How can I resolve 503 and unexpected EOF errors for HTTPS requests in n8n with a proxy setup?

I’m running n8n version 1.71.3 in a Docker container on Ubuntu Server 22 behind Traefik, and I’ve configured an HTTP proxy using Xray to route outbound requests through an SSH tunnel. While manual tests with curl succeed, setting the HTTPS_PROXY environment variable causes all external HTTPS requests (such as those to the Google OAuth API) to fail with 503 Service Unavailable and unexpected EOF errors.

Below is the detailed setup and configuration:

• n8n version: 1.71.3
• Database: default (SQLite)
• n8n EXECUTIONS_PROCESS: default
• Running n8n via: Docker
• Operating system: Ubuntu Server 22

Infrastructure Overview:

1. Traefik acts as a reverse proxy for n8n.
2. Xray functions as an HTTP proxy, forwarding traffic through an SSH tunnel using a local SOCKS5 connection.
3. Manual curl tests inside the n8n container work correctly using the proxy, but n8n’s internal requests fail when HTTPS_PROXY is set.

Traefik Container Configuration:

YAMLCopied
traefik:
  image: "traefik"
  container_name: traefik
  restart: always
  command:
    - "--api=true"
    - "--api.insecure=true"
    - "--providers.docker=true"
    - "--providers.docker.exposedbydefault=false"
    - "--entrypoints.web.address=:80"
    - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
    - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
    - "--entrypoints.websecure.address=:443"
    - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
    - "--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}"
    - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - /hdd8tb/traefik:/letsencrypt
    - /var/run/docker.sock:/var/run/docker.sock:ro
  networks:
    custom_network:
      ipv4_address: 192.168.11.2

n8n Container Configuration:

YAMLCopied
n8n:
  container_name: n8n
  build:
    context: ./n8n
    dockerfile: Dockerfile
  restart: always
  depends_on:
    - sshproxy
  ports:
    - "5678:5678"
  environment:
    - HTTP_PROXY=http://sshproxy:4424
    - HTTPS_PROXY=http://sshproxy:4424
    - NO_PROXY=localhost,127.0.0.1
    - N8N_HTTP_PROXY_TIMEOUT=10000
    - N8N_HTTPS_PROXY_TIMEOUT=10000
    - NODE_TLS_REJECT_UNAUTHORIZED=0
  networks:
    custom_network:
      ipv4_address: 192.168.11.3

Xray (sshproxy) Container Configuration:

YAMLCopied
sshproxy:
  image: sshproxy
  container_name: sshproxy
  build:
    context: ./xray
    dockerfile: Dockerfile
  environment:
    - SSH_REMOTE_HOST=${SSH_HOST}
    - SSH_REMOTE_PORT=22
    - SSH_USERNAME=${SSH_USER}
    - SSH_PASSWORD=${SSH_PASSWORD}
    - LOCAL_HTTP_PORT=4424
  ports:
    - "4424:4424"
    - "5535:5535"
  networks:
    custom_network:
      ipv4_address: 192.168.11.4

Xray Proxy Initialization Script:

BASHCopied
#!/bin/bash
sshpass -p "${SSH_PASSWORD}" ssh -o StrictHostKeyChecking=no -f -N -D 0.0.0.0:5535 -p ${SSH_REMOTE_PORT} ${SSH_USERNAME}@${SSH_REMOTE_HOST}
cat <<EOF > /etc/xray/config.json
{
  "inbounds": [
    {
      "port": 4424,
      "protocol": "http",
      "settings": {
        "allowTransparent": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "socks",
      "settings": {
        "servers": [
          {
            "address": "127.0.0.1",
            "port": 5535,
            "udp": true
          }
        ]
      }
    }
  ]
}
EOF
xray -config /etc/xray/config.json

Manual curl Test within the n8n Container:

BASHCopied
docker exec -it n8n curl -v -x http://sshproxy:4424 \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=refresh_token&client_id=your_client_id&client_secret=your_client_secret&refresh_token=your_refresh_token" \
     https://oauth2.googleapis.com/token

Observed Behavior:

• Manual curl tests succeed with a proper HTTP response (e.g., 401 Unauthorized).
• When running n8n with the HTTPS_PROXY set, requests to the Google API fail with 503 errors and unexpected EOF messages in the logs.

Log Excerpts:

Xray Logs (sshproxy Container):
2024/12/17 14:44:36 [Info] [1363944455] proxy/http: request to Method [CONNECT] Host [oauth2.googleapis.com:443]
2024/12/17 14:44:36 [Info] [1363944455] app/dispatcher: default route for tcp:oauth2.googleapis.com:443
2024/12/17 14:44:36 [Info] [1363944455] transport/internet/tcp: dialing TCP to tcp:127.0.0.1:5535
2024/12/17 14:44:36 [Warning] [1363944455] proxy/http: failed to read response from oauth2.googleapis.com > unexpected EOF

n8n Logs:
AxiosError: Request failed with status code 503
at IncomingMessage.handleStreamEnd (/usr/local/lib/node_modules/n8n/node_modules/axios/lib/adapters/http.js:599:11)
at IncomingMessage.emit (node:events:531:35)
at endReadableNT (node:internal/streams/readable:1696:12)
Error: Bad Request
at /usr/local/lib/node_modules/n8n/node_modules/@rudderstack/rudder-sdk-node/cjs/index.js:639:49

Question:

How can I resolve this issue where n8n’s HTTPS requests fail when HTTPS_PROXY is enabled, despite manual curl tests working correctly? Is there a compatibility issue with Axios or a required configuration tweak to properly handle HTTPS requests via the proxy?
<NL any insights or further recommendations would be greatly appreciated!