vaultwarden 도커로 옮기는데 haproxy에서 503이 계속 뜨네요

 맥미니 M2에 도커를 올려서 vaultwarden-server 컨테이너를 활성화 했습니다.

컴포즈는

  vaultwarden:
    image: vaultwarden/server
    restart: always
    ports:
      - 31127:80
    volumes:
      - /data:/data
    environment:
      - TZ=Asia/Seoul

이런식으로 구성해서 

PC에서 해당 ip로 테스트 커넥션 날려보니 true로 뜨긴하고

ComputerName     : 192.168.1.52
RemoteAddress    : 192.168.1.52
RemotePort       : 31127
InterfaceAlias   : 이더넷
SourceAddress    : 192.168.1.146
TcpTestSucceeded : True

PC에서 ip로 접속은 됩니다.

그런데 pfsense haproxy에서 연결을 해주면 계속 503이 뜨네요.

원래 vaultwarden이 트루나스 jail로 있었는데 해당 사용하던 백엔드 그대로 ip, 포트만 변경 해주었는데 

503이 뜨는걸 모르겠네요..

pfsense 쪽 haproxy 컨픽을 뽑아보면

# Automaticaly generated, dont edit manually.
# Generated on: 2024-05-19 18:43
global
	maxconn			50000
	log			/var/run/log	local0	info
	stats socket /tmp/haproxy.socket level admin  expose-fd listeners
	gid			80
	nbthread			1
	hard-stop-after		15m
	chroot				/tmp/haproxy_chroot
	daemon
	ssl-default-bind-ciphersuites	TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-server-ciphersuites	TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-bind-ciphers	ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
	ssl-default-bind-options	ssl-min-ver TLSv1.2 no-tls-tickets
	ssl-default-server-ciphers	ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
	ssl-default-server-options	ssl-min-ver TLSv1.2 no-tls-tickets
	tune.ssl.default-dh-param	4096
	server-state-file /tmp/haproxy_server_state

listen HAProxyLocalStats
	bind 127.0.0.1:2200 name localstats
	mode http
	stats enable
	stats admin if TRUE
	stats show-legends
	stats uri /haproxy/haproxy_stats.php?haproxystats=1
	timeout client 5000
	timeout connect 5000
	timeout server 5000

frontend https
	bind			공인ip:443 name 공인ip:443  ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3 ssl crt-list /var/etc/haproxy/https.crt_list  
	bind            공인ip:80 name 공인ip:80   
	mode			http
	log			global
	option			http-keep-alive
	option			forwardfor
	acl https ssl_fc
	http-request set-header		X-Forwarded-Proto http if !https
	http-request set-header		X-Forwarded-Proto https if https
	timeout client		30000
	http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload;"
	acl			http-plain	ssl_fc
	acl			warden	var(txn.txnhost) -m beg -i warden.*.*.*
	acl			aclcrt_https	var(txn.txnhost) -m reg -i ^([^\.]*)\.*\.*\.*(:([0-9]){1,5})?$
	http-request set-var(txn.txnhost) hdr(host)
	http-request set-var(txn.txnpath) path
	http-request redirect scheme https code 301  if  !http-plain aclcrt_https
	use_backend warden_ipv4  if  warden aclcrt_https

 이렇게 해두어서 다른 truenas에 있는 jail들로는 잘 됩니다 dns는 클라우드플레어 사용중이고 dns전용모드입니다

맥미니는 방화벽 전부 해제해둔 상태입니다.

도커쪽을 뭘 봐야하는건지 잘 모르겠네요.