btcpayserver / btcpayserver-docker

Docker resources for hosting BTCPayServer easily
MIT License
590 stars 364 forks source link

BTCPAY_ENABLE_SSH not working #198

Closed ndeet closed 5 years ago

ndeet commented 5 years ago

I did not use the SSH functionality at all in my setups because I ran updates from command line all the time.

Reading the current release notes of 1.0.3.132 I gave the instructions a try on my testnet rpi4 and ran:

BTCPAY_ENABLE_SSH=true
. btcpay-setup.sh -i

This seems to make trouble on the container startup of btcpayserver, spark and charge:

root@testpi:~/btcpayserver/btcpayserver-docker# docker ps
CONTAINER ID        IMAGE                                                     COMMAND                  CREATED             STATUS                         PORTS                                                                   NAMES
83732de3d6d2        btcpayserver/letsencrypt-nginx-proxy-companion:1.11.2.1   "/bin/bash /app/entr…"   28 seconds ago      Up 25 seconds                                                                                          letsencrypt-nginx-proxy-companion
7c0f9092eca2        btcpayserver/docker-gen:0.7.6                             "/usr/local/bin/dock…"   32 seconds ago      Up 29 seconds                                                                                          nginx-gen
f23659ac52b0        btcpayserver/btcpayserver:1.0.3.132                       "/app/docker-entrypo…"   35 seconds ago      Up 1 second                    49392/tcp                                                               generated_btcpayserver_1
513610b29a86        shesek/spark-wallet:0.2.8-standalone                      "tini -g -- scripts/…"   3 minutes ago       Restarting (1) 8 seconds ago                                                                           generated_clightning_bitcoin_spark_1
a861962621da        shesek/lightning-charge:0.4.6-standalone                  "bin/docker-entrypoi…"   3 minutes ago       Restarting (1) 8 seconds ago                                                                           generated_clightning_bitcoin_charge_1
1b7e2d7593f0        btcpayserver/lightning:v0.7.2                             "/usr/bin/tini -g --…"   3 minutes ago       Up 3 minutes                   0.0.0.0:9735->9735/tcp, 9835/tcp                                        btcpayserver_clightning_bitcoin
aa541c621a28        btcpayserver/bitcoin:0.18.0                               "/entrypoint.sh bitc…"   3 minutes ago       Up 3 minutes                   8332-8333/tcp, 18332-18333/tcp, 18443-18444/tcp, 39388/tcp, 43782/tcp   btcpayserver_bitcoind
4d0c3474cbc6        btcpayserver/docker-gen:0.7.6                             "/usr/local/bin/dock…"   3 minutes ago       Up 3 minutes                                                                                           tor-gen
9b64d0c59b49        nginx:1.16.0                                              "nginx -g 'daemon of…"   3 minutes ago       Up 3 minutes                   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp                                nginx
9f4008fb2091        btcpayserver/tor:0.4.1.5                                  "./entrypoint.sh tor"    3 minutes ago       Up 3 minutes                   9050-9051/tcp                                                           tor
b99365963359        postgres:9.6.5                                            "docker-entrypoint.s…"   3 minutes ago       Up 3 minutes                   5432/tcp                                                                generated_postgres_1
b0a9f9abaa6a        nicolasdorier/nbxplorer:2.0.0.57                          "dotnet NBXplorer.dll"   3 minutes ago       Up 3 minutes                   32838/tcp                                                               generated_nbxplorer_1

btcpayserver logs:

root@testpi:~/btcpayserver/btcpayserver-docker# docker logs generated_btcpayserver_1
/app/docker-entrypoint.sh: 5: /app/docker-entrypoint.sh: [[: not found
/app/docker-entrypoint.sh: 16: /app/docker-entrypoint.sh: [[: not found
info: Configuration:  Data Directory: /datadir
info: Configuration:  Configuration File: /datadir/TestNet/settings.config
info: Configuration:  Network: Testnet
info: Configuration:  Supported chains: BTC
fail: Configuration:  sshkeyfile does not exist
fail: Configuration:  Configuration error

I also tried to restart in case some container where not properly restarted. Same problem.

NicolasDorier commented 5 years ago

wtf, checking this now.

NicolasDorier commented 5 years ago

Should be fixed in .133 can you give a try?

ndeet commented 5 years ago

Thank you but something still wrong I fear.

After updating and setting the env variable and doing setup again, nginx 502 error and logs:

root@testpi:~/btcpayserver/btcpayserver-docker# docker logs generated_btcpayserver_1
Creating BTCPay Server SSH key File...
Adding BTCPay Server SSH key to authorized keys
info: Configuration:  Data Directory: /datadir
info: Configuration:  Configuration File: /datadir/TestNet/settings.config
info: Configuration:  Network: Testnet
info: Configuration:  Supported chains: BTC
info: Configuration:  LogFile: btcpay.log
info: Configuration:  Log Level: Debug
info: Configuration:  Network: Testnet
info: Configuration:  Supported chains: BTC
info: Configuration:  LogFile: btcpay.log
info: Configuration:  Log Level: Debug
info: Configuration:  Postgres DB used (User ID=postgres;Host=postgres;Port=5432;Database=btcpayservertestnet)
info: Configuration:  Root Path: /
info: Configuration:  BTC: Explorer url is http://nbxplorer:32838/
info: Configuration:  BTC: Cookie file is /root/.nbxplorer/TestNet/.cookie
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
info: PayServer:      Starting listening NBXplorer (BTC)
info: PayServer:      Start watching invoices
info: Events:         NBXplorer BTC: NotConnected => Ready
info: PayServer:      BTC: Checking if any pending invoice got paid while offline...
info: PayServer:      Starting payment request expiration watcher
info: Configuration:  Listening on http://0.0.0.0:49392
info: PayServer:      BTC: 0 payments happened while offline
info: PayServer:      Connected to WebSocket of NBXplorer (BTC)
info: PayServer:      0 pending payment requests being checked since last run
info: Events:         BTC: New block
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 10 seconds
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 20 seconds
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...

Restarted the Pi and now the site is up again which is good but going to maintenance page I see the error:

Error: Maintenance feature requires access to SSH properly configured in BTCPayServer configuration

seems spark + charge restart loop

root@testpi:~# docker ps
CONTAINER ID        IMAGE                                                     COMMAND                  CREATED             STATUS                          PORTS                                                                   NAMES
f590b08a4d7a        btcpayserver/letsencrypt-nginx-proxy-companion:1.11.2.1   "/bin/bash /app/entr…"   4 minutes ago       Up 4 minutes                                                                                            letsencrypt-nginx-proxy-companion
f76c416d924a        btcpayserver/docker-gen:0.7.6                             "/usr/local/bin/dock…"   4 minutes ago       Up 4 minutes                                                                                            nginx-gen
b8b34ecae5d1        btcpayserver/btcpayserver:1.0.3.133                       "/app/docker-entrypo…"   4 minutes ago       Up 4 minutes                    49392/tcp                                                               generated_btcpayserver_1
098b2ee8b0b2        shesek/spark-wallet:0.2.8-standalone                      "tini -g -- scripts/…"   4 minutes ago       Restarting (1) 13 seconds ago                                                                           generated_clightning_bitcoin_spark_1
e56d138d5eea        shesek/lightning-charge:0.4.6-standalone                  "bin/docker-entrypoi…"   4 minutes ago       Restarting (1) 14 seconds ago                                                                           generated_clightning_bitcoin_charge_1
f2008a4d8a18        btcpayserver/lightning:v0.7.2                             "/usr/bin/tini -g --…"   4 minutes ago       Up 4 minutes                    0.0.0.0:9735->9735/tcp, 9835/tcp                                        btcpayserver_clightning_bitcoin
6e3ecc0f9dcf        btcpayserver/bitcoin:0.18.0                               "/entrypoint.sh bitc…"   4 minutes ago       Up 4 minutes                    8332-8333/tcp, 18332-18333/tcp, 18443-18444/tcp, 39388/tcp, 43782/tcp   btcpayserver_bitcoind
ec497db1195e        btcpayserver/docker-gen:0.7.6                             "/usr/local/bin/dock…"   4 minutes ago       Up 4 minutes                                                                                            tor-gen
41c37b44ea86        nginx:1.16.0                                              "nginx -g 'daemon of…"   4 minutes ago       Up 4 minutes                    0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp                                nginx
ba18f32334c8        btcpayserver/tor:0.4.1.5                                  "./entrypoint.sh tor"    4 minutes ago       Up 4 minutes                    9050-9051/tcp                                                           tor
9271e6067b3c        nicolasdorier/nbxplorer:2.0.0.57                          "dotnet NBXplorer.dll"   4 minutes ago       Up 4 minutes                    32838/tcp                                                               generated_nbxplorer_1
4d2dd8daa818        postgres:9.6.5                                            "docker-entrypoint.s…"   4 minutes ago       Up 4 minutes                    5432/tcp                                                                generated_postgres_1
root@testpi:~# docker logs generated_btcpayserver_1
info: Configuration:  Data Directory: /datadir
info: Configuration:  Configuration File: /datadir/TestNet/settings.config
info: Configuration:  Network: Testnet
info: Configuration:  Supported chains: BTC
info: Configuration:  LogFile: btcpay.log
info: Configuration:  Log Level: Debug
info: Configuration:  Network: Testnet
info: Configuration:  Supported chains: BTC
info: Configuration:  LogFile: btcpay.log
info: Configuration:  Log Level: Debug
info: Configuration:  Postgres DB used (User ID=postgres;Host=postgres;Port=5432;Database=btcpayservertestnet)
info: Configuration:  Root Path: /
info: Configuration:  BTC: Explorer url is http://nbxplorer:32838/
info: Configuration:  BTC: Cookie file is /root/.nbxplorer/TestNet/.cookie
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
info: PayServer:      Starting listening NBXplorer (BTC)
info: PayServer:      Start watching invoices
info: PayServer:      Starting payment request expiration watcher
info: Configuration:  Listening on http://0.0.0.0:49392
warn: PayServer:      Error while contacting ndax: No MediaTypeFormatter is available to read an object of type 'Dictionary`2' from content with media type 'text/html'.
info: PayServer:      0 pending payment requests being checked since last run
info: Events:         NBXplorer BTC: NotConnected => Synching
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 10 seconds
info: Events:         NBXplorer BTC: Synching => Ready
info: PayServer:      BTC: Checking if any pending invoice got paid while offline...
info: PayServer:      BTC: 0 payments happened while offline
info: PayServer:      Connected to WebSocket of NBXplorer (BTC)
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
info: PayServer:      User logged in.
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 20 seconds
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 40 seconds
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 80 seconds
info: Configuration:  SSH settings detected, testing connection to root@host.docker.internal on port 22 ...
info: Events:         BTC: New block
warn: Configuration:  SSH connection issue of type SshOperationTimeoutException: Connection failed to establish within 30000 milliseconds.
warn: Configuration:  Retrying SSH connection in 160 seconds
NicolasDorier commented 5 years ago

Given the error, I am almost sure it comes from a firewall. Have you done something there?

ndeet commented 5 years ago

Oh yeah good catch, I followed the pi guide and only allowed my internal subnet of 10.14.1.x to connect port 22. Guess this differs from internal docker lan and why it fails now. Any automated solution to this or do I need to find out the docker subnet and allow it manually?

NicolasDorier commented 5 years ago

@ndeet mmh good question. I never setup the firewall. I think you can get the network programatically via docker cli, but I don't know how. Probably need to update the article.

NicolasDorier commented 5 years ago

I see Error while contacting ndax: No MediaTypeFormatter is available, this is not a big deal, but quite strange, what do you see if you browse to https://ndax.io/api/returnTicker ?

ndeet commented 5 years ago

I think the other errors/warnings could be caused because there are no invoices yet on the testpi? on ndax.io I see the JSON array of current prices:

{
"ETH_CAD": {
"isFrozen": "0",
"lowestAsk": "269.39",
"highestBid": "262",
...

Seems internally docker is using 172.16.0.0 - 172.18.0.0 ranges + 169.something (not sure if needed). Because not all of 172. ip range is private ips (only 172.16 to 172.31.) we need to whitelist with /12 subnet (which covers that range).

ufw allow from 172.16.0.0/12 to any port 22
NicolasDorier commented 5 years ago

@ndeet I don't know if this subnet is always the same or if it can change.

ndeet commented 5 years ago

Yeah does not work after several reboots, thats's why I tried the whole private ip range of 172.16. but seems not working all the time ... so maybe we open up to public which is also suboptimal but router should not forward any port by default anyway, so not sure if these ufw settings are needed at all. on the other hand keeping things closed is also a good approach

NicolasDorier commented 5 years ago

@ndeet I have the same problem. This is weird. (no firewall)

NicolasDorier commented 5 years ago

So I can use ssh cli from inside the docker container and connect to the host with the file. So this has something to do with btcpay. This is weird.

NicolasDorier commented 5 years ago

My error: SSH connection issue of type SshConnectionException: Key exchange negotiation failed.

NicolasDorier commented 5 years ago

So my error SshConnectionException: Key exchange negotiation failed came because I renewed the ssh host keys after the setup. I removed the check for that since we just connect locally.

NicolasDorier commented 5 years ago

hey @ndeet my problem about "Key exchange negotiation failed" is my own fault.

If you still get connection timeout then the firewall is definitely preventing connection. Maybe you can see in the logs?

ndeet commented 5 years ago

Closing as the documented change in #345 fixes it finally without any random connection errors after restarts.