配置NGINX反向代理Docker中GitLab/NextCloud遇502错误求助

I’ve dealt with this exact frustration before—when your containers work fine directly but Nginx throws a 502, it almost always boils down to network connectivity or misconfigured proxy settings. Let’s break down the most likely fixes step by step:

1. Fix Docker Network Connectivity (The #1 Culprit) #

Docker containers don’t automatically talk to each other using your VPS’s public IP—you need to use their internal network. Here’s what to check:

• Ensure all containers are on the same Docker network: By default, containers use the bridge network, but using a custom network is more reliable. Create one if you haven’t:

  docker network create nginx-proxy-network
  

  Then connect your Nginx, GitLab, and NextCloud containers to it:

  docker network connect nginx-proxy-network nginx-container
  docker network connect nginx-proxy-network gitlab-container
  docker network connect nginx-proxy-network nextcloud-container
  

• Replace the public IP in your upstream with the container name: Instead of server x.x.x.x:3000, use your GitLab container’s name (check with docker ps). Your upstream block should look like this:

  upstream gitlab {
      server gitlab-container:3000; # Or whatever your GitLab container's internal port is—see next point!
  }
  

2. Double-Check Container Port Mapping #

A common mistake is confusing host ports with container internal ports. When you run docker run -p 3000:80 gitlab, the 3000 is the port on your VPS, and 80 is the port inside the GitLab container. If Nginx is talking directly to the GitLab container (via Docker network), you need to use the internal port (e.g., 80), not the host port 3000.

Verify your container’s internal port with:

docker ps | grep gitlab

Look for output like 0.0.0.0:3000->80/tcp—the number after -> is the internal port. Update your upstream to use that port instead of the host port.

3. Add Critical Proxy Headers #

GitLab and NextCloud rely on proper HTTP headers to handle proxy requests. Missing these can cause the app to reject the request, leading to a 502. Update your server block to include these:

server {
    listen 80;
    server_name gitlab.domain.com;

    location / {
        proxy_pass http://gitlab;
        # Required headers for proxying to web apps
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

4. Check Firewall/SELinux Restrictions #

If you’re still using your VPS’s public IP in the upstream (not recommended), make sure your firewall (ufw, firewalld, etc.) allows incoming traffic to ports 3000/3100 from the Nginx container’s internal IP.

For SELinux users (common on RHEL/CentOS), it might block Nginx’s proxy requests. Test this temporarily by running:

setenforce 0

If the 502 goes away, you’ll need to add a SELinux rule to allow Nginx to proxy:

setsebool -P httpd_can_network_connect 1

5. Reload Nginx Configuration #

Don’t forget to apply your changes! Either reload the Nginx config inside the container:

docker exec nginx-container nginx -s reload

Or restart the container if reload doesn’t work:

docker restart nginx-container

After trying these steps, test your domain again—this should resolve the 502 error.

内容的提问来源于stack exchange，提问作者Intersect