Grist - SSL error

[simplerethink]

I set up a new project using the Grist service.

I set the Grist domain to https://grist.mydomain.com:443

When I deploy, the Grist service shows as running(unhealthy)

When I go to the domain in my browser, Cloudflare gives me an invalid SSL certificate error page, showing the issue is on the host.

I don't have SSL issues with any other service, so I don't think the issue is with Cloudflare config.

Any idea what the issue might be?

[djsisson]

@simplerethink im not sure why the template has port 443 , as according to image its 8484

so can you change the port on your url in coolify from 443 to 8484, save and redeploy ( not sure if you need to alter the SERVICE env to match)

[simplerethink]

@djsisson thanks for the response.

I was just reviewing the image and saw 8484 as well. I changed https://grist.mydomain.com:443 to https://grist.mydomain.com:8484 but that did not seem to help.

I also tried adding

ports:
  - 8484:8484

But that didn't resolve the issue either.

[djsisson]

no do not port bind, can you paste proxy logs

i assume you did redeploy after changing url? as editing it does not change the container labels until redeployment

[simplerethink]

@djsisson Right, I tried just the domain change and it did not resolve the issue, which is why I tried port binding.

Yes, I did a redeploy with each change.

I just deleted the entire project and started with a clean slate, changing only the url to https://grist.mydomain.com:8484. I still get the same result.

I tried to get the proxy logs, but it's not showing anything. Clicking refresh button and stream log did nothing either. I'm using Coolify Cloud.

[djsisson]

grist is trying to connect to postgres on localhost, when it should be using the postgres service name, can you post your compose you are using

[djsisson]

I'm guessing its because TYPEORM_HOST is not set it should have a default value, but doesn't so change it to the value postgres

[simplerethink]

Thank you. That seems to have fixed the DB error. I'm using the Coolify Service Template so I'm guessing that just needs to be updated with a default?

I get a new error in the app log, but it looks like that is related to my Coolify Authentik service not being publicly accessible. I currently have Cloudflare set to only allow traffic to each subdomain from certain IPs.

2025-10-09T14:41:51.303038546Z Running Grist as user 1001 with primary group 1001
2025-10-09T14:41:51.386448390Z gvisor check ok (flags: -unprivileged -ignore-cgroups)
2025-10-09T14:41:52.810292064Z 2025-10-09 14:41:52.809 - info: Loading config file from /persist/config.json
2025-10-09T14:41:52.815887423Z 2025-10-09 14:41:52.815 - debug: 3-pipe Sandbox started sandboxPid=81, flavor=gvisor, command=undefined, entryPoint=(default)
2025-10-09T14:41:52.850506097Z 2025-10-09 14:41:52.850 - info: Sandbox stderr: run.py: sandbox/gvisor/run.py -E PYTHONPATH=/grist/sandbox/grist -E PIPE_MODE=minimal -m /grist/sandbox --checkpoint /tmp/engine__grist python3 -- /grist/sandbox/grist/main.py sandboxPid=81, flavor=gvisor, command=undefined, entryPoint=(default)
2025-10-09T14:41:54.011412454Z 2025-10-09 14:41:54.011 - info: Sandbox stderr: Ready message: [INFO] [__main__] Ready sandboxPid=81, flavor=gvisor, command=undefined, entryPoint=(default)
2025-10-09T14:41:55.503683078Z 2025-10-09 14:41:55.502 - info: Loading config file from /persist/config.json
2025-10-09T14:41:55.758460868Z Welcome to Grist.
2025-10-09T14:41:55.758493978Z In quiet mode, see http://localhost:8484 to use.
2025-10-09T14:41:55.758498244Z For full logs, re-run with DEBUG=1
2025-10-09T14:41:55.760023028Z Setting up database...
2025-10-09T14:41:56.443753360Z Database setup complete.
2025-10-09T14:41:56.446227903Z 2025-10-09 14:41:56.445 - info: == Grist version is 1.7.4 (commit unknown)
2025-10-09T14:41:56.449845956Z 2025-10-09 14:41:56.449 - debug: skipping incomplete language ar (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.451995079Z 2025-10-09 14:41:56.451 - debug: skipping incomplete language ca (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.462923401Z 2025-10-09 14:41:56.462 - debug: skipping incomplete language fa (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.465718957Z 2025-10-09 14:41:56.465 - debug: skipping incomplete language hu (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.465737846Z 2025-10-09 14:41:56.465 - debug: skipping incomplete language ig (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.470555785Z 2025-10-09 14:41:56.470 - debug: skipping incomplete language nl (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.489380387Z 2025-10-09 14:41:56.488 - debug: skipping incomplete language th (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.489542541Z 2025-10-09 14:41:56.489 - debug: skipping incomplete language tr (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.495401476Z 2025-10-09 14:41:56.495 - debug: skipping incomplete language zun (set GRIST_OFFER_ALL_LANGUAGES if you want it)
2025-10-09T14:41:56.671910988Z OPError: expected 200 OK, got: 403 Forbidden
2025-10-09T14:41:56.671947805Z     at processResponse (/grist/node_modules/openid-client/lib/helpers/process_response.js:41:11)
2025-10-09T14:41:56.671968847Z     at Issuer.discover (/grist/node_modules/openid-client/lib/issuer.js:179:18)
2025-10-09T14:41:56.671971270Z     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
2025-10-09T14:41:56.671973323Z     at async OIDCConfig._initClient (/grist/_build/app/server/lib/OIDCConfig.js:252:24)
2025-10-09T14:41:56.671975587Z     at async OIDCConfig.initOIDC (/grist/_build/app/server/lib/OIDCConfig.js:159:9)
2025-10-09T14:41:56.671977590Z     at async OIDCConfig.build (/grist/_build/app/server/lib/OIDCConfig.js:107:9)
2025-10-09T14:41:56.671979612Z     at async Object.getMiddleware (/grist/_build/app/server/lib/OIDCConfig.js:341:28)
2025-10-09T14:41:56.671981646Z     at async FlexServer.addLoginMiddleware (/grist/_build/app/server/lib/FlexServer.js:1218:33)
2025-10-09T14:41:56.671983829Z     at async MergedServer.create (/grist/_build/app/server/MergedServer.js:86:9)
2025-10-09T14:41:56.671985812Z     at async main (/grist/_build/stubs/app/server/server.js:139:26) {
2025-10-09T14:41:56.671987825Z   error: 'expected 200 OK, got: 403 Forbidden'
2025-10-09T14:41:56.671989788Z }

[djsisson]

yes, looks like its querying the issuer, but being denied

[simplerethink]

Right. I have it mostly working now. However, I'm trying to use OIDC and Authentik and Grist app log shows option domain is invalid and my Grist login keeps failing because of it. I'll have to work on it more later this week. Seems Grist is not very straightforward to set up.