# Bad Gateway 502 with Nginx on native Install - Debian

**URL:** <https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129>\
**Category:** Installation & Configuration\
**Created:** [November 6, 2024, 8:17pm UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129 "2024-11-06T20:17:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![superfun](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@superfun](https://forum.collaboraonline.com/u/superfun)\
**Post date:** [November 6, 2024, 8:17pm UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/1 "2024-11-06T20:17:05Z")

</div>

Hi there,

I have a problem with my collabora setup, after starting fresh with my Pi because of Software-Failures.

I´ve had it on the old system natively installed and so on the new one, my nginx-config is also copied from the old system, so everything should be working, but it won´t :-/

so I installed it after setting prerequisities and finaly installed it with

```auto
apt install coolwsd code-brand

```

systemctl status coolwsd also tells:  
“Nov 06 20:14:28 DietPi coolwsd[464]: Ready to accept connections on port 9980.”

The following is configured:

```auto
sudo coolconfig set storage.wopi.host office.mydomain.de
sudo coolconfig set ssl.enable true
sudo coolconfig set ssl.termination true

```

But everytime I try to connect it with my Nextcloud, I get 502 Bad Gateway, also when trying to browse to [https://office.mydomain.de/hosting/discovery](https://office.mydomain.de/hosting/discovery)

Here the collabora.conf from Nginx:

```auto
server {
 listen 443 ssl;
 server_name office.mydomain.de;

 ssl_certificate /etc/letsencrypt/live/office.mydomain.de/fullchain.pem; # managed by Certbot
 ssl_certificate_key /etc/letsencrypt/live/office.mydomain.de/privkey.pem; # managed by Certbot

 # static files
 location ^~ /browser {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Host $http_host;
 }

 # WOPI discovery URL
 location ^~ /hosting/discovery {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Host $http_host;
 }

 # Capabilities
 location ^~ /hosting/capabilities {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Host $http_host;
 }

 # main websocket
 location ~ ^/cool/(.*)/ws$ {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header Host $http_host;
   proxy_read_timeout 36000s;
 }

 # download, presentation and image upload
 location ~ ^/(c|l)ool {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Host $http_host;
 }

 # Admin Console websocket
 location ^~ /cool/adminws {
   proxy_pass https://127.0.0.1:9980;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "Upgrade";
   proxy_set_header Host $http_host;
   proxy_read_timeout 36000s;
 }
}

```

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [November 7, 2024, 6:05am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/2 "2024-11-07T06:05:45Z")

</div>

hello @superfun welcome to collabora online community forums.

I have seen same type of errors in forum topics. I am sharing one solution here, please try and let me know how things goes.

Probably it is related to the deprecated packages not installed by default so that we need…

> [@502 Bad Gateway in NextCloud after dist-upgrade (--\> Ubuntu 24.04)](https://forum.collaboraonline.com/t/502-bad-gateway-in-nextcloud-after-dist-upgrade-ubuntu-24-04/3017):
>
> TLDR: 502 on ubuntu - look for coolmount in coolwsd log - install coolwsd-deprecated In-depth explanation So here I was getting 502 Bad Gateway whenever trying to open documents or even just connect to https:///hosting/discovery I spent an embarrassing amount of time , reading nginx docs ( yes - I use nginx not Apache) , generating tons of logs, adding hostnames to /etc/hosts apart from localhost etc etc etc to no avail Until i found out what was wrong In my case It was down do an error ari…

Thanks,  
Darshan

---

<div class="post-metadata">

**Author:** ![superfun](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@superfun](https://forum.collaboraonline.com/u/superfun)\
**Post date:** [November 7, 2024, 7:02am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/3 "2024-11-07T07:02:07Z")

</div>

> [@502 Bad Gateway in NextCloud after dist-upgrade (--\> Ubuntu 24.04)](https://forum.collaboraonline.com/t/502-bad-gateway-in-nextcloud-after-dist-upgrade-ubuntu-24-04/3017/1):
>
> sudo apt install coolwsd-deprecated

that was not the solution in my case. after install coolwsd-deprecated the problem persists :-/

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [November 7, 2024, 8:21am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/4 "2024-11-07T08:21:05Z")

</div>

Here are some troubleshooting steps that might help you identify and resolve the issue:

### 1. Check Collabora (coolwsd) Logs

Since `coolwsd` is reporting readiness on port 9980, it’s essential to check the detailed logs to see if there’s a specific error. Run:

```bash
sudo journalctl -u coolwsd -f

```

Look for any messages that indicate network or SSL-related issues.

### 2. Verify SSL Termination

Since you’re using `ssl.termination=true` in Collabora’s config, NGINX should handle the SSL termination, while Collabora will operate over HTTP locally (127.0.0.1). However, in your NGINX config, you are using `https://127.0.0.1:9980` in `proxy_pass`. Try updating the `proxy_pass` settings to `http://127.0.0.1:9980` as follows:

```nginx
# static files
location ^~ /browser {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Host $http_host;
}

# WOPI discovery URL
location ^~ /hosting/discovery {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Host $http_host;
}

# Capabilities
location ^~ /hosting/capabilities {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Host $http_host;
}

# main websocket
location ~ ^/cool/(.*)/ws$ {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
  proxy_set_header Host $http_host;
  proxy_read_timeout 36000s;
}

# download, presentation, and image upload
location ~ ^/(c|l)ool {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Host $http_host;
}

# Admin Console websocket
location ^~ /cool/adminws {
  proxy_pass http://127.0.0.1:9980;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
  proxy_set_header Host $http_host;
  proxy_read_timeout 36000s;
}

```

### 3. Restart NGINX and coolwsd

After making changes, restart both NGINX and Collabora to apply them:

```bash
sudo systemctl restart nginx
sudo systemctl restart coolwsd

```

### 4. Verify `coolwsd` Port Binding and Firewall Rules

Ensure that `coolwsd` is indeed listening on `127.0.0.1:9980`. Run:

```bash
sudo netstat -tuln | grep 9980

```

If it’s bound to `127.0.0.1:9980`, verify that no firewall rules are blocking access to this port locally.

### 5. Confirm Nextcloud Configuration

Make sure that the Nextcloud configuration for Collabora Online points to the correct address (`https://office.mydomain.de`), with SSL enabled as expected. Double-check for any typos or mismatches in the Collabora Online app settings within Nextcloud.

### 6. Inspect Permissions and Ownership

Occasionally, permission issues can prevent coolwsd from working correctly. Confirm that the service user running `coolwsd` has the necessary permissions for any required files or directories.

### 7. Additional Debugging with NGINX Logs

If the issue persists, examine NGINX’s error logs for more detailed information on the 502 errors. Run:

```bash
sudo tail -f /var/log/nginx/error.log

```

After following these steps, you should have a clearer indication of where the issue lies. Let me know if you encounter specific errors

Thanks,  
Darshan

---

<div class="post-metadata">

**Author:** ![superfun](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@superfun](https://forum.collaboraonline.com/u/superfun)\
**Post date:** [November 7, 2024, 8:40am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/5 "2024-11-07T08:40:53Z")

</div>

Hi,

“sudo journalctl -u coolwsd -f”

gives output and this is the only section with an error

Error “File not found: /etc/coolwsd/ca-chain.cert.pem”

```auto
Nov 07 08:37:04 DietPi coolwsd[15266]: Failed to initialize COOLWSD: File not found: /etc/coolwsd/ca-chain.cert.pem
Nov 07 08:37:04 DietPi coolwsd[15266]: wsd-15266-15266 2024-11-07 08:37:04.039526 +0000 [coolwsd] TRC Initialize StorageConnectionManager| wsd/COOLWSD.cpp:2953
Nov 07 08:37:04 DietPi coolwsd[15266]: wsd-15266-15266 2024-11-07 08:37:04.042422 +0000 [coolwsd] FTL Failed to initialize COOLWSD: File not found: /etc/coolwsd/ca-chain.cert.pem| wsd/COOLWSD.hpp:530
Nov 07 08:37:04 DietPi coolwsd[15266]: File not found: /etc/coolwsd/ca-chain.cert.pem
Nov 07 08:37:04 DietPi coolwsd[15266]: <shutdown>-15266 2024-11-07 08:37:04.058860 +0000 [coolwsd] SIG Fatal signal received: SIGABRT code: 18446744073709551610 for address: 0x6900003ba2
Nov 07 08:37:04 DietPi coolwsd[15266]: Recent activity:
Nov 07 08:37:04 DietPi coolwsd[15266]: Backtrace 15266 - wsd 24.04.9.1 55317ef:
Nov 07 08:37:04 DietPi systemd[1]: coolwsd.service: Main process exited, code=killed, status=11/SEGV
Nov 07 08:37:04 DietPi systemd[1]: coolwsd.service: Failed with result 'signal'.
Nov 07 08:37:04 DietPi systemd[1]: coolwsd.service: Consumed 8.027s CPU time.
Nov 07 08:37:04 DietPi systemd[1]: coolwsd.service: Scheduled restart job, restart counter is at 1077.
Nov 07 08:37:04 DietPi systemd[1]: Stopped coolwsd.service - Collabora Online WebSocket Daemon.
Nov 07 08:37:04 DietPi systemd[1]: coolwsd.service: Consumed 8.027s CPU time.
Nov 07 08:37:04 DietPi systemd[1]: Started coolwsd.service - Collabora Online WebSocket Daemon.

```

Also Log in Nginx tell that connection to Collabora is refused:

```auto
2024/11/07 08:44:49 [error] 16335#16335: *37 connect() failed (111: Connection refused) while connecting to upstream, client: 79.242.101.142, server: office.mydomain.de, request: "GET /hosting/discovery HTTP/2.0", upstream: "http://127.0.0.1:9980/hosting/discovery", host: "office.mydomain.de"

```

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [November 7, 2024, 10:10am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/6 "2024-11-07T10:10:19Z")

</div>

@superfun did you read the log ? There is no such file exist `ca-chain.cert.pem`

You have some issues with the ssl certificates, so please recheck that.

> **[Proxy settings — SDK https://sdk.collaboraonline.com/ documentation](https://sdk.collaboraonline.com/docs/installation/Proxy_settings.html?highlight=proxy)**
>
> Collabora Online Proxy settings: reverse proxy (Apache or Nginx), load balancing (HAProxy or Nginx)

Thanks,  
Darshan

---

<div class="post-metadata">

**Author:** ![superfun](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@superfun](https://forum.collaboraonline.com/u/superfun)\
**Post date:** [November 7, 2024, 4:57pm UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/7 "2024-11-07T16:57:36Z")

</div>

Yes, I read the log, but the problem is, the ssl certificate is issued by LetsEncrypt and it is linked in nNginx collabora.conf.

the path where collabora searches for the cert is not in use… but I try to simlink LetsEncrypt to the path and test

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [November 12, 2024, 11:35am UTC](https://forum.collaboraonline.com/t/bad-gateway-502-with-nginx-on-native-install-debian/3129/8 "2024-11-12T11:35:40Z")

</div>

Closed on November 12, 2024, 11:35am UTC