🐛 Bug Report: "Internal server error" when using DNS Rewrite on Local DNS

[ryuupendragon]

👟 Reproduction steps

I'm using Pocket ID as my OIDC Provider. When I'm using custom DNS rewrite on Adguard Home for pocket id (id.mydomain.com) site on my local network getting below error. After disabling the rewrite for pocket id (id.mydomain.com) it's started working normally.

I have Unraid as my primary home server and RPI4 as secondary server. On longer power outage, I'll turnoff Unraid to save power on the Inverter UPS. So I'm running Pocket ID on RPI4. I have caddy running on both machines, Unraid one for external services and RPI4 for internal services. I'm using DNS rewrite on Adguard Home so even if Unraid is offline, pocket id will be still working.

When accessing id.mydoamin.com from outside, First it'll go to caddy on unraid and pocket id container on RPI4. When accessing it from inside, DNS rewrite will make it to go to caddy on RPI4 then pocket id container on RPI4.

👍 Expected behavior

Other Services are working without any issues.

👎 Actual Behavior

{"statusCode":500,"message":"Internal server error"}

📜 Logs

[Nest] 49  - 12/27/2025, 8:56:12 PM   ERROR [ExceptionsHandler] TypeError: fetch failed
    at node:internal/deps/undici/undici:14900:13
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async OidcProvider.getToken (/opt/app/backend/dist/src/oauth/provider/genericOidc.provider.js:60:21)
    at async OAuthController.callback (/opt/app/backend/dist/src/oauth/oauth.controller.js:49:28) {
  [cause]: Error: getaddrinfo ENOTFOUND id.mydomain.com
      at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26) {
    errno: -3008,
    code: 'ENOTFOUND',
    syscall: 'getaddrinfo',
    hostname: 'id.mydomain.com'
  }
}

[aottr]

The issue comes from node not being able to resolve the domain. I assume you're using docker for your setup?

I'm already using Node v22 so I don't think the issue comes from an old node version.
I'd assume the embedded DNS of docker or resolv.conf don't point to your Adguard Home instance which you could enforce with setting it in the compose file:

services:
  ottrbox:
    dns:
      - 192.168.1.X  # AdGuard Home's IP address

You can also confirm this via connecting into the container with sh:

docker exec -it <container-id> sh

or:

docker compose exec <service-name> sh

And then ping your domain with pocket-id.

---

If this didn't help and you can resolve the domain inside the container (but still have the issue with the rewrite), I'd like to know the version of ottrbox you're running and if there are any major changes to the compose file (so I can test it myself)

---

For an alternative setup you can also have a look at keepalived that's providing a virtual IP for both instances of pocket-id and point your Adguard Home to this IP without the need of a rewrite (to basically have a main and a fallback instance of pocket-id in case you need to shut-off your server)

[ryuupendragon]

Still getting the same error. I'm using unraid. Below is the equivalant docker run command.

docker run
  -d
  --name='pingvin-share'
  --net='frontend'
  --pids-limit 2048
  -e TZ="Asia/Calcutta"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="Umbreon"
  -e HOST_CONTAINERNAME="pingvin-share"
  -e 'TRUST_PROXY'='true'
  -e 'PV_LOG_LEVEL'='debug'
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.webui='http://[IP]:[PORT:3000]'
  -l net.unraid.docker.icon='https://cdn.jsdelivr.net/gh/ryuupendragon/icons/png/pingvin-share.png'
  -p '8012:3000/tcp'
  -v '/mnt/pool/appdata/pingvin-share/config.yaml':'/opt/app/config.yaml':'ro'
  -v '/mnt/pool/appdata/pingvin-share/images/':'/opt/app/frontend/public/img':'rw'
  -v '/mnt/pool/ssd-data/pingvin-share/data/':'/opt/app/backend/data':'rw'
  --user 99:100
  --dns 10.24.10.20
  --dns 10.24.10.50 'ghcr.io/aottr/ottrbox:v1.15.0'

Tried pinging pocket id but getting below error for both before and after adding the dns.

/opt/app $ ping id.mydomain.com
ping: bad address 'id.mydomain.com

[ryuupendragon]

For an alternative setup you can also have a look at keepalived that's providing a virtual IP for both instances of pocket-id and point your Adguard Home to this IP without the need of a rewrite (to basically have a main and a fallback instance of pocket-id in case you need to shut-off your server)

Never used it but have heard about for running more than two pihole/adguardhome. Will try this later.

[aottr]

Still getting the same error. I'm using unraid. Below is the equivalant docker run command.

docker run
  -d
  --name='pingvin-share'
  --net='frontend'
  --pids-limit 2048
  -e TZ="Asia/Calcutta"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="Umbreon"
  -e HOST_CONTAINERNAME="pingvin-share"
  -e 'TRUST_PROXY'='true'
  -e 'PV_LOG_LEVEL'='debug'
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.webui='http://[IP]:[PORT:3000]'
  -l net.unraid.docker.icon='https://cdn.jsdelivr.net/gh/ryuupendragon/icons/png/pingvin-share.png'
  -p '8012:3000/tcp'
  -v '/mnt/pool/appdata/pingvin-share/config.yaml':'/opt/app/config.yaml':'ro'
  -v '/mnt/pool/appdata/pingvin-share/images/':'/opt/app/frontend/public/img':'rw'
  -v '/mnt/pool/ssd-data/pingvin-share/data/':'/opt/app/backend/data':'rw'
  --user 99:100
  --dns 10.24.10.20
  --dns 10.24.10.50 'ghcr.io/aottr/ottrbox:v1.15.0'

Tried pinging pocket id but getting below error for both before and after adding the dns.

/opt/app $ ping id.mydomain.com
ping: bad address 'id.mydomain.com

Thanks ! That you're still getting an error with the ping indicates that it's not necessarily the application code but rather something in the container (-network) still.

I'll set up a test-env in Unraid after the holidays (probably on the 2nd January)

What type has the frontend network ? Is it a bridge network ? I assume it's for the communication with the reverse proxy.

[ryuupendragon]

Thanks ! That you're still getting an error with the ping indicates that it's not necessarily the application code but rather something in the container (-network) still.

I'll set up a test-env in Unraid after the holidays (probably on the 2nd January)

Sure thanks.

What type has the frontend network ? Is it a bridge network ? I assume it's for the communication with the reverse proxy.

Yes, It is just an normal bridge network. Yes, I'm using frontend network is for reverse proxy.

docker network create --subnet=172.20.0.0/16 --gateway=172.20.0.1 frontend
docker network create --subnet=172.25.0.0/16 --gateway=172.25.0.1 internal
docker network create --subnet=172.30.0.0/16 --gateway=172.30.0.1 backend

[aottr]

@ryuupendragon
I didn't find a solution yet since it's DNS issue that is not really related to the code itself but more likely the way you set it up.

One idea that came to my mind is to set up a custom /etc/hosts rule inside your docker (since the dns attribute apparently didnt work).

You can do that by adding --add-host id.mydomain.com:x.x.x.x to the docker run command with x.x.x.x being the ip address of your RP4 hosting PocketID. reference to the attribute

Resulting in sth like:

docker run
  -d
  --name='pingvin-share'
  --net='frontend'
  --pids-limit 2048
  -e TZ="Asia/Calcutta"
  -e HOST_OS="Unraid"
  -e HOST_HOSTNAME="Umbreon"
  -e HOST_CONTAINERNAME="pingvin-share"
  -e 'TRUST_PROXY'='true'
  -e 'PV_LOG_LEVEL'='debug'
  -l net.unraid.docker.managed=dockerman
  -l net.unraid.docker.webui='http://[IP]:[PORT:3000]'
  -l net.unraid.docker.icon='https://cdn.jsdelivr.net/gh/ryuupendragon/icons/png/pingvin-share.png'
  -p '8012:3000/tcp'
  -v '/mnt/pool/appdata/pingvin-share/config.yaml':'/opt/app/config.yaml':'ro'
  -v '/mnt/pool/appdata/pingvin-share/images/':'/opt/app/frontend/public/img':'rw'
  -v '/mnt/pool/ssd-data/pingvin-share/data/':'/opt/app/backend/data':'rw'
  --user 99:100
  --dns 10.24.10.20
  --add-host id.mydomain.com:x.x.x.x
  --dns 10.24.10.50 'ghcr.io/aottr/ottrbox:v1.15.0'