[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)

Marshalleq · May 14, 2020

All good and thanks so much! I'm so tired of cloud mail. Finally realised how to get around the lack of PTR on home ISP's. Amazing what happens when you sit down and actually work stuff out!

Marshalleq

bombz · May 14, 2020

2 hours ago, aptalca said:

Smh. You see the linuxserver version and the binhex version side by side in your screenshot and you still select the binhex version. Why? Not that there is anything wrong with that version, but I'm asking you to follow the simple steps outlined in the troubleshooting article. We put a lot of time into it and it gets frustrating when users still don't follow them even when we spell them out step by step.

The whole point of the troubleshooting article is so you can make sure that your ports are properly mapped and forwarded and that the container is accessible from the internet. Only then, you should try to set up letsencrypt. Otherwise there are too many reasons why it can fail and as you experienced, if it fails a bunch of times, you're throttled.

So read the directions carefully.

Thank you for your assistance.
I attempted linuxserver version (2015) first and it prompted a server error when I attempted to start it the binhex did not.

I can understand the frustration, I knew as soon as I responded the 'smh' was understandable.
Copy that on the troubleshooting steps and outlook. Its been a long few days on this.
Long story short I made some successful progress tonight, but good things came of it.

Continue some more tomorrow.

Ccheese4 · May 14, 2020

9 hours ago, aptalca said:

I recommend unraid console for those operations. Simple "cp sourcefilename targetfilename" will do what you want. And use "nano filename" to edit files

worked like a charm. Thanks!

KJThaDon · May 16, 2020

~~Anyone know where I can change the default error file locations?~~

~~I've tried adding something like this to one of my .conf~~

Nevermind. I fixed it below. Didn't have correct volume mapping path.

error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 506 507 508 510 511 /error.html;

location = /error.html {

  ssi on;
  internal;
  auth_basic off;
  root /config/www;
}

Edited May 16, 2020 by KJThaDon

izarkhin · May 16, 2020

HI guys,

My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached.

Thanks!

[removed].duckdns.org.conf letsencrypt.log

Edited May 16, 2020 by izarkhin

izarkhin · May 16, 2020

48 minutes ago, izarkhin said:

HI guys,

My certificate fails to renew. I have a free DuckDNS account that worked just fine before. I verified that the account is valid and has the correct IP address. What could be the problem? The config and the log files are attached.

Thanks!

[removed].duckdns.org.conf 1015 B · 0 downloads letsencrypt.log 3.05 kB · 0 downloads

Never mind! Turns out I needed to open port 80 for the challenge to work. All fine now.

TeCH-Guruz · May 16, 2020

did anyone ever manage to get a nginx subdomain proxy setup with bitnami's phpbb that you wouldn't mind sharing?

madaroda · May 17, 2020

I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP.

But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where?

saarg · May 17, 2020

7 hours ago, madaroda said:

I've set up Letsencrypt/nginx wildcard on an unraid docker with my own domain. Letsencrypt certificates appear to download fine. I've got sonarr, radarr and a few more subdomains edited and renamed in proxy-confs. Letsencrypt docker opens and ends in "Server ready." Domain.me and anything.domain.me resolve to correct IP.

But nothing opens. https://sonarr.domain.me et all are unable to establish a connection to the server, even though sonarr.domain.me pings correctly (to the WAN address). I suspect a config issue, but where?

Try following this https://blog.linuxserver.io/2019/07/10/troubleshooting-letsencrypt-image-port-mapping-and-forwarding/

Tucubanito07 · May 17, 2020

Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider.

Edited May 17, 2020 by Tucubanito07

aptalca · May 17, 2020

40 minutes ago, Tucubanito07 said:

Hey guys. I have followed this site to create a website using Wordpress but when i go to the https://servername.com it goes to my nextcloud. However, when i go to https://www.servername.com it gives me this site can be reached. Can someone help me figure out the issue please? i am using the EXTRA_DOMAIN parameters and i dont see the name of the domain i use on the logs. I only see the others from my DNS provider.

Post what you changed/tried to make it work and we'll take a look

Tucubanito07 · May 17, 2020

3 minutes ago, aptalca said:

Post what you changed/tried to make it work and we'll take a look

Thank you so much @aptalca This config is the one that this guide said to use. https://technicalramblings.com/blog/how-to-set-up-a-wordpress-site-with-letsencrypt-and-mariadb-on-unraid/

# REDIRECT WWW TO https://[domain.com]
server {
listen 80;
listen 443 ssl http2;
server_name www.domainname.com;
return 301 https://domainnamecom$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
listen 80;
server_name domainname.com;
return 301 https://domainname.com$request_uri;
}

# BLOG SITE
server {
listen 443 ssl http2;
server_name domainname.com;

## Source: https://github.com/1activegeek/nginx-config-collection
## READ THE COMMENT ON add_header X-Frame-Options AND add_header Content-Security-Policy IF YOU USE THIS ON A SUBDOMAIN YOU WANT TO IFRAME!

## Certificates from LE container placement
ssl_certificate /config/keys/letsencrypt/fullchain.pem;
ssl_certificate_key /config/keys/letsencrypt/privkey.pem;

## Strong Security recommended settings per cipherli.st
ssl_dhparam /config/nginx/dhparams.pem; # Bit value: 4096
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout 10m;

## NOTE: The add_header Content-Security-Policy won't work with duckdns since you don't own the root domain. Just buy a domain. It's cheap
## Settings to add strong security profile (A+ on securityheaders.io/ssllabs.com)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; #SET THIS TO index IF YOU WANT GOOGLE TO INDEX YOU SITE!
add_header Content-Security-Policy "frame-ancestors https://*.$server_name https://$server_name"; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header X-Frame-Options "ALLOW-FROM https://*.$server_name" always; ## Use *.domain.com, not *.sub.domain.com (*.$server_name) when using this on a sub-domain that you want to iframe!
add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#FEATURE POLICY: READ MORE HERE: https://scotthelme.co.uk/a-new-security-header-feature-policy/

proxy_cookie_path / "/; HTTPOnly; Secure"; ##NOTE: This may cause issues with unifi. Remove HTTPOnly; or create another ssl config for unifi.
more_set_headers "Server: Classified";
more_clear_headers 'X-Powered-By';

client_max_body_size 0;

root /config/www/wordpress/;
index index.html index.php;

location ~ /\. {
deny all;
}
location / {
try_files $uri $uri/ /index.php?_url=$uri&$query_string;
}

# PHP
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
# With php7-cgi alone:
fastcgi_pass 127.0.0.1:9000;
# With php7-fpm:
#fastcgi_pass unix:/var/run/php7-fpm.sock;
fastcgi_index index.php;
include /etc/nginx/fastcgi_params;
}

fastcgi_buffer_size 4K;
fastcgi_buffers 64 4k;
}

So i dont think that one is the one working. I copied the nextcloud config file and changed the name of the site server and also the app name. I believe this one is the ones that is working. Since it had nextcloud i changed it to WordPress and now i get a 502 Bad Gateway. Here is that config.

# make sure that your dns has a cname set for nextcloud
# assuming this container is called "letsencrypt", edit your nextcloud container's config
# located at /config/www/nextcloud/config/config.php and add the following lines before the ");":
# 'trusted_proxies' => ['letsencrypt'],
# 'overwrite.cli.url' => 'https://nextcloud.your-domain.com/',
# 'overwritehost' => 'nextcloud.your-domain.com',
# 'overwriteprotocol' => 'https',
#
# Also don't forget to add your domain name to the trusted domains array. It should look somewhat like this:
# array (
# 0 => '192.168.0.1:444', # This line may look different on your setup, don't modify it.
# 1 => 'nextcloud.your-domain.com',
# ),

server {
listen 443 ssl;
listen [::]:443 ssl;

server_name mydomainname.com;

include /config/nginx/ssl.conf;

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

client_max_body_size 0;

location / {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app WordPress;
set $upstream_port 443;
set $upstream_proto https;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;

proxy_max_temp_file_size 2048m;
}
}

Tucubanito07 · May 17, 2020

This is how the container looks

The logs look like this. I dont see the domain i own with google on the EXTRA_DOMAIN parameters.

saarg · May 17, 2020

You have probably used the wrong name for the variable. It's EXTRA_DOMAINS.

Show us how it looks like if you click Edit on Extra domain.

And please use the code tag if you insert config files or else it's a pain to read them.

Like this

Much easier to read for our sore eyes

Edited May 17, 2020 by saarg

Tucubanito07 · May 17, 2020

18 minutes ago, saarg said:
You have probably used the wrong name for the variable. It's EXTRA_DOMAINS.

Show us how it looks like if you click Edit on Extra domain.

And please use the code tag if you insert config files or else it's a pain to read them.
Like this

Much easier to read for our sore eyes

Ok so i was missing the S in EXTRA_DOMAINS i had EXTRA_DOMAIN. I do see that my domain on the logs does not have an error. Before i was doing domainname.com,www.domainname.com. The www.domainname.com was the one throwing an error. I delete it. Now i have been trying other configs like the ones above and grrr.

Tucubanito07 · May 17, 2020

This is the config i am using under letsencrypt/nginx/proxy-confs/

# REDIRECT WWW TO https://[domain.com]
server {
listen 80;
listen 443 ssl http2;
server_name www.domainame.com;
return 301 https://domainame.com$request_uri;
}

# REDIRECT HTTP TRAFFIC TO https://[domain.com]
server {
listen 80;
server_name domainame.com;
return 301 https://domainame.com$request_uri;
}

# BLOG SITE
server {
listen 443 ssl http2;
server_name domainame.com;