Static media failure or some such, reverse proxy misconfiguration?

[kommserv]

Seems Netbox is the causality after our upgrade of the host server from bionic to jammy and the successfull restoration of all LXC containers (including the netbox container).

Before the upgrade, we were using LXC v3 installed using apt, and could set an Alias in the vhost on the reverse proxy (i.e., the LXC server) that pointed at Netbox's static folder inside its container's filesystem. https://github.com/netbox-community/netbox/discussions/8598#discussioncomment-2147712

Now this door is closed due to how LXC installed as snap mounts the LXD tree. It seems there's no way to install LXD using any other method than snap on Jammy(?)

Unfortunately, I have not been able to figure out how to handle this alias properly. I upgraded Netbox in place from 3.1.8 to 3.2.7, and using the otherwise identical Apache vhost file from before, got an error about a missing css file in the static directory. I also restored 3.1.8 and its database from backup, but got no closer to a working configuration. I tried changing ownership of Netbox's media/ and static/ folders to www-data, but with no apparent effect.

The Netbox systemd service (gunicorn) was confirmed working at port 8001 inside the container.

That's it, I'm out of time for now. Our Netbox instance is currently out of order.

• https://github.com/netbox-community/netbox/discussions/7831
• https://github.com/netbox-community/netbox/discussions/7511
• https://groups.google.com/g/netbox-discuss/c/B1AHwhKMY54
• https://docs.netbox.dev/en/stable/installation/5-http-server/
• https://arcaik.net/posts/how-to-install-netbox-with-apache-and-uwsgi/

[kommserv]

Snap-based LXD provides a symlink that may allow similar functionality: /var/snap/lxd/common/mntns/var/snap/lxd/common/lxd/storage-pools/default/containers/<container_name>/rootfs/opt/netbox/netbox/static/.

The symlink occurs here:

root@luxor:~
# sudo -u www-data ls -al /var/snap/lxd/common/mntns
lrwxrwxrwx 1 root root 15 apr 20 07:52 /var/snap/lxd/common/mntns -> /proc/1734/root

but unfortunately any path below this is unreadable by the Apache user:

# sudo -u www-data ls -al /var/snap/lxd/common/mntns/var/
ls: cannot access '/var/snap/lxd/common/mntns/var/': Permission denied

The question is thus: can we get www-data read access to files below /proc/1734/root/?

[kommserv]

Solved this by flipping the approach: mount the directory inside the container on the LXC host (aka the reverse proxy), along these lines (command runs on the LXC host):

bindfs /var/snap/lxd/common/mntns/var/snap/lxd/common/lxd/storage-pools/default/containers/<container>/rootfs/opt/netbox/netbox/static /media/lxd/<container>/netbox/static

For specifics see additions in README.md introduced in commit https://github.com/kommserv/netbox/commit/a7774ad61bf04c2737b3191da14b13e9f12311f2

With that we can continue using an Apache vhost on the reverse proxy without any need for a webserver on the container.

Thanks to @antitoine for demonstrating how this can be done. This makes use of the /var/snap/lxd/common/mntns symlink which LXD makes available as a gateway into the container's filesystem.