search

ajslater / codex

Codex is a web based comic archive browser and reader
GNU General Public License v3.0
202 stars 6 forks source link

HTTPS via Tailscale Problem #334

Open PoloDePoli opened 10 months ago

PoloDePoli commented 10 months ago

This could very well be a user issue

With the update to iOS 17 it appears that apps (e.g. Panels) cannot anymore work with non HTTPS file when outside a local network.

Previously I used to access my Codex library via simple HTTP through http://192.168.1.2:9810/opds/v1.2/r/0/1 (when at home and through http://machine.domain.ts.net:9810/opds/v1.2/r/0/1 (i.e. the tailscale magic dns) when outside home.

Due to the iOS 17 I have created and enabled the Tailscale certificate via Let's Encrypt. The certificate seems to work fine for those docker containers that have HTTPS capabilities (and for the main homepage of my Synology NAS). However for Codex I get the error: "Connection Not Encrypted. The website machine.domain.ts.net does not support encryption for the page you are viewing".

With the other containers instead I get the "Connection Encrypted (TLS_......)"

When trying to add the Tailscale version of the opds code to Panels I get "Unable to Find Server" even though the server is running just fine and working flawlessly when using the 192 address [and the tailscale address used to work fine with just HTTP before the move to iOS 17]

I know a similar issue was flagged in https://github.com/ajslater/codex/issues/330, however that issue related to reverse proxy while this one is specifically about using Codex with HTTPS within a Tailscale network

Thanks for any help Error Message

ajslater commented 10 months ago

Thanks for the very technical writeup. I'll take a look.

On Thu, Nov 16, 2023 at 1:45 PM PoloDePoli @.***> wrote:

This could very well be a user issue

With the update to iOS 17 it appears that apps (e.g. Panels) cannot anymore work with non HTTPS file when outside a local network.

Previously I used to access my Codex library via simple HTTP through http://192.168.1.2:9810/opds/v1.2/r/0/1 (when at home and through http://machine.domain.ts.net:9810/opds/v1.2/r/0/1 (i.e. the tailscale magic dns) when outside home.

Due to the iOS 17 I have created and enabled the Tailscale certificate via Let's Encrypt. The certificate seems to work fine for those docker containers that have HTTPS capabilities (and for the main homepage of my Synology NAS). However for Codex I get the error: "Connection Not Encrypted. The website machine.domain.ts.net does not support encryption for the page you are viewing".

With the other containers instead I get the "Connection Encrypted (TLS_......)"

When trying to add the Tailscale version of the opds code to Panels I get "Unable to Find Server" even though the server is running just fine and working flawlessly when using the 192 address [and the tailscale address used to work fine with just HTTP before the move to iOS 17]

I know a similar issue was flagged in #330 https://github.com/ajslater/codex/issues/330, however that issue related to reverse proxy while this one is specifically about using Codex with HTTPS within a Tailscale network

Thanks for any help [image: Error Message] https://user-images.githubusercontent.com/34724297/283605198-a6558425-389e-4d66-bef9-12a1ac3f320d.png

— Reply to this email directly, view it on GitHub https://github.com/ajslater/codex/issues/334, or unsubscribe https://github.com/notifications/unsubscribe-auth/AACAKRX36Q4I4RQ6NNEXFBDYE2CN7AVCNFSM6AAAAAA7O3CRVOVHI2DSMVQWIX3LMV43ASLTON2WKOZRHE4TOOBUGQ3DMOI . You are receiving this because you are subscribed to this thread.Message ID: @.***>

PoloDePoli commented 10 months ago

Thank you.

Just an update: I tried changing the network mode for the Codex container to host in case the issue was with using the bridge mode. I still get the error that it is not possible to connect securely.

I wonder if it has something to do with https://www.devopsschool.com/blog/how-to-configure-docker-container-with-https/ (but most of it is above my head as I only use docker not create containers) and whether it would require to add a https port (e.g. 9811) for it to be used (either via bridge or more likely via host network mode)

PoloDePoli commented 10 months ago

Some further research came across https://tailscale.dev/blog/docker-mod-tailscale It appears that for containers based on linuxserver.io images it is possible to add those containers on the tailscale network directly (e.g. using the previous nomenclature https://codex_container.domain.ts.net:9810/opds/v1.2/r/0/1) which might be an alternative option