URL="http://localhost:8079"
UPSTASH_REDIS_TOKEN=4e216b8d87929c16fa3dd3ceac85a15e01e0f1c01d79d62a87762b65c61ef665
REDIS_URL=# used for subscriptions: rediss://:password@host:port
QSTASH_TOKEN=
QSTASH_CURRENT_SIGNING_KEY=
QSTASH_NEXT_SIGNING_KEY=
LOG_ZOD_ERRORS=true
CRON_SECRET=# cron disabled if not set
TINYBIRD_TOKEN=
TINYBIRD_BASE_URL=https://api.us-east.tinybird.co/
TINYBIRD_ENCRYPT_SECRET=df30ee340e1b531ec106c7f8cf011678b03b29b55fdf6a92b7ad16f5b5d1375e # openssl rand -hex 32
TINYBIRD_ENCRYPT_SALT=c41bdee8113cf2f56035290c1dce228f # openssl rand -hex 16
SENTRY_AUTH_TOKEN=
SENTRY_ORGANIZATION=
SENTRY_PROJECT=
NEXT_PUBLIC_SENTRY_DSN=
NEXT_PUBLIC_AXIOM_DATASET=
NEXT_PUBLIC_AXIOM_TOKEN=
RESEND_API_KEY=
LOOPS_API_SECRET=
SERVER_BASE_URL=https://inboxzero.domain.pl
AUTH_TRUST_HOST=true

Any help appriciated :)

When I am in docker exec and I am tring to do
wget -S -O - https://1fb97fca97fc:3000/api/user/rules

There's an error regarding SSL:
Connecting to 1fb97fca97fc:3000 (100.64.14.5:3000)
28FBBF9A9A7F0000:error:0A0000C6:SSL routines:tls_get_more_records:packet length too long:ssl/record/methods/tls_common.c:662:
28FBBF9A9A7F0000:error:0A000139:SSL routines::record layer failure:ssl/record/rec_layer_s3.c:696:
ssl_client: SSL_connect
wget: error getting response: Connection reset by peer

[elie222]

Hey, not sure how you handle the HTTPS with Portainer. This isn't part of Inbox Zero itself, but handled via some sort of reverse proxy like nginx, AWS ALB, or Vercel.

In terms of the error getting the rules I wonder if it's because the Redis isn't set up properly, but I'm not sure.

[sledzik1984]

Portainer brings up all docker containers. Nginx Proxy Manager proxies traffic from external domain to main docker container.

Portainer is just an Web Interface used to manage docker conainers so there is no HTTPS handling.

I don't understand the logic behind that errors:

Web container starts up and says:

Local: http://1fb97fca97fc:3000/ Network: http://1fb97fca97fc:3000/

After that - when I log in to inbox-zero interface it tries to query API via HTTPS but in my opinion port 3000 isn't HTTPS but HTTP so it throws an error:

"error": "fetch failed"
There is no way to mix SSL and non SSL ports...

Why api calls are made via HTTPS? Missconfigured NGINX Proxy Manager?

[elie222]

Local: http://1fb97fca97fc:3000/ Network: http://1fb97fca97fc:3000/

This is good. It's internal Docker Compose.

After that - when I log in to inbox-zero interface it tries to query API via HTTPS but in my opinion port 3000 isn't HTTPS but HTTP so it throws an error: "error": "fetch failed"

fetch failed error may not be related to https/http. Why do you think it is? Is the server logging that error? If yes, it's getting the request and the issue is elsewhere. Are there any other logs that show? Does the landing page load up?

If you had nginx as a reverse proxy, what would happen is that nginx is open on port 443 and then it passes the requests to Next.js on port 3000.

I don't know exactly how Portainer works so it's a little difficult to help. Does Claude/ChatGPT/Cursor have any insights to help you perhaps?

[sledzik1984]

Yeah. Web interface shows, I can log in with my Google Credentials, and after few second,s there's an error in the web interface:

Simultaneously - main docker container throws errors:

I think that error is related to HTTPS because (I think) - API is not using HTTPS/SSL at all so there is no way to request anything from that API using HTTPS.

When I open the web interface using the internal IP:
http://192.168.10.15:3000 it opens without any problems, but if I try to use HTTPS, Chrome throws an error:
ERR_SSL_PROTOCOL_ERROR

So in my opinion - if there is no SSL in main container, all API calls must be made using HTTP. Internal logic should "know" that.
Or there should be an env variable that allows user to force internal API address and port.

Of course - at the moment my problem is elsewhere but I cannot find where.

[sledzik1984]

I've made some changes in my docker compose and everything seems to be working.

I swaped all docker internal hosts to external :

For example :
SRH_CONNECTION_STRING: "redis://192.168.15.130:6379" # Using redis hostname since they're in the same Docker network.

I have no idea why it works. But it works.

[regnighc]

@sledzik1984 sorry if you saw lots of notifications, I deleted some comments I made that were not quite correct.

I believe this issue here is because the UPSTASH_REDIS_URL="http://localhost:8079/" is incorrectly generated by the setup.

localhost will never work from within the web container because the redis http service doesnt run on the web container.

The correct value should be UPSTASH_REDIS_URL=http://serverless-redis-http:80 but your use of the host IP and external port will work also, it just means the traffic has to leave the docker network.