Jump to content

aptalca

Community Developer
 View Profile  See their activity

  • Posts

    3,064

  • Joined

  • Last visited

  • Days Won

    3

 Content Type 

Posts posted by aptalca

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    Any particular reason why most (if not all) of your containers have /mnt/user mounted at /unraid by default? Is it mostly just a convenience mount? Feels like a potential security risk most of the cases if left at such a high level (as in just 2 dirs from root).

    It's an unraid thing. Not something I implemented. You can remove those mappings during install

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    I believe so. Basically, every user's connection is proxied through the letsencrypt container and so emby thinks that all the requests are coming from that container. And the container ip is that 172.x.x.x one.
    I was a little bit surprised, because on Apache virtual hosts, it was never a "problem".

     

    If it's an issue you'd like to fix, there may be a way to do it through the options in proxy.conf but I don't know which. You'd have to search online.

    I have searched around and found this. So I took just the first part in my site-confs

     

    [...]
location / {
    	proxy_pass https://192.168.0.100:8920/;
    	proxy_set_header  Host $host;
proxy_set_header  X-Real-IP $remote_addr;
proxy_set_header  X-Forwarded-For $remote_addr;
}
[...]

     

    and it seems to work. ;D

    Glad you figured it out.

     

    That's my experience with nginx. There is always an option to fix whatever, but it may not be obvious and may require some online research to figure out.

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    Why are php packages in the Nginx-letsencrypt docker? Does something depend on that?

     

    php is kind of useful for web servers, hence LEMP stacks (Linux, Nginx, MySQL, PHP) and the derivatives of this.

     

    'P' in the stack acronym doesn't necessarily stand for PHP :)

    Besides, it's 2016 2017; wouldn't consider php a must-have dependency on a webserver.

    I host a very modern html5 site in my container. However, there is a message box that still runs php code to send me an email.

     

    Some things are just so easy to implement with php especially if the person is relying on online templates and guides.

     

    Plus, a bunch of users are hosting WordPress sites that are php based

     

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    This Plugin works like a charm :), but I have one question: When I connect from my external URL to my application (like emby), the application get only the IP «172.17.0.2 » at every online user, and not the real IP. Is this normal?

     

    Thanks and happy new year.

    I believe so. Basically, every user's connection is proxied through the letsencrypt container and so emby thinks that all the requests are coming from that container. And the container ip is that 172.x.x.x one.

     

    If it's an issue you'd like to fix, there may be a way to do it through the options in proxy.conf but I don't know which. You'd have to search online.

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    Hey all. This is probably stupidly simple but beginner with nginx configs, 4 hours and many many google searches later im not too much further into my problem.

     

    Essentially i have stats.domain.co.uk loading up PlexPy perfectly using letsencrypt. Now trying to get requests.domain.co.uk to point to Plex Requests.

     

    My default config file below. The first and second "server_name" seem to work perfectly. http traffic is denied and https gets to PlexPy perfectly, but the 3rd server_name doesnt make it to Plex Requests. Tried even using the stats.domain.co.uk with the port for Requests and that works fine so doesnt seem to be the Docker.

     

    Any pointers as to what i need to change below? Just want requests.domain.co.uk to work alongside stats.domain.co.uk

     

    # redirect all traffic to https
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}

server {
listen 443 ssl;

root /config/www;
index index.html index.htm index.php;

server_name stats.*;

ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;
ssl_dhparam /config/nginx/dhparams.pem;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;

client_max_body_size 0;

#PLEX STATS

location / {
#		auth_basic "Restricted";
#		auth_basic_user_file /config/nginx/.htpasswd;
	include /config/nginx/proxy.conf;
	proxy_pass http://10.0.0.11:8181;	
}
}


server {
listen 443 ssl;

root /config/www;
index index.html index.htm index.php;

server_name requests.*;

ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;
ssl_dhparam /config/nginx/dhparams.pem;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_prefer_server_ciphers on;

client_max_body_size 0;

#PLEX REQUESTS

location / {
#		auth_basic "Restricted";
#		auth_basic_user_file /config/nginx/.htpasswd;
	include /config/nginx/proxy.conf;
	proxy_pass http://10.0.0.11:3000/request;	
}
}

     

    Likely an issue because https://domain.com is proxied to http://ip/requests

     

    It is usually a good idea to keep that base url (in this case "requests") the same between the domain address and the proxied address.

     

    You can either try to remove the base url from the plex requests container so that you access it at just http://serverip:port and so the proxied address would match the domain address (no base url) or you can try "location /requests" in the config and access it at requests.domain.com/requests (not pretty).

     

    You can also try adding a trailing slash at the end of the requests in your existing config. It *may* work

     

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    regarding PHP5 and mySQL, i see in the dockerfile you have the following:

     

    # install packages
RUN \
apk add --no-cache \
certbot \
curl \
fail2ban \
php5-curl \
php5-gd \
php5-mcrypt && \

     

    I think php5-mysqlnd would be the module I'd need added. I was reading this guide which had a section for adding mysql for PHP5 in an nginx installation: https://www.howtoforge.com/tutorial/installing-nginx-with-php-fpm-and-mariadb-lemp-on-debian-jessie/

     

    I'm missing the MySQL and MySQLi sections in my phpinfo page (see attached example from howtoforge link

    There are a ton of php modules and we only included the most commonly used ones (so as not to bloat the image unnecessarily). We can add more modules as we get requests. I'll look into  adding a sql one before the next Friday update

    [Support] Linuxserver.io - Plex Media Server

    in Docker Containers

    Posted

    I've tried adding a TZ variable in the past but it doesn't replace 'America/Chicago' instead another TZ value appears in the docker run command. I followed the instructions posted her but the result is the same:

     

    Docker command:

    root@localhost:# /usr/local/emhttp/plugins/dynamix.docker.manager/scripts/docker run -d --name="Sonarr" --net="bridge" -e TZ="America/Chicago" -e HOST_OS="unRAID" -e "PUID"="99" -e "PGID"="100" -e "TZ"="America/Toronto" -p 8989:8989/tcp -v "/dev/rtc":"/dev/rtc":ro -v "/mnt/user/TV/":"/tv":rw -v "/mnt/cache/Apps/docker/downloads/":"/downloads":rw -v "/mnt/cache/Apps/docker/appdata/sonarr":"/config":rw linuxserver/sonarr

    Unraid automatically adds the tz variable using your server's timezone. Go to unraid's settings and change your timezone to Toronto and reinstall the container

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    Hi all,

     

    I have this docker setup nicely and its doing everything i want it to do, ie. reverse proxy for a few dockers over https:// and serving some game files over standard http://.

     

    My question is about security and what, if anything, I need to make sure i'm doing to prevent security issues.

    Seeing that this docker is on my main unRAID machine with all my personal stuff on it as well as all my media is concerning me.

     

    I don't know enough about it and its keeping me up at night!

     

    The server has a A+ rating on SSL Labs which I assume is a good start but after that I need some guidance/reassurance.

     

    Can anyone shed some light on this for me?

     

    Cheers.

    Password protection if you haven't set it up already. See the docker hub page about htpasswd

     

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    Hi, thanks for this docker and all the others!

     

    Sorry if this has been asked before but i do not find any search in thread function.

     

    Is there a way to restart nginx from within the docker so i dont have to restart the entire thing every time i do a little change in the config file?

     

    service nginx restart does not work :/

     

    // Grasfer

    s6-svc -h /var/run/s6/services/nginx

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    Instructions for Dockergui based containers - DigiKam, RDP-Calibre and RDP-Boinc

     

    These containers are linux desktop apps that open in a web browser thanks to HurricaneHernandez's awesome Dockergui baseimage (guacamole server based).

     

    All you have to do is open the WebUI. The default resolution is 1280x720, but can be changed by clicking on the container name, selecting Advanced View and modifying the WIDTH and HEIGHT variables.

     

    Tips for setting up Zoneminder (older version, which installs 1.28)

    Please see here: https://hub.docker.com/r/aptalca/docker-zoneminder/

     

    Instructions for the Zoneminder 1.29 version

    Please see here: https://hub.docker.com/r/aptalca/zoneminder-1.29/

     

    Instructions for Nginx-letsencrypt

    Please see here: https://hub.docker.com/r/aptalca/nginx-letsencrypt/

    Additional support provided in this thread: http://lime-technology.com/forum/index.php?topic=43696.0

     

     

     

    Are you going to create a Zoneminder 1.30 separate docker or just update the 1.29?

    Probably neither. Zoneminder changes so much between versions that updating in place is near impossible. I'm not willing to create a new container every time they have an update. That's too much to support. Especially when I'm not even using it myself

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    Here is the output from the log

     

    *** Running /etc/my_init.d/00_regen_ssh_host_keys.sh...
*** Running /etc/my_init.d/firstrun.sh...
copying php.ini
moving mysql to config folder
rm: cannot remove ‘/config/mysql’: No such file or directory
moving data folder to config folder
moving perl data folder to config folder
creating symbolink links
setting the correct local time
mv: cannot move ‘/etc/localtime.dpkg-new’ to ‘/etc/localtime’: Device or resource busy
increasing shared memory
starting services
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
* Starting MySQL database server mysqld
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
/usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot open shared object file: Permission denied
   ...fail!
* Starting web server apache2
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.3. Set the 'ServerName' directive globally to suppress this message
*
DBI connect('database=zm;host=localhost','zmuser',...) failed: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2) at /usr/share/perl5/ZoneMinder/Config.pm line 92.
Can't connect to db at /usr/share/perl5/ZoneMinder/Config.pm line 119.
BEGIN failed--compilation aborted at /usr/share/perl5/ZoneMinder/Config.pm line 119.
Compilation failed in require at /usr/share/perl5/ZoneMinder.pm line 33.
BEGIN failed--compilation aborted at /usr/share/perl5/ZoneMinder.pm line 33.
Compilation failed in require at /usr/bin/zmpkg.pl line 48.
BEGIN failed--compilation aborted at /usr/bin/zmpkg.pl line 48.
Starting ZoneMinder: failure

*** /etc/my_init.d/firstrun.sh failed with status 255

*** Killing all processes...

     

    The SQL Error that the webpage presents (which makes sense considering the log output above)

     

    Unable to connect to ZM db.SQLSTATE[HY000] [2002] Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)

     

    I also noticed that the folder within the /config location had some interesting ownership

     

    drwxrwxrwx 5 www-data          www-data 4.0K Dec 13 21:19 data
drwxrw-rw- 5 systemd-bus-proxy input    4.0K Mar 26  2016 mysql
drwxrwxrwx 3 root              root     4.0K Dec 13 21:19 perl5
-rw-rw-rw- 1 root              root      69K Dec 13 21:19 php.ini

    I believe you're hitting this issue: https://github.com/docker/docker/issues/7512

     

    I can't remember why zoneminder runs in privileged mode, but you can try without, or (if you can) remove mysql from Ubuntu

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    I don't see any issues with the create statement. What do the logs say?

     

    By default, images and such are stored in the config folder but you should be able to change that location in the app settings.

     

    Pobably a dumb question, but are you referring to Docker logs or ZM logs from within the container? Assuming they would be stored in the /config location if the latter.

     

    My /camera mount is a WD Purple specifically installed for storing recorded camera content so I was really wanting to use it. I guess I could just pass that in as the /config location and store everything for that container on it. The /home location I was using for the /config above is on my array and part of an auto-backup.

     

    I never got into the actual Web UI at /zm, it was just displaying the SQL error. I'll get that error along with the logs when I get home from work.

     

    I meant the docker log

     

    docker logs zoneminder

     

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    This probably doesn't make sense, because of the xRDP/Guacamole base container:

     

    Your (awesome) JDownloader v2 container is the largest of my setup. Any chance this will migrate to lsio, too (same for Calibre)?

    Probably not. Lsio containers are very lean and clean. JD2 container is the opposite. It's huge.

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

     

     

    Hello,

     

    I'm new to docker, but I do have three other containers working... I'm running Ubuntu 16.04 LTS Server

     

    I just tried your aptalca/zoneminder-1.29 container with the following command

    sudo docker create \
--name=zoneminder \
--privileged=true \
-p 8585:80 \
-v /home/docker/appdata/zoneminder:/config \
-v /etc/localtime:/etc/localtime:ro \
-v /cameras:/cameras \
aptalca/zoneminder-1.29

     

    Then I start it with 

    sudo docker start zoneminder

     

    It starts up just fine but at about the 45-60 second mark it crashes and the container stops.

     

    I was able to access it initially at #.#.#.#:8585/zm but it was just displaying an SQL error.

     

    Is my create statement faulty?

     

    I'm wanting to use the /cameras mount volume to store the images, sounds, and events. Assuming that is where ZM keeps all of the stored footage it captures.

     

     

    Is there anything that I am doing incorrectly?

     

    I don't see any issues with the create statement. What do the logs say?

     

    By default, images and such are stored in the config folder but you should be able to change that location in the app settings.

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    I've been meaning to update this thread with a message (first post as well) that I have joined the LinuxServer.io team and have been moving some of my old containers over.

     

    Yes, my personal letsencrypt container will be deprecated, as the ls.io version is newer, smaller and more streamlined.

     

    The parameters are pretty much the same, but there are some structural changes so you can't use the same data/config folder when you switch over (how services are started and locations of certain things, etc.)

     

    I would recommend installing the lsio version as a clean install (with the same parameters), move your www folder over and then migrate your default site config elements piece by piece. It should be relatively simple.

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    I'm getting this error even after just doing a fresh install of Nginx-letsencrpt

     

    Upgrading certbot-auto 0.8.1 to 0.9.3...
Couldn't download https://raw.githubusercontent.com/certbot/certbot/v0.9.3/letsencrypt-auto-source/letsencrypt-auto. <urlopen error [Errno 1] _ssl.c:510: error:140773E8:SSL routines:SSL23_GET_SERVER_HELLO:reason(1000)>

/etc/my_init.d/firstrun.sh: line 138: cd: /config/keys: No such file or directory
Error opening input file cert.pem

cert.pem: No such file or directory
* Starting nginx nginx
...fail!
* Starting authentication failure monitor fail2ban
ERROR No file(s) found for glob /config/log/nginx/error.log

ERROR Failed during configuration: Have not found any log file for nginx-http-auth jail

...fail!
*** Running /etc/rc.local...
*** Booting runit daemon...
*** Runit started as PID 110
Nov 19 03:58:30 47089d200a78 syslog-ng[119]: syslog-ng starting up; version='3.5.3'

    That's the official letsencrypt client script trying to update itself. Not something under my control. It may have been a temporary connection issue to github

     

    I'll look into it but likely not something on my end

     

    Ok for some reason that container time is wrong by 8 hours so maybe that would cause an issue?

    Is your timezone set correctly in unraid?

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    I certainly have a very rudimentary understanding of how these dockers interact as I'm still quite confused as to what needs to be modified, and how.

     

    For instance, if I simply want Plexypy to run through https I would:

     

    1. Modify the nginx.conf by copy and pasting the following:

     

    # PlexyPy

    # https://github.com/linuxserver/docker-plexpy

    #

    # Settings => Web Interface

    # Change http root to /plexpy

    #

     

    location ^~ /plexpy/ {

        proxy_pass http://192.168.1.28:8181;

        include /config/nginx/proxy.conf;

        proxy_bind $server_addr;

        proxy_set_header X-Forwarded-Host $server_name;

        proxy_set_header X-Forwarded-Ssl    on;

    }

     

    Then I'd also have to place an .htpasswd file in ~/plexpy/.  But what are the contents of this .htpasswd file?

     

    It looks like letsencrypt is a bit more involved then some of your more basic plug and play apps.

     

    My goal is to be able to interact with these dockers securely from outside of my network.  So to do that, I've opened each ones respective port and assumed that as long as I have https running on each open port, I should be good to go? 

     

    Maybe if there's some basic primer on how this stuff works, if someone could point me in the right direction I could do some of my own readings rather than having to ask all of these random questions and re ask them when they're answered at a level beyond my understanding  :-[

    See the description at the following link for htpasswd, you just run a single command: https://hub.docker.com/r/linuxserver/letsencrypt/

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

     

     

    I converted from aptalca's Letsencrypt container over to this one today, thanks aptalca and the rest of LSIO for all your work on this!

     

    A few questions:

    1) In the old container, I could docker exec into it and run 

    nginx -t

    to have it check the config. But in the new container I have to specify which config file to test:

    nginx -c /config/nginx/nginx.conf -t

    Is there any way to make this the default?

     

    2) In the old container I could restart nginx with "service nginx restart".  How do you restart nginx in the new container, without actually restarting the whole container?

     

    3) In /etc/init.d/nginx, the pid is defined as /run/nginx/nginx.pid.  I think that should be /run/nginx.pid?  Hmm, when I try to exec that script it says: 

    /sbin/openrc-run: bad interpreter: No such file or directory

    Is /etc/init.d/nginx even used then?

     

    4) Since most people are using this for reverse proxy and not hosting a public website, it might make sense to drop a basic robots.txt file in the default www directory to keep search engines away:

    User-agent: *
Disallow: /

     

    1) Not that I know of. Old container used a lot of symlinks, which aren't ideal. New container defines files in place.

     

    2) s6-svc -h /var/run/s6/services/nginx

     

    3) Nginx is started by the s6 service manager. Check out the file /etc/services.d/nginx/run

     

    4) Some people host public wordpress sites. We design for the lowest common denominator, but you can always put whatever you need in the www folder as the container doesn't touch that as long as it exists

    (Support) Aptalca's docker templates

    in Docker Containers

    Posted

    Has anyone tried the HA bridge container with Google Home yet?

     

    https://github.com/bwssytems/ha-bridge/blob/master/README.md#google-assistant

    I believe it works, but you have to run it on port 80, and to do that, you have to move the unraid gui to a different port (instructions for that are on the forum that you should be able find easily)

     

    You would think that at this point and time in technology companies would stop using port 80 since most homes would already have something running on port 80, baffles me.

    The reason is that this bridge emulates a hue bridge. And the hue bridge (physical device) listens on port 80. From Google's perspective, there is nothing wrong with hardcoding the hue communication port because it is always 80. It is a problem for other software that pretend to be a hue bridge [emoji6]

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    Thank you,

     

    This community is amazing!

     

    All up and running now :)

     

    the last query I had was if I could set up multiple 'htpasswd' files.

     

    I want the server to be encrypted but it would be good if I could allow access to plexrequests with a separate password that way I could allow my users to make requests without giving them an overall admin logon which could be use to change settings etc.

     

    IIRC plex requests links to a plex username.  So probably best just to leave that without .htpasswd.

     

    You can setup different .htpasswd files.  But you need one per "group"

    You can also add multiple user pass combos to the same htpasswd file

    [Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

    in Docker Containers

    Posted

    Just looking into this for future use.  How would I handle having multiple domains pointing to the same server?

     

    Ex: My current nginx setup has 4 totally different domains, all coming in on the same ip/port then gets sorted out by nginx.

     

    Is something like that possible with this container? (I'm 100% new to letsencypt, only switching because of chrome/google no longer recognizing startssl)

    That's possible with letsencrypt, but not this container. This container only supports one domain with multiple subdomains

×
×
  • Create New...