EspoCRM with docker, Web-Socket and SSL issues

[DashingUno]

Good day everybody!
I've setup Espo from official docker image (via docker-compose, replacing MySQL with Maria though)

I'm managing my hosts with NPM, which is located on the same bridged network as the Espo stack.
External network conf. looks like this

https://espodomain.com -> Router NAT with 80/443 port forwarding to NPM external network ip -> NPM -> espo container bridge network ip
NPM handles SSL for me, I've attached the configuration screenshots

The issue that I'm currently facing is I don't quite understand how to get websockets to work.
I understand that I need to change espocrm-websocket container env. variable from "ws" to "wss" so that chrome does not block it.
But what kind of ip address should I input there is the part where I'm lost.
localhost, container bridge network IP, external IP - all resolve to "failed to connect"
Also I'm having doubts about the default 8080 websocket port, but I have no idea how to go about changing it.

All of the containers are within 192.168.122.* macvlan subnet
If needed any container can be port forwarded from the router directly bypassing NPM (except the 80 port of main espocrm container)

[tarasm]

Can you share your docker-compose.yml?

[DashingUno]

version: '3.8'

services:

mysql:
image: mariadb:latest
network_mode: bridge
container_name: mysql
command: --default-authentication-plugin=mysql_native_password
environment:
MARIADB_ROOT_PASSWORD: 
MARIADB_DATABASE: 
MARIADB_USER: 
MARIADB_PASSWORD: 
volumes:
- /home/j/stage/mysql:/var/lib/mysql
restart: always

espocrm:
image: espocrm/espocrm:7.0.9-apache
network_mode: bridge
container_name: espocrm
environment:
ESPOCRM_DATABASE_HOST: mysql
ESPOCRM_DATABASE_USER: 
ESPOCRM_DATABASE_PASSWORD: 
ESPOCRM_ADMIN_USERNAME: 
ESPOCRM_ADMIN_PASSWORD: 
ESPOCRM_SITE_URL: "http://localhost:8080"
ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN: "tcp://espocrm-websocket:7777"
volumes:
- /home/j/stage/espo:/var/www/html
restart: always

adminer:
image: adminer
network_mode: bridge
restart: always
depends_on:
- mysql

espocrm-daemon:
image: espocrm/espocrm
network_mode: bridge
container_name: espocrm-daemon
volumes:
- /home/j/stage/espo:/var/www/html
restart: always
entrypoint: docker-daemon.sh

espocrm-websocket:
image: espocrm/espocrm
network_mode: bridge
container_name: espocrm-websocket
environment:
ESPOCRM_CONFIG_USE_WEB_SOCKET: "true"
ESPOCRM_CONFIG_WEB_SOCKET_URL: "wss://localhost:8081"
ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBSCRIBER_DSN: "tcp://*:7777"
ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN: "tcp://espocrm-websocket:7777"
volumes:
- /home/j/stage/espo:/var/www/html
restart: always
entrypoint: docker-websocket.sh

[lazovic]

Hi,

Please try this solution:

In the docker-compose.yml delete this line from the espocrm part:

ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN: "tcp://espocrm-websocket:7777"

Change your espocrm-websocket part to this:

espocrm-websocket:
image: espocrm/espocrm
network_mode: bridge
container_name: espocrm-websocket
volumes:
- /home/j/stage/espo:/var/www/html
restart: always
entrypoint: php websocket.php
ports:
- 8081:8080

In your data/config.php add:

'useWebSocket' => true,
'webSocketUrl' => 'ws://localhost:8081',
'webSocketZeroMQSubscriberDsn' => 'tcp://*:7777',
'webSocketZeroMQSubmissionDsn' => 'tcp://espocrm-websocket:7777',

[DashingUno]

Hi lazovic! Thank you for the advice

I've tried your solution, but I got this error (token replaced):

WebSocket connection to 'ws://localhost:8081/?authToken=______' failed:
ab.Session @ autobahn.js:341
connect @ web-socket-manager.js:93
(anonymous) @ web-socket-manager.js:112

I think the issue might be lying with ip addreses/ports and potentially Nginx Proxy Manager
In my original setup I am not using any ports, as all of the containers have designated IP within the bridge networks, so there is no need for me to forward any ports, since NPM does it directly from a fully qualified domain name lets say espo.domain.com to containers IP, and since I don't need access to it from local network, I am not forwarding any ports

Additional things that I have tried:

 'webSocketUrl' => 'ws://localhost:8081',  changed to  'webSocketUrl' => 'ws://localhost:8080',

Same error as above

 'webSocketUrl' => 'ws://localhost:8081', changed to   'webSocketUrl' => 'ws://192.168.122.12:8080',

Results in

Mixed Content: The page at 'https://espo.domain.com/#Tasks/view/________' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://192.168.122.12:8080/?

So I changed it to wss, and got this

WebSocket: Could not unsubscribe from streamUpdate.Tasks.________.

So I'm guessing the main issue is the network setup?

[DashingUno]

Is it possible to change the Webscoket server port in the container?

This issue seems to be common when reverse proxy is used

[DashingUno]

Issue solved automatically with images after
image: espocrm/espocrm:7.0.9-apache