DNS config error 502 bad gateway notifications

[tecbox]

Since Cloudron 9, I get constantly notifications (messages in message center in Clodron Dashboard) about misconfigured Domain correlated to deSEC DNS:

If I mark as read, the notification is gone and come back around next day, sometimes takes longer, 2-3 days.
I did not find any issues regarding DNS, new Apps and DNS working "normal", nothing I can find in logs.

Logs

If applicable, attach relevant logs from /home/yellowtent/platformdata/logs/box.log or the Dashboard

There is nothing a can share here (didn't find anything).

Troubleshooting Already Performed

Mention any steps you have already tried (restarts, reboots, etc.). This prevents repeated suggestions

Server rebooted, DNS reconfigured, sync DNS, added new App to test DNS record creation. All ok / function.

System Details

Generate Diagnostics Data

WARNING

The command cloudron-support --send-diagnostics generated URL might contain sensitive details.

When choosing this option, you can delete everything below.

Your https://paste.cloudron.io/ URL generated from cloudron-support --send-diagnostics.

generated, can I provide, if needed

Cloudron Version

9.0.15

Ubuntu Version

Ubuntu 24.04.2 LTS

Cloudron installation method

Manual with ./cloudron-setup

Output of cloudron-support --troubleshoot

Vendor: netcup Product: KVM Server
Linux: 6.8.0-90-generic
Ubuntu: noble 24.04
Execution environment: kvm
Processor: AMD EPYC-Rome Processor
BIOS pc-i440fx-9.2  CPU @ 2.0GHz x 4
RAM: 8131816KB
Disk: /dev/vda3       107G
[OK]    node version is correct
[OK]    IPv6 is enabled and public IPv6 address is working
[OK]    docker is running
[OK]    docker version is correct
[OK]    MySQL is running
[OK]    nginx is running
[OK]    dashboard cert is valid
[OK]    dashboard is reachable via loopback
[OK]    No pending database migrations
[OK]    Service 'mysql' is running and healthy
[OK]    Service 'postgresql' is running and healthy
[OK]    Service 'mongodb' is running and healthy
[OK]    Service 'mail' is running and healthy
[OK]    Service 'graphite' is running and healthy
[OK]    Service 'sftp' is running and healthy
[OK]    box v9.0.15 is running
[OK]    netplan is good
[OK]    DNS is resolving via systemd-resolved
[OK]    Dashboard is reachable via domain name
[WARN]  Domain xxx expiry check skipped because whois does not have this information
[OK]    unbound is running

[james]

Hello @tecbox
Without the domain we can not validate the deSEC configuration.

[tecbox]

Hi @james
the domain is "tecbox.de". Thanks!

[james]

Hello @tecbox
Sorry, I mistook deSEC for DNSSEC.

Do you have IPv4 and IPv6 enabled?
Please connect to your Cloudron server with ssh and run the following two commands and share the output:

curl -4 'https://desec.io/api/v1/'

curl -6 'https://desec.io/api/v1/'

[tecbox]

Hi @james,
no problem, here the outputs from requested commands:
4:

{"register":"https://desec.io/api/v1/auth/","login":"https://desec.io/api/v1/auth/login/","reset-password":"https://desec.io/api/v1/auth/account/reset-password/"}

6:

{"register":"https://desec.io/api/v1/auth/","login":"https://desec.io/api/v1/auth/login/","reset-password":"https://desec.io/api/v1/auth/account/reset-password/"}

[james]

Hello @tecbox
Could you please go into your deSEC DNS configuration in Cloudron and verify if everything look correct and also if the api token is still valid?

[tecbox]

Hi @james
all seems ok, config is good, token is still valid. DNS updates working, a DNS resync goes through without any errors.

[james]

Hello @tecbox
Could you please contact support@cloudron.io and reference this topic with a link?
We need to look into it a little deeper to get to the root of this issue.

[tecbox]

Hi @james
done: [27594]
Thx!

[jdaviescoates]

What was the issue?

[tecbox]

@jdaviescoates
It is actually not resolved, opened ticket via mail, but did not received an anwser yet.

[joseph]

@tecbox I sent a reply from support. I debugged this further . The 502 is returned from deSEC . I have added some logs on your server to see if we can get the full error to report to deSEC. So far, it's been running for the last one hour without reporting any error from deSEC .