Installation in ProxMox LXC with external Reverse Proxy

Tropaion

Hello Community,
I'm trying to get Funkwhale running in my setup but somehow I cant make it.
I have an ProxMox-Server with many containers (LXCs, I don't like to use docker) with NextCloud, Bitwarden,...reachable via HTTP. Only the Reverse-Proxy LXC is reachable externally,

Now I want that Funkwhale runs in its own LXC (Debian 10) and is reachable via IP and HTTP.
My reverse proxy is enforcing HTTPS to the outside and internally I only use HTTP so I only have one LetsEncrypt-Setup.

What I did:
I installed 'libpq-dev' to get the install script running. In the script I chose to install everything except nginx and letsencrypt, works without error. Then I changed the 'FUNKWHALE_PROTOCOL' in er .env auf http.
Afterwards I set up nginx according the instructions in the documentation.
I tried modifying the funkwhale.conf, removing the HTTPS enforcement and ssl and change it to port 80.
'nginx -t' says syntax is ok and start without error.
But when I try to start Funkwhale it always gives the error "(code=exited, status=1/FAILURE)".

I hope someone can help me because I really want to use Funkwhale.

Mfg,
Tropaion

EDIT: logfile of funkwhale-beat: logfile.txt

wancat

Hi! I have set up FunkWhale on Proxmox LXC and external reverse proxy. I use an Nginx in the funkwhale lxc, and a Caddy in the reverse proxy vm.
This is my Nginx config:

# This file was generated from funkwhale.template

upstream funkwhale-api {
    # depending on your setup, you may want to update this
    server 0.0.0.0:5000;
}

# required for websocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    # update this to match your instance name
    # useful for Let's Encrypt
    location /.well-known/acme-challenge/ { allow all; }


    # If you are using S3 to host your files, remember to add your S3 URL to the
    # media-src and img-src headers (e.g. img-src 'self' https://<your-S3-URL> data:)

    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    root /srv/funkwhale/front/dist;

    # compression settings
    gzip on;
    gzip_comp_level    5;
    gzip_min_length    256;
    gzip_proxied       any;
    gzip_vary          on;

    gzip_types
        application/javascript
        application/vnd.geo+json
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        font/opentype
        image/bmp
        image/svg+xml
        image/x-icon
        text/cache-manifest
        text/css
        text/plain
        text/vcard
        text/vnd.rim.location.xloc
        text/vtt
        text/x-component
        text/x-cross-domain-policy;

    # end of compression settings
    location / {
        include /etc/nginx/funkwhale_proxy.conf;
        # this is needed if you have file import via upload enabled
        client_max_body_size 200M;
        proxy_pass   http://funkwhale-api/;
    }

    location /front/ {
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
        add_header Referrer-Policy "strict-origin-when-cross-origin";
        add_header Service-Worker-Allowed "/";
        add_header X-Frame-Options "SAMEORIGIN";
        alias /srv/funkwhale/front/dist/;
        expires 30d;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }
    location /front/embed.html {
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
        add_header Referrer-Policy "strict-origin-when-cross-origin";

        add_header X-Frame-Options "ALLOW";
        alias /srv/funkwhale/front/dist/embed.html;
        expires 30d;
        add_header Pragma public;
        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
    }

    location /federation/ {
        include /etc/nginx/funkwhale_proxy.conf;
        proxy_pass   http://funkwhale-api/federation/;
    }

    # You can comment this if you do not plan to use the Subsonic API
    location /rest/ {
        include /etc/nginx/funkwhale_proxy.conf;
        proxy_pass   http://funkwhale-api/api/subsonic/rest/;
    }

    location /.well-known/ {
        include /etc/nginx/funkwhale_proxy.conf;
        proxy_pass   http://funkwhale-api/.well-known/;
    }

    location /media/ {
        alias /srv/funkwhale/data/media/;
    }

    location /_protected/media {
        # this is an internal location that is used to serve
        # audio files once correct permission / authentication
        # has been checked on API side
        internal;
        alias   /srv/funkwhale/data/media;
    }

    # Comment the previous location and uncomment this one if you're storing
    # media files in a S3 bucket
    # location ~ /_protected/media/(.+) {
    #     internal;
    #     # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
    #     proxy_set_header Authorization "";
    #     proxy_pass $1;
    # }

    location /_protected/music {
        # this is an internal location that is used to serve
        # audio files once correct permission / authentication
        # has been checked on API side
        # Set this to the same value as your MUSIC_DIRECTORY_PATH setting
        internal;
        alias   /srv/funkwhale/data/music;
    }

    location /staticfiles/ {
        # django static files
        alias /srv/funkwhale/data/static/;
    }
}

And this is my Caddy config:

music.example.com {
  reverse_proxy 192.168.0.19:80  # Change to your FunkWhale LAN IP
}

FunkWhale config/.env

# Ansible managed

FUNKWHALE_HOSTNAME=music.example.com
FUNKWHALE_PROTOCOL=https

FUNKWHALE_API_IP=0.0.0.0
FUNKWHALE_API_PORT=5000
FUNKWHALE_WEB_WORKERS=1
REVERSE_PROXY_TYPE=nginx

Hope it would help!