bdschuster
commented
3 years ago So, I do know your trouble....this was a pain for a while at the end of last year for me...I did end up figuring out what we need to do, and have been using it for a while now, and discussed with @TechPerplexed for a moment, but I believe we are still planning on switching to a different proxy which would take care of this issue for a longer time than how it's setup now. Let us ponder on this for a moment, but yes, I know your trouble.
christeasdale
Otherwise, if your way is working, no, nothing will change that file on you unless we make a major update, minor updates won't change that file.
ltheakston
DPMUC
if you put it in the /var/local/Gooby/Plex folder, then use '/config/certificate.pfx' for location.
Encryption key is the export password you used.
and the domain should be "
thunderstorm654
I and many other Plex user have been having issues with the "New Player" in the Plex AndroidTV app. After a lot of research I found out that Plex "New Player" actually does a check before playback to make sure the connection is secure. If not it fails playback,
So by design Gooby's intention was to have the Plex server running behind the NGINX reverse proxy but if the official guide is followed that isn't the case. In 21-plex-beta.yaml. 21-plex-hw.yaml, 21-plex.yaml for the Docker containers all have this line:
-ADVERTISE_IP=https://plex.${MYDOMAIN}:8443
Okay if you have your domain set in Gooby for plex.MYDOMAIN the certificate pulled is only going to apply to plex.MYDOMAIN and you DNS will direct all secure traffic coming in on port 443 through NGNIX which then arrives to port 8443 and directs to your Docker container running on default Plex port 32400.
So to make this work correctly for me at least I had to change to this:
Plex yaml file line "-ADVERTISE_IP=https://plex.${MYDOMAIN}" which changes "Plex Settings->Network->Custom server access URLs to "https://plex.MYDOMAIN" which Plex.tv then uses on its website to let your Plex clients know how to find your Plex server securely using you LetsCrypt certificate.
This only works if you DISABLE, Plex's built in "Remote Access" completely.
If you keep the normal Gooby settings and use Plex's "Remote Access" your Plex traffic isn't going through NGNIX. The only reason it works at all this way is because of what many think is a bug in Docker, Ports exposed in Docker containers (in our Plex Gooby case 8443) are open to the public internet.
Plex's method of providing certificates is quite complicated with Wildcards, etc. So with the Gooby default settings applied and Plex "Remote Access" I found that going to plex.MYDOMAIN and attempting to login into my Plex Server the connection was NOT SECURE. Instead of using my LetsCrypt Certificate it was using a Plex INC owned certificate that was not valid because of course it didn't match the custom domain name plex.MYDOMAIN. It is unclear to me why in Plex server GUI or many apps it still shows a secure connection but it sure doesn't seem the correct way to deploy things. I think we are using multiple certificates and different routes to get to the Plex server instead of the NGNIX reverse proxy.
I know this works because I setup my Vultr Firewall and blocked all ports except for 443 and my setup worked and stock Gooby setup does not! I am not sure how we should proceed? I am no web expert so maybe I am missing something? I did however notice that none of the other services on Gooby, Emby, Jellyfin etc etc specify a port number after MYDOMAIN, so making sure all traffic goes through the NGINX reverse proxy.