danioj

Thank you. It's nice to have the benefit of someone else doing the same to give me a little confidence that its ok.

I was wondering if someone would mind casting thier eye over what I have done to be able to resolve dockers via my external app.domain.tld BUT limit access to just client requests from my LAN. Over in this thread I was investigating how I might do that: In short, I setup the application via the reverse proxy like any other public facing app (e.g. with DNS to my external site and through reverseproxy). Result, available through http://app.domain.tld as expected, but not desired. I only want it to be accessible via requests from my LAN. So I put this code into the location code block of the app.subdomain.conf file that sits within the proxy-confs folder of my letsencrypt setup. location / { # allow anyone in 192.168.1.0/24 allow 192.168.1.0/24; # drop rest of the world deny all; } The result, I can access https://app.domain.tld from the LAN but NOT the Internet - which returns a 403. Excellent!!!! I just want to make sure that I am not missing some obvious security issue here which would make the app accessible from the internet or worse.

I understand why your mind might go there, mine did too. Unless I am blind, it's really not. I am stumped. Any other out there ideas you can suggest for me to chase down? Nope. The official response from the ISP is misinformed (or a downright lie). My ISP does in fact block port 80. Thats the issue. Thanks for the reply anyway.

I had an issue like this. On my backup unraid server, I have two important shares mounted from my unraid main server that i use to store my important documents and photos. The purpose of these shares is so that Duplicati can use them to run scheduled backups of those shares onto the backup server. Most of the time the setup works fine, but I have recently been experiencing the stale share "issue" which has caused the scheduled backup to fail. I have followed most of the suggestions listed in this thread but it still happens. Yesterday morning, when I checked if Duplicati had run at 1am - you guessed it - backup failed, stale share. I decided to band-aid the issue. I wrote the following - very inelegant script - that checks if the shares are alive and mounted and if not mounts them. If the share is mounted, it does nothing. I use the User Scripts plugin (available in CA) to schedule this to run in the background on a custom 5 mins schedule (*/5 * * * *). It run all yesterday and kept the share mounted and yes, my backups were successful. Checking the unraid log, the script had to mount them 3 times throughout the day without any obvious reason why. Like I said, it is very inelegant and could be improved greatly by feeding the motored shares into an array and looping through them but I didn't want to spend that much time on it as it was for just me and those two shares. For those with a little bash script knowledge, amending the script to meet your needs should be straightforward. Sharing in the hope that someone who has a similar situation and setup can use it. #!/bin/bash # shares the script is monitoring to keep alive. documents_share=/mnt/disks/UNRAID_documents/ photos_share=/mnt/disks/UNRAID_photos/ # test if the shares are alive by seeing if ls errors but suppress that error. documents_share_isalive=$(ls $documents_share 2> /dev/null) photos_share_isalive=$(ls $photos_share 2> /dev/null) # set need to mount variable to 0 as it will be tested needtomount=0 if [ -z "$documents_share_isalive" ] then echo "$documents_share is either unmounted or stale." # unmount the documents share. uad command to remount won't work yet if its stale. if it is already unmounted then it will just error. if it is stale then it will be unmounted. umount $documents_share 2> /dev/null # set a flag to mount later needtomount=1 else echo "$documents_share is mounted and alive. nothing to do here." fi if [ -z "$photos_share_isalive" ] then echo "$photos_share is either unmounted or stale." # unmount the photos share. uad command to remount won't work yet if its stale. if it is already unmounted then it will just error. if it is stale then it will be unmounted. umount $photos_share 2> /dev/null # set a flag to mount later needtomount=1 else echo "$photos_share is mounted and alive. nothing to do here." fi if [ $needtomount = "1" ] then echo "one of the monitored shares was identified as being either unmounted or stale and was therefore unmounted." echo "lets try mounting them again ..." /usr/local/emhttp/plugins/unassigned.devices/scripts/rc.unassigned mount auto echo "done. all monitored shares are now mounted and alive." else echo "there was nothing for me to do, all monitored shares are mounted and alive." fi

I love the idea of multiple array pools and native backup. But TBH the absence of those functions has already pushed me to invest in working solutions involving physical diversity and a Duplicati docker (using perm UAD mounts on the backup server) so they are down on my wanted list. Shame to see VM enhancements are so far down the public wanted list. Specifically I’d love to push the FR asking for the ability to start a VM (which does not require array disk access) running off UAD (or a LT version of it - personally I think they could consider taking control of it basic functionality and integrate) which would allow for the running of a pfsense VM (for example) to be truly viable on unraid. I’d be open to some constraints if LTs issue here is how this could be exploited by community development (e.g. only certain VMs allowed which call for pre array startup - like pfsense) but I honestly think it is this development - and branches of development that will spawn from it - that will truly open up my server being the “one server”. Lol.

Hi Guys, It's been a while, hope you're all well. I currently have this lets encrypt docker container working well with dns validation (cloudflare - non proxy) and am serving a very simple landing page as well as a couple of apps via sub domains. There is one niggling issue that I can't seem to solve that I am hoping someone can help me debug. I cannot get the site to redirect to https. Here is some relevant info from my setup: Ports forwarded on my router to unraid: router => unraid 80 => 180 443 => 1444 The code snippet below from the 'default' file in site-confs is unchanged from the installation and every link I have been to regarding nginx suggests this is the right code to redirect. server { listen 80 default_server; listen [::]:80 default_server; server_name _; return 301 https://$host$request_uri; } Now, it appears that the redirect works perfectly from the LAN BUT when I am out and about it does not. I have made sure that the browsers are not caching etc. In fact, I have just demo'd it right now. Phone on the Wifi, go to http://subdomain.domain.com redirects great. Drop the Wifi and repeat, no connection is made and no redirect. I have checked with my ISP and they do not block port 80 and all my port forwards are in there and fine. I am not sure how to go about debugging this. Can anyone help please? EDIT: Issue resolved as per post below - a couple down - ISP actually DO block port 80, despite telling me something different. That was the issue.

Thanks for posting these excellent pieces of information @ljm42 and thanks for the plugin @bonienl I had previously tried to setup Wireguard to replace my OpenVPN setup (running in a seperate Ubuntu VM) and I had issues with both the local dns not resolving and also not being able to access containers that had their own IP's. I think I might have even asked on a different post earlier in the week if anything had been done in this space. Doh. I had missed that the post had been updated. I noticed it this morning and it took me all of 10 mins afterwards to follow the guide and get Wireguard working with my custom IPs on my dockers and local DNS name resolution. I have now retired the Ubuntu VM and have a fully functional Wireguard VPN. Excellent.

Worked like a charm. I think this should be noted somewhere as being "best practice" for new people setting the app up.

Sweet, thank you!!!

Excellent video AGAIN. Thank you.

What an excellent piece of software and an amazing thing to be able to self host and run on our own servers. I set mine up in no time using spaceinvaderone’s excellent video and have it running through my exisiting letsencrypt reverse proxy. I was so impressed with this yesterday. I decided to do a full migration from my current password manager and see if I can actually use it real world. I mean, jeez, I pay Dashlane $50 per year for this functionality and this is just as polished. I was able to setup an iOS app, desktop app on OS X and also browser integration (which I might add is even BETTER than Dashlane for Safari) just as easy as with the paid Dashlane service. Shame I renewed my yearly Dashlane subscription in Feb. anyway, I guess that’s good JIC this little trial goes awry. I don’t think it will though. One issue I have though is the security of the admin page. It’s open to the world. Yes I know it’s protected by a long random ssl generated key but I’d much prefer the secure method of accessing it that utilises email OR hide it from being public facing completely. Does anyone know how to enable the email access method for this RS version OR know how to limit access to the admin link to LAN only!?

Excellent video. I followed it step by step (the parts for installing on unraid anyway) and given I had already setup letsencrypt (with dns validation) as per your previous videos - I was up and running in no time. Perfect.

Hope you're all safe and indoors. With the additional time at home - and the AL I am on - I have more time to play with unRAID again. Just like old times. Re the above post by @Selmak and the reply by @bonienl does anyone know if there has been any progress on a more permanent solution to being able to access containers with custom IP's through a Wireguard VPN connection? It's a great piece of technology, however I use custom IP's allot to channel their connection through a VPN client which runs on my router (Merlin-ASUSWRT) which means I am stuck running OpenVPN-AS on a dedicated nix VM.

Hi, I did as you asked. My SSL setting was Auto (as is the unraid default I believe), i set it to 'no' as requested and tried again. The result was identical. I won't post the image again as it was literally identical, down to the unraid log of unsuccessful login. You mention that there should be another debug line, there is not. I have tried scrolling, copying etc, and nothing.

Hi, done. Trying automated find, results in same behaviour as described above and no debug log to post. Trying manual add, results in the following: EDIT: Googled the error, reckon it is a special character parse problem. Given the complex password I use I'm guessing your gut feeling is right. EDIT2: if it helps, I'm willing to change my password and share the password that doesn't seem to be working to help debug. It's auto generated by the password manager anyway so no bother.

Hi, since upgrading recently, I have been having an issue logging in - in that I can't. Unraid version: 6.8.0 Stable Controlr version: 4.16.0 OS: Android (December 2019 patch) Phone: Galaxy S9 Protocol for accessing Unraid: http After upgrading from last stable of unraid to the current stable I tried to log in via Controlr and it just hung. So I removed the profile and tried to add it again. I experienced the following (repeatedly): Automated method: Click + Add username and password Keep https button unchecked Hit Discover Goes back to Server UI and does nothing. Manual method: Same as above but add hostname (also tried using IP address) Hangs with a spinning wheel and a message saying 'Adding host <IP address> indefinitely. Port is port 80 (unchanged from unraid default). Nothing else has changed since upgrading (except password change) when all worked well and has done since you released the app. I can log into the Unraid GUI via a browser just fine. Have removed app and reinstalled. Same thing happens. Have also reset phone to factory (for another reason) and that didn't have an effect either. In the Unraid log there is a corresponding line for each attempt: 'Dec 29 17:11:37 unraid webGUI: Unsuccessful login user root from <IP address>' I use a reasonably long password with mixed case letters, numbers and symbols.

Upgraded from 6.7.2 to 6.8.0 with no issue at all.

Nah. I did this and got really sick. My priorities have changed and tbh I have abandoned this. It was a good idea when i had time but even I back up manually now.

For anyone having an issue setting up this container, here are some tips from me: - don't worry that there appear to be no port or config mappings. Everything is fine, you don't need to add these. - if you set your own IP (which you will probs have to do given it requires port 80) then ALL other containers it interacts with need their own IP - tvhProxy may need a restart before it will be recognised by TVH. - Don't mess with ports - use <ip>:<port> format of tvhProxy setup in Plex to find the server. Just my experience - HNY 2019. D

For anyone who is installing Ombi for the first time and either cannot log in via OAuth OR Ombi doesn't recognise Plex Media Server (despite pulling the details from your Plex account), then the following solutions worked for me: - Don't try and login using OAuth on initial setup. Skip the wizard and set yourself a very strong password. Then, once logged in, navigate to Settings>Configuration>Authentication and click the checkbox which says "Enable Plex OAuth". Then, disable any popup blocker you have for your Ombi URL. Log out, then log back in (this time using the newly appearing option to use OAuth) and then you're good. For some reason, this method of logging requires a popup method of logging on, which the Wizard doesn't seem to use (as in it opens a new page). Meaning, when you're taken to a new page (where you are successfully logged in - and asked to close the window) but then the wizard never continues. - Once you have grabbed the details of your Plex server (via the Media Server settings option) from your Plex account and Click either "Load Libraries" OR "Test Connectivity" and received an error saying it can't connect to your server - just go to the Docker page and reset the server and try again. It should then work. - Run a Settings>Media Server>Plex>Manually Run Full Sync right at the end. Just my experience! HNY 2019! D

Yorkshire Aussie @ that! Double trouble! LOL!

Sorry!

Let me start this off by saying, I have NOT read the entire thread for this issue. I searched for .DS to see if anything was posted and there was nothing. That might give some clue as to why I am posting. I have been doing some general updating to the server (along with installing some new excellent plugins - of which I think this is) and I found a conflict between this plugin and user scripts. I ran the included "This script will delete all .DS_Store files on your array created by Apple's Finder" script on the user scripts plugin and the ransomware plugin kicked in. Doh! When I say "conflict" I believe the ransomware plugin is behaving as intended BUT the files in question are inconsequential. Are we able to set an exclusion list? or a safe plugin list? .... Just thinking out loud!? EDIT: also, is it possible for everything to work as intended and still have the SMB folders hidden. It bugs me that when I open my share list up I have this huge list of "dummy" shares and I have to "scan" to find what I want!?

Welcome to v6+. The best way to add "Apps" in unRAID 6 is to use the Community Applications Plugin: https://forums.lime-technology.com/topic/38582-plug-in-community-applications/ When you add this plugin you will get a tab within the unRAID GUI called Apps. Within this tab you can search for "Plex" and choose the linuxserver container and install. Once installed the container will appear in the Docker tab where you can configure. Useful links for you: v6 getting started: https://lime-technology.com/wiki/index.php/UnRAID_6/Getting_Started#Getting_Started Docker FAQ's: https://forums.lime-technology.com/topic/55246-docker-faq/

I feel like I'm missing something REALLY simple You're not. I know what the issue is. Sent a PM but you haven't seen it so Ill just post it here. Switch the Container to Bridge Mode in the Docker Tab. Add an additional port (e.g. 1194 UDP), call it whatever you want. Then hit save. Then it will work. The connectivity issue has to do with the Container running in Host Mode. I am going to co-ordinate some changes to the guidance centrally. Its a bit of pain as it was originally setup to run in Bridge Mode but was changed (due to issues experienced by users) to run as Host. Now it appears it has to go back again. Yet...post 3 or so says things NEED to be HOST and PRIVILEGED I understand, we shall clear the guidance up as required. Just trust me, give it a go. I'm 99.9% sure this is the issue .... Confirmed via IRC that move to Bridge mode worked.