SSL Internal Error - Unraid Docker

[sly83910]

Hi, good morning from France. I'am pretty newbie here.

On Déc 2020 i installed NPM and all works fine, i have 5 subdomains with SSL certificats.

One of certificat expire and when i renew it, i have an internal errors. I try lots of things but nothing works and i have rates limit.

I created new subdomain to test, the redirect works fine but impossible to create SSL.

In the log at the end i have this

File "/usr/bin/certbot", line 11, in <module> load_entry_point('certbot==1.4.0', 'console_scripts', 'certbot')() File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main return internal_main.main(cli_args) File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1347, in main return config.func(config, plugins) File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1233, in certonly lineage = _get_and_save_cert(le_client, config, domains, certname, lineage) File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 121, in _get_and_save_cert lineage = le_client.obtain_and_enroll_certificate(domains, certname) File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 423, in obtain_and_enroll_certificate return storage.RenewableCert.new_lineage( File "/usr/lib/python3.8/site-packages/certbot/_internal/storage.py", line 1054, in new_lineage new_config = write_renewal_config(config_filename, config_filename, archive, File "/usr/lib/python3.8/site-packages/certbot/_internal/storage.py", line 148, in write_renewal_config filesystem.chmod(n_filename, current_permissions) File "/usr/lib/python3.8/site-packages/certbot/compat/filesystem.py", line 40, in chmod os.chmod(file_path, mode) PermissionError: [Errno 1] Operation not permitted: '/etc/letsencrypt/renewal/npm-11.conf' 2021-05-08 09:06:29,767:ERROR:certbot._internal.log:An unexpected error occurred:

Somebody can help me?

Thnaks a lot

[jlesage]

This show permission errors. Do the permissions changed on the app data folder /mnt/user/appdata/NginxProxyManager) ?

[sly83910]

Hi, Thanks for reply

I don't change permission

root@NAS-SLY:/mnt/disks/SSD/appdata# ls -l NginxProxyManager/ total 117 drwxrwxrwx 1 root root 0 May 8 07:59 access/ drwxrwxrwx 1 root root 0 May 8 07:59 custom_ssl/ -rwxrwxrwx 1 root root 102400 May 10 08:57 database.sqlite drwxrwxrwx 1 root root 4096 May 10 08:57 letsencrypt/ drwxrwxrwx 1 root root 0 May 8 09:06 letsencrypt-acme-challenge/ drwxrwxrwx 1 root root 0 May 10 08:57 letsencrypt-workdir/ drwxrwxrwx 1 root root 4096 May 8 08:10 log/ -rwxrwxrwx 1 root root 29 May 8 07:59 logrotate.status -rwxrwxrwx 1 root root 0 May 10 08:57 logrotate.status.tmp drwxrwxrwx 1 root root 4096 May 10 08:57 nginx/ -rwxrwxrwx 1 root root 2414 May 8 08:00 production.json root@NAS-SLY:/mnt/disks/SSD/appdata#

[jlesage]

Looks like something changed ownership of the folder. Has you can see, files are owned by root.

You can restore the proper ownership by running:

docker stop NginxProxyManager
chown -R nobody:users /mnt/disks/SSD/appdata/NginxProxyManager
docker start NginxProxyManager

[sly83910]

I try chown on chown -R nobody:users /mnt/disks/SSD/appdata/NginxProxyManager chown -R nobody:users /mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt chown -R nobody:users /mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal

But same permission error

Can you give you more informations?

Paste of internal error:

Error: Command failed: /usr/bin/certbot certonly --non-interactive --config "/etc/letsencrypt.ini" --cert-name "npm-22" --agree-tos --email "blondet.sylvain@gmail.com" --preferred-challenges "dns,http" --domains "unraid1.sly83.ovh" Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator webroot, Installer None Obtaining a new certificate An unexpected error occurred: PermissionError: [Errno 1] Operation not permitted: '/etc/letsencrypt/renewal/npm-22.conf' Please see the logfiles in /var/log/letsencrypt for more details.

at ChildProcess.exithandler (child_process.js:308:12)
at ChildProcess.emit (events.js:314:20)
at maybeClose (internal/child_process.js:1022:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:287:5)

When i open npm-22.conf the file is empty

[jlesage]

Are you using default container settings ?

Can you provide the output of the following commands:

• ls -l /mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal
• docker inspect NginxProxyManager

[sly83910]

I think yes

root@NAS-SLY:/mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal# ls -l /mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal total 0 -rwxrwxrwx 1 root root 0 May 8 09:06 npm-11.conf -rwxrwxrwx 1 root root 0 May 8 09:44 npm-13.conf -rwxrwxrwx 1 root root 0 May 8 09:48 npm-14.conf -rwxrwxrwx 1 root root 0 May 8 09:52 npm-15.conf -rwxrwxrwx 1 root root 0 May 10 14:22 npm-18.conf -rwxrwxrwx 1 root root 0 May 10 14:24 npm-19.conf -rwxrwxrwx 1 root root 0 May 8 08:11 npm-2.conf -rwxrwxrwx 1 root root 0 May 10 14:27 npm-21.conf -rwxrwxrwx 1 root root 0 May 10 14:28 npm-22.conf -rwxrwxrwx 1 root root 0 May 8 08:32 npm-4.conf -rwxrwxrwx 1 root root 0 May 8 08:33 npm-5.conf -rwxrwxrwx 1 root root 0 May 8 08:34 npm-6.conf -rwxrwxrwx 1 root root 0 May 8 08:39 npm-7.conf -rwxrwxrwx 1 root root 0 May 8 08:46 npm-8.conf root@NAS-SLY:/mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal#

root@NAS-SLY:/mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal# docker inspect NginxProxyManager [ { "Id": "aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279", "Created": "2021-05-08T08:16:32.859856881Z", "Path": "/init", "Args": [], "State": { "Status": "running", "Running": true, "Paused": false, "Restarting": false, "OOMKilled": false, "Dead": false, "Pid": 10753, "ExitCode": 0, "Error": "", "StartedAt": "2021-05-10T12:25:51.35200859Z", "FinishedAt": "2021-05-10T12:25:32.521695488Z" }, "Image": "sha256:36d82e1382b870fd62145ca18cf4e6693657f37973736101c46eb86899a4dac0", "ResolvConfPath": "/var/lib/docker/containers/aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279/resolv.conf", "HostnamePath": "/var/lib/docker/containers/aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279/hostname", "HostsPath": "/var/lib/docker/containers/aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279/hosts", "LogPath": "/var/lib/docker/containers/aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279/aa317000743209b29c1e5ae3400931fa8584a100006b3ca92773ea157dbb3279-json.log", "Name": "/NginxProxyManager", "RestartCount": 0, "Driver": "btrfs", "Platform": "linux", "MountLabel": "", "ProcessLabel": "", "AppArmorProfile": "", "ExecIDs": null, "HostConfig": { "Binds": [ "/mnt/disks/SSD/appdata/NginxProxyManager:/config:rw" ], "ContainerIDFile": "", "LogConfig": { "Type": "json-file", "Config": { "max-file": "1", "max-size": "50m" } }, "NetworkMode": "sly", "PortBindings": { "4443/tcp": [ { "HostIp": "", "HostPort": "18443" } ], "8080/tcp": [ { "HostIp": "", "HostPort": "1880" } ], "8181/tcp": [ { "HostIp": "", "HostPort": "7818" } ] }, "RestartPolicy": { "Name": "no", "MaximumRetryCount": 0 }, "AutoRemove": false, "VolumeDriver": "", "VolumesFrom": null, "CapAdd": null, "CapDrop": null, "Capabilities": null, "Dns": [], "DnsOptions": [], "DnsSearch": [], "ExtraHosts": null, "GroupAdd": null, "IpcMode": "private", "Cgroup": "", "Links": null, "OomScoreAdj": 0, "PidMode": "", "Privileged": true, "PublishAllPorts": false, "ReadonlyRootfs": false, "SecurityOpt": [ "label=disable" ], "UTSMode": "", "UsernsMode": "", "ShmSize": 67108864, "Runtime": "runc", "ConsoleSize": [ 0, 0 ], "Isolation": "", "CpuShares": 0, "Memory": 0, "NanoCpus": 0, "CgroupParent": "", "BlkioWeight": 0, "BlkioWeightDevice": [], "BlkioDeviceReadBps": null, "BlkioDeviceWriteBps": null, "BlkioDeviceReadIOps": null, "BlkioDeviceWriteIOps": null, "CpuPeriod": 0, "CpuQuota": 0, "CpuRealtimePeriod": 0, "CpuRealtimeRuntime": 0, "CpusetCpus": "", "CpusetMems": "", "Devices": [], "DeviceCgroupRules": null, "DeviceRequests": null, "KernelMemory": 0, "KernelMemoryTCP": 0, "MemoryReservation": 0, "MemorySwap": 0, "MemorySwappiness": null, "OomKillDisable": false, "PidsLimit": null, "Ulimits": null, "CpuCount": 0, "CpuPercent": 0, "IOMaximumIOps": 0, "IOMaximumBandwidth": 0, "MaskedPaths": null, "ReadonlyPaths": null }, "GraphDriver": { "Data": null, "Name": "btrfs" }, "Mounts": [ { "Type": "bind", "Source": "/mnt/disks/SSD/appdata/NginxProxyManager", "Destination": "/config", "Mode": "rw", "RW": true, "Propagation": "rprivate" } ], "Config": { "Hostname": "aa3170007432", "Domainname": "", "User": "", "AttachStdin": false, "AttachStdout": true, "AttachStderr": true, "ExposedPorts": { "4443/tcp": {}, "8080/tcp": {}, "8181/tcp": {} }, "Tty": false, "OpenStdin": false, "StdinOnce": false, "Env": [ "DISABLE_IPV6=1", "TZ=Europe/Paris", "HOST_OS=Unraid", "USER_ID=99", "GROUP_ID=100", "UMASK=000", "APP_NICENESS=", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "LANG=en_US.UTF-8", "S6_BEHAVIOUR_IF_STAGE2_FAILS=3", "S6_SERVICE_DEPS=1", "APP_NAME=Nginx Proxy Manager", "APP_USER=app", "XDG_DATA_HOME=/config/xdg/data", "XDG_CONFIG_HOME=/config/xdg/config", "XDG_CACHE_HOME=/config/xdg/cache", "XDG_RUNTIME_DIR=/tmp/run/user/app" ], "Cmd": [ "/init" ], "Image": "jlesage/nginx-proxy-manager", "Volumes": { "/config": {} }, "WorkingDir": "/tmp", "Entrypoint": null, "OnBuild": null, "Labels": { "org.label-schema.description": "Docker container for Nginx Proxy Manager", "org.label-schema.name": "nginx-proxy-manager", "org.label-schema.schema-version": "1.0", "org.label-schema.vcs-url": "https://github.com/jlesage/docker-nginx-proxy-manager", "org.label-schema.version": "1.14.0", "org.opencontainers.image.created": "2021-03-22T23:56:27Z", "org.opencontainers.image.revision": "e93e0751abba5322a94e258bd72cb427518ced6d", "org.opencontainers.image.source": "https://github.com/jlesage/docker-nginx-proxy-manager.git", "org.opencontainers.image.url": "https://github.com/jlesage/docker-nginx-proxy-manager" } }, "NetworkSettings": { "Bridge": "", "SandboxID": "82d29a4fdc79b77f411bd246b43aa0243247f4bbde9d29a006d6707ecc077f0b", "HairpinMode": false, "LinkLocalIPv6Address": "", "LinkLocalIPv6PrefixLen": 0, "Ports": { "4443/tcp": [ { "HostIp": "0.0.0.0", "HostPort": "18443" } ], "8080/tcp": [ { "HostIp": "0.0.0.0", "HostPort": "1880" } ], "8181/tcp": [ { "HostIp": "0.0.0.0", "HostPort": "7818" } ] }, "SandboxKey": "/var/run/docker/netns/82d29a4fdc79", "SecondaryIPAddresses": null, "SecondaryIPv6Addresses": null, "EndpointID": "", "Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "MacAddress": "", "Networks": { "sly": { "IPAMConfig": null, "Links": null, "Aliases": [ "aa3170007432" ], "NetworkID": "7c256bbd701c87f7df9afaf0a2d95e4b5fdfa0b8e5569a4fa6f69234ef1ac2ad", "EndpointID": "3a01f6f4d4594e0aeb6e54721ff7470f13837dbecd259bb40198eeafc5e25a33", "Gateway": "172.18.0.1", "IPAddress": "172.18.0.6", "IPPrefixLen": 16, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "02:42:ac:12:00:06", "DriverOpts": null } } } } ] root@NAS-SLY:/mnt/disks/SSD/appdata/NginxProxyManager/letsencrypt/renewal#

[jlesage]

There is something wrong. Files are still owned by root. Looks like chown -R nobody:users /mnt/disks/SSD/appdata/NginxProxyManager didn't work ?

Also, all the files are empty (have a size of 0), which is not expected...

[jlesage]

Any reason why the appdata folder is on a disk instead of a share (e.g. /mnt/user/appdata)? Maybe this is causing the issue ?

[sly83910]

When i type the chown command i don't have error message

All my dockers content are separate of my array to run on a SSD. I try to move the NPM dockers on user/appdata and retry

[sly83910]

God damm it that works !! Thanks a lots

I have an error of rate limit, do you know time i have to wait with this message ?

There were too many requests of a given type :: Error creating new order :: too many certificates already issued for exact set of domains: jeedom.sly83.ovh: see https://letsencrypt.org/docs/rate-limits/

[jlesage]

From the link it seems that the limit is 50 requests per week. So I guess you need to wait at least a week.

[sly83910]

I created an other domain and subdomain name and all work fine ! Thanks a lot