Vitreous Humour

Hi all, this may be a stupid question, but I was under the impression that Wireguard being a plugin/built into the Unraid OS now should allow it to continue functioning even when things like the array or docker are stopped. I have this issue where VPN'ing into my Unraid server via Wireguard works perfectly if the array or docker are turned on, but the moment I disable docker my VPN tunnel shuts down (looking at the logs I stop getting a handshake from the Unraid server). This makes using the VPN to fix any docker/array problems extremely dicey because I can't actually turn off docker or risk disrupting the connection. Am I just completely mistaken about how Wireguard is supposed to work in this case? Is this a known problem with a known solution? Are there config details I can share that will help troubleshoot this? Thanks for the help! Edit: I also tried using Tailscale with docker stopped and it doesn't seem to connect either, if that helps

Also thank you for calling me a "full nerd", I feel like this is unfortunately the very VERY edge of nerddom. It only involved delving in to the CLI a bit, and no direct programming was required at all! I didn't even personally compile the docker image (that was just a process that I knew I wasn't going to do regularly enough to ensure things stayed safe). But clearly the people who created authelia expect someone to be comfortable with an IDE so that was probably the biggest challenge there, no GUI, and quite frankly the errors that it throws are sometimes confusing or difficult to interpret unless you understand how those yml files are supposed to be structured. I wish SpaceInvaderOne had created a walkthrough for this, but it was a learning experience. Honestly, my biggest concern is security. I tried to make sure I didn't open any more holes in security than absolutely necessary during this process, but its something that I worry about constantly (particularly the passthrough for the webfinger server through SWAG). If anyone can see something I did wrong, please let me know so I can fix it ASAP!

Yeah, the process of implementing a OIDC server is much more complicated than it should be. When you break it down the whole process is only 4 steps (arrange stable domain, set up authelia, set up webfinger server, integrate into SWAG) but the authelia step is just such a huge hurdle. Actually, let me see if I can upload censored versions of my various yaml and conf files for the setup. Half the challenge was just figuring out if I was putting things down in the right places, and in the right format, so that might make it a lot more straightforwards. Edit: OK attached. The default.conf file is for SWAG, the configuration.yml and user database file is for authelia, the config.yml and account email file are for carpal (the account email should literally be named acct:youremail@domain, but windows doesn't accept that file name so you'll need to rename when the file is in unraid). default.confacct emailconfig.ymlusers_database.ymlconfiguration.yml

Ok, I was able to figure out how to do it on my own! It wasn't great, but it is definitely doable. I very much used https://blog.janissary.xyz/posts/tailscale-oidc-authelia-carpal as a framework for my approach. But in case anyone else wants to venture down this path I'll leave some notes here. I purchased a domain name (I used cloudflare as the DNS provider, right now free.) and then used ddclient to effectively make it target my dynamic IP. I already had a SWAG instance, but I did have to go through and update the various configs (nginex and subdomain configs) to updated templates in order to get Authelia to work. Oh, and use auth.domain.xyz, not the old authelia.* subdomain. Authelia was the most PITA thing to set up. All the youtube guides and most of the documentation on authelia (especially the IBRACORP guide) are horribly out of date, and almost nothing works that way anymore. For anyone struggling with it, you can use the IBRACORP template, but then you need to turn on debug logging and then slowly but surely walkthrough the errors that it throws, correcting each one (and particularly looking at the authelia documentation to figure out what has changed and what is new). There was also a problem with the redis container they suggest not being able to properly write out some files because of permissions, which you would only know by looking at the youtube comments for that video. Make Authelia an OIDC issuer per the janissary.xyz guide. It won't work right out of the box because authelia has broken that config in a later update, much of it is just re-writing the yml file to match authelia's new config framing. You will need to create some secrets, which authelia's guide will walk you through pretty well, though I was not able to get authelia to properly read a secrets file, so they needed to be in-line. I pulled the Carpal docker image from https://hub.docker.com/r/peeley/carpal. Use the config options in the janissary.xyz and peeley/carpal github to help set it up, but it was pretty easy. One pitfall I ran into is that for some reason Tailscale WON'T query properly if you have capital letters in your email and the matching acct file! This was driving me crazy and throwing a 404 error, but you need to have the emails be lower case. add the carpal webfinger server in the location section of the default.conf file in SWAG (as per the janissary.xyz guide) to allow your base domain to respond to a query at .well-known/webfinger with the proper JSON response. You should check on the webfinger website that it's properly responding when you put in the email you want Tailscale to register you at. Make sure that in the email account file, that you have the href pointing to your authelia subdomain (which should be set properly downstream of your SWAG proxy server). Hopefully at that point the tailscale account setup will get a proper response from your carpal server that points it to your authelia instance. It will continue to do this whenever you need to login to Tailscale. Ugh, honestly authelia was the biggest bear here, it took over a week of fiddling to get it to work right. Unfortunately there don't seem to be many "easier" OIDC setups, I considered Authentik but it seemed even MORE fiddly than authelia to get set up reliably. Good luck!

Hi all! I'm trying to venture into utilizing Tailscale, but am running into an immediate barrier. Tailscale requires using a third-party identity provider to set up an account, all of the easy free options being Google/Microsoft/Apple. Now, the problem is that I'm specifically working on creating my own self-hosted app ecosystem (which Tailscale would be an entry-point to) specifically to pull out of the FAANG ecosystems, so it makes me really uncomfortable to have to lock myself to one of them in order to use Tailscale. I do see that Tailscale allows other OIDC options, but most of those cost a pretty penny or are ultimately owned by major tech corps again. I was looking into self-hosted setups, as I've set up an Authelia container in my Unraid server, but apparently it requires a "Webfinger" server that I can't seem to find a good option for in the App store. There are applications like Go-Finger and Carpal which can be containerized and run in Docker, but that would require me to clone their GitHub repositories and compile them in order to run on unraid, and I'm uneasy about trusting myself to remember to regularly check for updates and go through that process over and over again to keep things secure. Anyone have a good recommendation of how to create a Tailscale account but not have to go through Google/Microsoft/Apple or another corporate provider? Is there a relatively straightforwards way to self-host a compatible OIDC service with WebFinger compatibility? Thanks!

I'm having a minor issue. The syncthing container is working normally, but oddly won't autostart with the other docker containers. It will manually start fine, but just won't autostart. More an annoyance issue than anything else, but anyone else having it? Or know how to fix it? I looked in both the server logs, as well as the syncthing container logs, and don't see any record of failed attempts to start the container.

Thanks! That worked!

Hmm. So it sounds like it should be working, any other ideas why I still don't get a password prompt when accessing the webGUI for DirSyncPro? Thanks so much for the help!

Literally the exact instructions in your post. 1. Opened the terminal by clicking console under DirSyncPro on the docker tab 2. Enter root by typing "su $USER" in the opened terminal 3. Executed password creation by typing "vncpasswd" 4. Put in 8 character password, twice 5. Edited the DirSyncPro settings to add a blank variable with "TURBOVNC_PARAMS" as the key. 6. Pressed apply to restart the container. The only additional step is I had to create a .vnc folder in the DirSyncPro appdata folder, so that I wouldn't get a " password file couldn't be created" error after inputing the passwords after the vncpasswd command. I'm assuming I'm running DirSyncPro as root when typing "su $USER", is there another way I should be running DirSyncPro as root? I'm on the latest version of your DirSyncPro docker, since I just installed it.

Apologies, but I just installed DirSyncPro and when I tried to set the noVNC password using the process described in the Recommended Post at the beginning of this topic I get a "Cannot write password file /dirsyncpro/.vnc/passwd" error and a password never appears to get set. Anyone have an idea as to why this is occuring, and how to allow that file to be created? Edit: I figured out that you need to actually manually create a .vnc folder in the dirsyncpro folder in appdata for the file to be properly written, but for some reason there is still not a required password to use the WebGUI. I made sure I had the TURBOVNC_PARAMS variable created and restarted the docker but nothing is showing up.