[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

[nraygun]

Is this anything to be concerned about? I see it in the syslog. The .45 address is my desktop PC. Everything seems to work (using Swag with Nextcloud).

 

Jul  6 09:27:47 server nginx: 2023/07/06 09:27:47 [error] 6177#6177: *927621 recv() failed (104: Connection reset by peer) while proxying upgraded connection, client: 192.168.0.45, server: , request: "GET //wsproxy/5701/ HTTP/1.1", upstream: "http://127.0.0.1:5701/", host: "server.local"

[allanp81]

Does anyone else have their Nextcloud docker set up to access externally via a subfolder? Mine worked perfectly before Nextcloud was ugpraded and now I can't get it to work no matter what I try. I used to be able to use https://my.domain.com/nextcloud and have that forward to the internal docker running at 192.168.7.11:8443 but now I can't get it to work with lots of errors regarding SSL handshakes etc.

 

Previously I had this in my default.conf within swag and it's worked fine for years:

 

location ^~ /nextcloud {
                proxy_pass https://192.168.7.11:8443;
                include /config/nginx/proxy.conf;
}

[MikaelTarquin]

For the last couple days, every one of my reverse proxied docker containers now shows this. This is annoying enough for me, but friends trying to access pages I host for them are understandably worried I've been hacked, despite me assuring them this is some quirk of Google security monitoring or something. I've tried updating the SSL.conf in the swag appdata folder and uncommenting basically everything at the bottom of that, but it doesn't seem to be helping. How can I make this go away?

[alturismo]

3 hours ago, MikaelTarquin said:

I've tried updating the SSL.conf in the swag appdata folder and uncommenting basically everything at the bottom of that, but it doesn't seem to be helping. How can I make this go away?

what does the swag logs say, especially when you start the docker and it tries to refresh the certs ...

[MikaelTarquin]

14 hours ago, alturismo said:

what does the swag logs say, especially when you start the docker and it tries to refresh the certs ...

 

Sorry for the screenshot log, I don't have a better way at the moment of sharing it. It looks unchanged from what I remember it saying in the past.

 

My nextcloud reverse proxy has stopped working (again, I swear that thing hates being reverse proxied more than anything), but I don't think that's related. I'm assuming an update broke it for the nth time.

 

[alturismo]

9 hours ago, MikaelTarquin said:

It looks unchanged from what I remember it saying in the past.

yep, swag and ssl cert refresh are looking fine.

 

i guess this is nothing swag related, i would search for the error on self hosted sites and look what could cause this ...

 

i see some different reasons and as im not using the services ... cant really help from my side, when i google it its now looking like you are flagged as malware ... sorry, may someone else can chim in if somebody else had this before, but i would search for it ...

[MikaelTarquin]

3 hours ago, alturismo said:

yep, swag and ssl cert refresh are looking fine.

 

i guess this is nothing swag related, i would search for the error on self hosted sites and look what could cause this ...

 

i see some different reasons and as im not using the services ... cant really help from my side, when i google it its now looking like you are flagged as malware ... sorry, may someone else can chim in if somebody else had this before, but i would search for it ...

 

All I've been able to find so far is some fairly unhelpful discussion about Security Headers, which I think by uncommenting the lines in the SSL configuration file, I've already done. Swag, duckdns, and namecheap are the only common threads I can think of. Bummer.

[allanp81]

I still cannot get my nextcloud instance to work with swag anymore. I've tried everything I can think of but can't get it to work.

[MikaelTarquin]

4 hours ago, allanp81 said:

I still cannot get my nextcloud instance to work with swag anymore. I've tried everything I can think of but can't get it to work.

Did you upgrade the nextcloud version inside the web UI before upgrading the docker? I finally got mine working again last night and pinned the docker to release 27 so that it doesn't break again. This page helped me a lot:

 

https://info.linuxserver.io/issues/2023-06-25-nextcloud/

[nraygun]

On 7/6/2023 at 9:58 AM, nraygun said:

Is this anything to be concerned about? I see it in the syslog. The .45 address is my desktop PC. Everything seems to work (using Swag with Nextcloud).

 

Jul  6 09:27:47 server nginx: 2023/07/06 09:27:47 [error] 6177#6177: *927621 recv() failed (104: Connection reset by peer) while proxying upgraded connection, client: 192.168.0.45, server: , request: "GET //wsproxy/5701/ HTTP/1.1", upstream: "http://127.0.0.1:5701/", host: "server.local"

This error has stopped. Not sure why. I guess it's OK.

If anyone know anything further about this error, please let me know.

[allanp81]

17 hours ago, MikaelTarquin said:

Did you upgrade the nextcloud version inside the web UI before upgrading the docker? I finally got mine working again last night and pinned the docker to release 27 so that it doesn't break again. This page helped me a lot:

 

https://info.linuxserver.io/issues/2023-06-25-nextcloud/

Originally I tried to get my docker to update etc. but gave up and ended up renaming the appdata folder and letting it create new and then copied back my config.php.

 

My instance works fine internally and things sync etc. but I can't get external access to work anymore when I try to replicate the settings I had applied to nginx and nextcloud. The main issue from the logs appears to be an SSL handshake problem but I don't recall having to do anything fancy other than change the url base to /nextcloud and add ips and hostnames to the trusted domains and trusted proxies etc.

[eagle470]

I have been trying to get Rocket.Chat to work with swag all week, currently RC works fine, I can go to it's port and everything works there.

 

I can see the SWAG splash page on my domain proper, but for the subdomain (rocketchat.mydomain.net) nothing comes up.

 

I have everything running on a customer docker net, I can ping SWAG from the RC instance. I have the database connection running on the custome docker net as well.

 

Nginx has NOTHING in the error logs.

 

SWAG looks up, I see no errors at all. I can see the swag instance from my public IP as well, so thats resolving too.

 

I used the SIO video to setup RC, everything worked swell up to the swag point. I checked the RC documentation and the nginx config file hasn't changed.

 

I'm more than happy to throw logs up here, let me know what you want to see.

[vurt]

Has anyone encountered an issue with ZeroSSL? I didn't know this previously or it might be a change on their end, but I've ran out of "credits" on the free plan to renew my SSL cert.

[alturismo]

11 hours ago, vurt said:

Has anyone encountered an issue with ZeroSSL? I didn't know this previously or it might be a change on their end, but I've ran out of "credits" on the free plan to renew my SSL cert.

what does zero ssl support says about this ?

[vurt]

On 7/24/2023 at 12:32 AM, alturismo said:

what does zero ssl support says about this ?

 

Sorry I didn't contact them, I wanted to check in here if other SWAG users have encountered this.

 

I noticed my SSL cert expired and when I went looking, I saw this on ZeroSSL.

 

 

 

It looks like they've changed this so it's no longer free and unlimited, and it doesn't look like we can get wildcards at all unless we upgrade to their Premium plan.

Looks self-explanatory but I wanted to confirm I'm not ... crazy or other SWAG users have worked around this.

 

 

Edited July 26, 2023 by vurt

[hansolo77]

Got a question...  I just set up SWAG so I can access my newly installed Nextcloud docker.  Working great so far.  Earlier today I tried to access my Unraid server while at work on my phone.  When I tried to access the url I typically used (subdomain.domain.org) it came up with the SWAG page rather than the Unraid page.  I imagine this is typical behavior now for whenever I access my server's address.  Trouble is, I don't know how to get around it.  To get Nextcloud to work, I had to follow our old pal SpaceInvader's video.  I don't know what to do now to access my server.  I checked the `/proxy-confs/` folder but it doesn't have a template sample for this particular situation.  So.. yeah.. what do I do?

[alturismo]

9 hours ago, hansolo77 said:

I checked the `/proxy-confs/` folder but it doesn't have a template sample for this particular situation.  So.. yeah.. what do I do?

make your own config ... when you check that folder you see in the top sample's for "not by lsio preconfigured config's".

 

btw, most say its not recommended todo so ... and you should be aware, when publishing your server to www ... you ´know what you do, if somebody is hacking your pass then ... he has control of everything then ...

[alturismo]

9 hours ago, hansolo77 said:

So.. yeah.. what do I do?

may as addon, you know Unraid is offering a webui access via Unraid Connect ... may take a look there instead

[hansolo77]

Ok thanks!

[hansolo77]

14 hours ago, alturismo said:

may as addon, you know Unraid is offering a webui access via Unraid Connect ... may take a look there instead

 

I had the MyServers addon installed and working, but it's not working either.  Now it just sits there unable to connect.  I have OpenVPN on my router, I'm going to try and see if I export a config for that to my phone.  It works great with my tablet.

[Smith007]

Hi, I have the following mapping for my SWAG docker container:

 

172.16.0.2:443/TCP 192.168.1.10:1443
172.16.0.2:80/TCP 192.168.1.10:180

 

where 192.168.1.10 is the main IP address of my Unraid server and hence I use ports 1443/180 instead of 443/80, as those are already taken.

 

I do have free IP address in 192.168.1.0/24 range and would like SWAG to listen on dedicated IP, i.e. 192.168.1.11 (and possibly other IPs from this range, for different proxied services). That way I could bind it to regular 443/80 ports (assuming no other docker containers would use that IP).

 

How shall I approach this? I'm thinking some additional parameters for SWAG container would help? if so, shall I somehow make additional IPs available for the docker first?

Edited July 30, 2023 by Smith007

[KoNeko]

been running swag for a very long time now but this is the first time my swag container does not want to update.

It says there is a update but when i click apply it seems like it updates and all  is fine and after that it still says there is a update.

 

the Container does work and no other problems. Wondering if more people have the same problem? I have the same with the vaultwarden docker ( which is behind Swag)

 

Edit:

i did restart my router and it started working again. for all containers

Edited July 30, 2023 by KoNeko
reason fixed

[alturismo]

9 hours ago, Smith007 said:

How shall I approach this? I'm thinking some additional parameters for SWAG container would help? if so, shall I somehow make additional IPs available for the docker first?

use custom br0 and assign your (free) ip to the docker, then its already listening in the default ports (as mapping is then obsolete).

 

be aware of the macvlan / ipvlan issues which some have issues with ...

[Smith007]

2 hours ago, alturismo said:

use custom br0 and assign your (free) ip to the docker, then its already listening in the default ports (as mapping is then obsolete).

Thanks for your answer, but how exactly to assign an IP to the docker? Sorry, but this is the part I'm probably struggling with...

[alturismo]

4 hours ago, Smith007 said:

but how exactly to assign an IP to the docker?

 

may start reading your options  docker, edit ...

 

 

but ... please also read about it what else would be to set etc ... and how it behaves then ...

 

as starter those 2 ...

 

 

ans so on, also, this is not swag docker related, rather post or search in the general part/s.