Thank you very much for the time and effort you spent to help me.
The thing is, I had it working using only HTTP, just as you do now with docker telling the container is healthy. I then created my certificates and changed the URIs to fit HTTPS, which resulted in the unhealthy status.
I did try to change the Bind Address to 0.0.0.0:9000 and even the IP as well as the FQDN, but nothing worked.
My docker-compose.yml file looks like this now:
version: '2.1'
services:
{...}
# Graylog: https://hub.docker.com/r/graylog/graylog/
graylog:
image: graylog/graylog:4.2-jre11
volumes:
- graylog_data:/usr/share/graylog/data
- ./certs:/etc/ssl/certs/graylog/
environment:
- TZ=Europe/Zurich
# CHANGE ME (must be at least 16 characters)!
- GRAYLOG_PASSWORD_SECRET=secretpasswordforgraylog
# Password: admin
- GRAYLOG_TIMEZONE=Europe/Zurich
- GRAYLOG_ROOT_TIMEZONE=Europe/Zurich
- GRAYLOG_ROOT_PASSWORD_SHA2=35af527f0ab05beafebc6e341127f338c12edfc7479c07f7869721840665bcee
- GRAYLOG_HTTP_EXTERNAL_URI=https://host.domain.ch:9000/
- GRAYLOG_HTTP_BIND_ADDRESS=0.0.0.0:9000
- GRAYLOG_HTTP_PUBLISH_URI=https://host.domain.ch:9000/
- GRAYLOG_HTTP_ENABLE_CORS=true
- GRAYLOG_HTTP_ENABLE_TLS=true
- GRAYLOG_HTTP_TLS_CERT_FILE=/etc/ssl/certs/graylog/host.domain.ch.crt
- GRAYLOG_HTTP_TLS_KEY_FILE=/etc/ssl/certs/graylog/host.domain.ch.key
entrypoint: /usr/bin/tini -- wait-for-it elasticsearch:9200 -- /docker-entrypoint.sh
links:
- mongodb:mongo
- elasticsearch
restart: always
depends_on:
- mongodb
- elasticsearch
ports:
# Graylog web interface and REST API
- 9000:9000
# Syslog TCP
- 1514:1514
# Syslog UDP
- 1514:1514/udp
# GELF TCP
- 12201:12201
# GELF UDP
- 12201:12201/udp
# Volumes for persisting data, see https://docs.docker.com/engine/admin/volumes/volumes/
volumes:
mongo_data:
driver: local
es_data:
driver: local
graylog_data:
driver: local
You’re right, I could just use a custom configuration file where I will set the http_publish_uri manually, that just isn’t the smooth way of fixing the issue but rather a workaround in my opinion. But I might as well just do it.
By my understanding just the line
- GRAYLOG_HTTP_PUBLISH_URI=https://host.domain.ch:9000/
should set the http_publish_uri in the ~/data/config/graylog.conf, but it does not, resulting in a fail of the /health_check.sh.
----- EDIT ----
I now put all the variables I need to set in a separate graylog.conf file, which replaces the default file. The Container still is listed as unhealthy, but docker logs shows me some warnings that might help, but I have to look into that.
2022-03-16 08:55:02,744 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Unable to call https://host.domain.ch:9000/api/system/metrics/multiple on node <39a013b4-eb50-4a0a-891b-7e089aff8858>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
