DNS resolver Bug

[A4alli]

Brief Intro
---> I have followed @flll and @patrick-theprogrammer guides based on Tailscale with caddy and Tailscale serve. SInce more than month I am struggling with the DNS resolver issue. Much discussion has been done on various platforms but no fruitful result. I finally open this issue as a Bug in nextcloud-aio network which is unable to resolve domain:443 if using Tailscale. The tailnet.ts.net is able to open the nextcloud-aio instance and work but with a lot of security and setup cautions and warnings. Though I made a system global DNS resolver in ~./config/docker/daemon.json (for docker rootless) but still unable to resolve the DNS issue.
Moreover I had install fresh Ubuntu VM and systemwide Docker to verify if the problem exist just due to docker rootless but came to know that the DNS issue still exist. I also setup Ubound DNS in Opnsense and bridge by Ubuntu VM to that (all in Proxmox). Still DNS issue. Below are the few logs:

sudo docker exec -it nextcloud-aio-apache bash -x /healthcheck.sh
[sudo] password for lee:
+ nc -z nextcloud-aio-nextcloud 9000
Connection to nextcloud-aio-nextcloud (172.18.0.8) 9000 port [tcp/*] succeeded!
+ nc -z 127.0.0.1 8000
Connection to 127.0.0.1 8000 port [tcp/*] succeeded!
+ nc -z 127.0.0.1 11000
Connection to 127.0.0.1 11000 port [tcp/*] succeeded!
+ nc -z [nextcloud.tailnet4567.ts.net](http://nextcloud.tailnet4567.ts.net/) 443
nc: getaddrinfo for host "[nextcloud.tailnet4567.ts.net](http://nextcloud.tailnet4567.ts.net/)" port 443: Name does not resolve
+ echo 'Could not reach [nextcloud.tailnet4567.ts.net](http://nextcloud.tailnet4567.ts.net/) on port 443.'
Could not reach [nextcloud.tailnet4567.ts.net](http://nextcloud.tailnet4567.ts.net/) on port 443.
Exit=1

compose.yml

services:
  nextcloud-tailscale:
    image: tailscale/tailscale:latest
    container_name: nextcloud-tailscale
    cap_add:
      - net_admin
    hostname: nextcloud
    environment:
      - TS_AUTHKEY=tskey-auth-xyz
      - TS_AUTH_ONCE=true
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_STATE_DIR=/var/lib/tailscale
    networks:
      - nextcloud-aio
    restart: always
    volumes:
      - nextcloud-tailscale-data:/var/lib/tailscale
      - ./serve_config/tailscale:/config
  nextcloud-aio:
    image: nextcloud/all-in-one:latest
    container_name: nextcloud-aio-mastercontainer # app requirement
    depends_on:
      - nextcloud-tailscale
    environment:
      - APACHE_IP_BINDING=127.0.0.1
      - APACHE_PORT=11000
      - NEXTCLOUD_ENABLE_DRI_DEVICE=true
      - NEXTCLOUD_STARTUP_APPS=deck twofactor_totp tasks calendar contacts notes
      - NEXTCLOUD_DATADIR=/mnt/media/ncdata
      - NEXTCLOUD_UPLOAD_LIMIT=10G
      - NEXTCLOUD_MAX_TIME=7200
      - NEXTCLOUD_MEMORY_LIMIT=1024M
      - NEXTCLOUD_ADDITIONAL_APKS=imagemagick
      - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick
      - APACHE_MAX_SIZE=10737418240
      - SKIP_DOMAIN_VALIDATION=true
      - WATCHTOWER_DOCKER_SOCKET_PATH=$XDG_RUNTIME_DIR/docker.sock # Docker rootless
    init: true
    networks:
      - nextcloud-aio
    restart: always
    volumes:
      - nextcloud-aio-data:/mnt/docker-aio-config
      - $XDG_RUNTIME_DIR/docker.sock:/var/run/docker.sock:ro # Docker rootless
networks:
  nextcloud-aio:
    name: nextcloud-aio
volumes:
  nextcloud-aio-data:
    name: nextcloud_aio_mastercontainer
  nextcloud-tailscale-data:

serve.json

{
  "TCP": {
    "443": {
      "HTTPS": true
    },
    "8443": {
      "HTTPS": true
    }
  },
  "Web": {
    "${TS_CERT_DOMAIN}:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://nextcloud-aio-apache:11000/"
        }
      }
    },
    "${TS_CERT_DOMAIN}:8443": {
      "Handlers": {
        "/": {
          "Proxy": "https+insecure://nextcloud-aio-mastercontainer:8080"
        }
      }
    }
  }
}

docker exec -it nextcloud-aio-apache bash

0e6b553:/usr/local/apache2$ 0e6b5533d46a:/usr/local/apache2$ nslookup nextcloud.tailnet4567.ts.net 
Server: 127.0.0.11 
Address: 127.0.0.11#53
server can't find nextcloud.tailscale4567.ts.net: NXDOMAIN

cat resolv.conf

# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.


nameserver 127.0.0.11
options ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [10.0.2.3]
# Overrides: []
# Option ndots from: internal

NEED HELP

[szaimen]

Hi, do you maybe run into this?
#5557

[A4alli]

well this mention issue doesn't solve a bit.
I experiment different thing and finally solved the issue by adding funnel in serve.json. it resolved the apache container health condition and host resolved. But without funnel the host resolved failed and apache is unhealthy. Any saying about why funnel is necessary

{
  "TCP": {
    "443": {
      "HTTPS": true
    },
    "8443": {
      "HTTPS": true
    }
  },
  "Web": {
    "${TS_CERT_DOMAIN}:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://nextcloud-aio-apache:11000"
        }
      }
    },
    "${TS_CERT_DOMAIN}:8443": {
      "Handlers": {
        "/": {
          "Proxy": "https+insecure://nextcloud-aio-mastercontainer:8080"
        }
      }
    }
  },
  "AllowFunnel": {
    "${TS_CERT_DOMAIN}:443": false,
    "${TS_CERT_DOMAIN}:8443": false
  }
}

even with =false it is working

[szaimen]

Any saying about why funnel is necessar

I cannot tell. I personally never used Tailscale and dont have any epxerience with it.

[A4alli]

you are right. this is not funnel issue. I again had the problem

[A4alli]

If installed tailscale itself on the host on which the docker is running, it solve the DNS resolver problems. I don't knw what is the issue. Is there something NAT loopback thing?