search

netbirdio / netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
11.32k stars 519 forks source link

Installing netbird on a Oracle Cloud VPS (Ubuntu) #1475

Open mrmoose0 opened 10 months ago

mrmoose0 commented 10 months ago

Describe the problem I installed self-hosting netbird on OCI using Authentik self-hosted. Authentication works well and installation too but on the dashboard there is the message: "Network Error". Is visible only Peers menù.

image

How can I solve the problem?

Here is docker logs

artifacts-signal-1 | 2024-01-16T16:26:55Z INFO signal/cmd/run.go:107: running gRPC backward compatibility server: [::]:10000 artifacts-signal-1 | 2024-01-16T16:26:55Z INFO signal/cmd/run.go:129: running gRPC server: [::]:80 artifacts-signal-1 | 2024-01-16T16:26:55Z INFO signal/cmd/run.go:132: started Signal Service artifacts-coturn-1 | 0: (1): INFO: System cpu num is 2 artifacts-coturn-1 | 0: (1): INFO: log file opened: /var/tmp/turn_1_2024-01-16.log artifacts-coturn-1 | 0: (1): INFO: System enable num is 2 artifacts-coturn-1 | 0: (1): INFO: Coturn Version Coturn-4.6.2 'Gorst' artifacts-coturn-1 | 0: (1): INFO: Coturn Version Coturn-4.6.2 'Gorst' artifacts-coturn-1 | 0: (1): INFO: Max number of open files/sockets allowed for this process: 1048576 artifacts-coturn-1 | 0: (1): INFO: Due to the open files/sockets limitation, max supported number of TURN Sessions possible is: 524000 (approximately) artifacts-coturn-1 | 0: (1): INFO: artifacts-coturn-1 | artifacts-coturn-1 | ==== Show him the instruments, Practical Frost: ==== artifacts-coturn-1 | artifacts-coturn-1 | 0: (1): INFO: OpenSSL compile-time version: OpenSSL 3.0.11 19 Sep 2023 (0x300000b0) artifacts-coturn-1 | 0: (1): INFO: TLS 1.3 supported artifacts-coturn-1 | 0: (1): INFO: DTLS 1.2 supported artifacts-coturn-1 | 0: (1): INFO: TURN/STUN ALPN supported artifacts-coturn-1 | 0: (1): INFO: Third-party authorization (oAuth) supported artifacts-coturn-1 | 0: (1): INFO: GCM (AEAD) supported artifacts-coturn-1 | 0: (1): INFO: SQLite supported, default database location is /var/lib/coturn/turndb artifacts-coturn-1 | 0: (1): INFO: Redis supported artifacts-coturn-1 | 0: (1): INFO: PostgreSQL supported artifacts-coturn-1 | 0: (1): INFO: MySQL supported artifacts-coturn-1 | 0: (1): INFO: MongoDB supported artifacts-coturn-1 | 0: (1): INFO: Default Net Engine version: 3 (UDP thread per CPU core) artifacts-coturn-1 | 0: (1): INFO: Domain name: netbird.example.com artifacts-coturn-1 | 0: (1): INFO: Default realm: wiretrustee.com artifacts-coturn-1 | 0: (1): WARNING: cannot find certificate file: /etc/coturn/certs/cert.pem (1) artifacts-coturn-1 | 0: (1): WARNING: cannot start TLS and DTLS listeners because certificate file is not set properly artifacts-coturn-1 | 0: (1): WARNING: cannot find private key file: /etc/coturn/private/privkey.pem (1) artifacts-coturn-1 | 0: (1): WARNING: cannot start TLS and DTLS listeners because private key file is not set properly artifacts-coturn-1 | 0: (1): INFO: Certificate file found: /etc/coturn/certs/cert.pem artifacts-coturn-1 | 0: (1): INFO: Private key file found: /etc/coturn/private/privkey.pem artifacts-coturn-1 | 0: (1): WARNING: NO EXPLICIT LISTENER ADDRESS(ES) ARE CONFIGURED artifacts-coturn-1 | 0: (1): INFO: ===========Discovering listener addresses: ========= artifacts-coturn-1 | 0: (1): INFO: Listener address to use: 127.0.0.1 artifacts-coturn-1 | 0: (1): INFO: Listener address to use: 192.168.50.32 artifacts-coturn-1 | 0: (1): INFO: Listener address to use: 172.17.0.1 artifacts-coturn-1 | 0: (1): INFO: Listener address to use: 172.23.0.1 artifacts-coturn-1 | 0: (1): INFO: Listener address to use: ::1 artifacts-coturn-1 | 0: (1): INFO: ===================================================== artifacts-coturn-1 | 0: (1): INFO: Total: 3 'real' addresses discovered artifacts-coturn-1 | 0: (1): INFO: ===================================================== artifacts-coturn-1 | 0: (1): WARNING: NO EXPLICIT RELAY ADDRESS(ES) ARE CONFIGURED artifacts-coturn-1 | 0: (1): INFO: ===========Discovering relay addresses: ============= artifacts-coturn-1 | 0: (1): INFO: Relay address to use: 192.168.50.32 artifacts-coturn-1 | 0: (1): INFO: Relay address to use: 172.17.0.1 artifacts-coturn-1 | 0: (1): INFO: Relay address to use: 172.23.0.1 artifacts-coturn-1 | 0: (1): INFO: Relay address to use: ::1 artifacts-coturn-1 | 0: (1): INFO: ===================================================== artifacts-coturn-1 | 0: (1): INFO: Total: 4 relay addresses discovered artifacts-coturn-1 | 0: (1): INFO: ===================================================== artifacts-coturn-1 | 0: (1): INFO: pid file created: /var/tmp/turnserver.pid artifacts-coturn-1 | 0: (1): INFO: IO method: epoll (with changelist) artifacts-coturn-1 | 0: (1): WARNING: STUN CHANGE_REQUEST not supported: only one IP address is provided artifacts-coturn-1 | 0: (1): INFO: Wait for relay ports initialization... artifacts-coturn-1 | 0: (1): INFO: relay 192.168.50.32 initialization... artifacts-management-1 | 2024-01-16T16:26:57Z INFO management/cmd/management.go:407: loading OIDC configuration from the provided IDP configuration endpoint https://authentik.example.com/application/o/netbird/.well-known/openid-configuration artifacts-coturn-1 | 0: (1): INFO: relay 192.168.50.32 initialization done artifacts-coturn-1 | 0: (1): INFO: relay 172.17.0.1 initialization... artifacts-dashboard-1 | + LETSENCRYPT_DOMAIN=netbird.example.com artifacts-dashboard-1 | + LETSENCRYPT_EMAIL=user@example.com artifacts-dashboard-1 | + NGINX_SSL_PORT=443 artifacts-dashboard-1 | + '[' netbird.example.com-x == none-x ']' artifacts-dashboard-1 | NetBird latest version: artifacts-dashboard-1 | + certbot -n --nginx --agree-tos --email user@example.com -d netbird.example.com --https-port 443 artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:412: loaded OIDC configuration from the provided IDP configuration endpoint: https://authentik.example.com/application/o/netbird/.well-known/openid-configuration artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:414: overriding HttpConfig.AuthIssuer with a new value https://authentik.example.com/application/o/netbird/, previously configured value: https://authentik.example.com/application/o/netbird/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:418: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://authentik.example.com/application/o/netbird/jwks/, previously configured value: https://authentik.example.com/application/o/netbird/jwks/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:423: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://authentik.example.com/application/o/token/, previously configured value: https://authentik.example.com/application/o/token/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:426: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://authentik.example.com/application/o/device/, previously configured value: https://authentik.example.com/application/o/device/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:434: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: authentik.example.com, previously configured value: authentik.example.com artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:444: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://authentik.example.com/application/o/token/, previously configured value: https://authentik.example.com/application/o/token/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/cmd/management.go:447: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://authentik.example.com/application/o/authorize/, previously configured value: https://authentik.example.com/application/o/authorize/ artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/server/store.go:74: using JSON file store engine artifacts-management-1 | 2024-01-16T16:26:59Z INFO management/server/account.go:828: single account mode enabled, accounts number 0 artifacts-dashboard-1 | NetBird latest version: artifacts-coturn-1 | 0: (1): INFO: relay 172.17.0.1 initialization done artifacts-coturn-1 | 0: (1): INFO: relay 172.23.0.1 initialization... artifacts-management-1 | 2024-01-16T16:27:01Z INFO management/server/account.go:1009: 1 entries received from IdP management artifacts-management-1 | 2024-01-16T16:27:01Z INFO management/server/account.go:1038: warmed up IDP cache with 0 entries artifacts-management-1 | 2024-01-16T16:27:02Z INFO management/cmd/management.go:249: running gRPC backward compatibility server: [::]:33073 artifacts-management-1 | 2024-01-16T16:27:02Z INFO management/cmd/management.go:281: running HTTP server and gRPC server on the same port: [::]:443 artifacts-dashboard-1 | Saving debug log to /var/log/letsencrypt/letsencrypt.log artifacts-coturn-1 | 0: (1): INFO: relay 172.23.0.1 initialization done artifacts-coturn-1 | 0: (1): INFO: relay ::1 initialization... artifacts-dashboard-1 | Certificate not yet due for renewal artifacts-dashboard-1 | Deploying certificate artifacts-dashboard-1 | Successfully deployed certificate for netbird.example.com to /etc/nginx/http.d/default.conf artifacts-coturn-1 | 0: (1): INFO: relay ::1 initialization done artifacts-coturn-1 | 0: (1): INFO: Relay ports initialization done artifacts-coturn-1 | 0: (1): INFO: Total General servers: 2 artifacts-coturn-1 | 10: (9): DEBUG: turn server id=0 created artifacts-coturn-1 | 10: (10): DEBUG: turn server id=1 created artifacts-coturn-1 | 10: (1): INFO: Total auth threads: 3 artifacts-coturn-1 | 10: (1): INFO: prometheus collector disabled, not started artifacts-dashboard-1 | Congratulations! You have successfully enabled HTTPS on https://netbird.example.com artifacts-dashboard-1 | artifacts-dashboard-1 | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - artifacts-dashboard-1 | If you like Certbot, please consider supporting our work by: artifacts-dashboard-1 | Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate artifacts-dashboard-1 | Donating to EFF: https://eff.org/donate-le artifacts-dashboard-1 | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - artifacts-dashboard-1 | + cat artifacts-dashboard-1 | + supervisorctl start cron artifacts-dashboard-1 | crond: crond (busybox 1.33.1) started, log level 8 artifacts-dashboard-1 | cron: started

lixmal commented 10 months ago

Hi @mrmoose0,

it seems like the management server is not accessible from your browser. Can you please run a curl https://yourdomain/api/users -v on the CLI and post the output here?

mrmoose0 commented 10 months ago

Hi @mrmoose0,

it seems like the management server is not accessible from your browser. Can you please run a curl https://yourdomain/api/users -v on the CLI and post the output here?

lixmal commented 10 months ago

The output indicates that your requests end up on the dashboard and not the API.

It seems the reverse proxy is not configured correctly. https://docs.netbird.io/selfhosted/selfhosted-guide#configuration-for-your-reverse-proxy

Could you share your docker-compose.yml as well?

mrmoose0 commented 10 months ago

I don't use reverse proxy, only Authentik as authenticator configured as described. The same configuration works well using self-hosting site. Only OCI give me this problem.

Here the docker-compose file

version: "3" services:

UI dashboard

dashboard: image: wiretrustee/dashboard:latest restart: unless-stopped ports:

  • 80:80
  • 443:443 environment:

    Endpoints

  • NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:33073
  • NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:33073

    OIDC

  • AUTH_AUDIENCE=54hf549kfPAg8lC3edcZ0F6m9hrMVbfisFkOr
  • AUTH_CLIENT_ID=54hf549kfPAg8lC3edcZ0F6m9hrMVbfisFkOr
  • AUTH_CLIENT_SECRET=
  • AUTH_AUTHORITY=https://authentik.example.com/application/o/netbird/
  • USE_AUTH0=false
  • AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
  • AUTH_REDIRECT_URI=
  • AUTH_SILENT_REDIRECT_URI=
  • NETBIRD_TOKEN_SOURCE=accessToken

    SSL

  • NGINX_SSL_PORT=443

    Letsencrypt

  • LETSENCRYPT_DOMAIN=netbird.example.com
  • LETSENCRYPT_EMAIL=user@example.com volumes:
  • netbird-letsencrypt:/etc/letsencrypt/ networks:
  • netbird

    Signal

    signal: image: netbirdio/signal:latest restart: unless-stopped volumes:

  • netbird-signal:/var/lib/netbird ports:
  • 10000:80

    port and command for Let's Encrypt validation

    - 443:443

    command: ["--letsencrypt-domain", "netbird.example.com", "--log-file", "console"]

    networks:

  • netbird

    Management

    management: image: netbirdio/management:latest restart: unless-stopped depends_on:

  • dashboard volumes:
  • netbird-mgmt:/var/lib/netbird
  • netbird-letsencrypt:/etc/letsencrypt:ro
  • ./management.json:/etc/netbird/management.json ports:
  • 33073:443 #API port

    command for Let's Encrypt validation without dashboard container

    command: ["--letsencrypt-domain", "netbird.example.com", "--log-file", "console"]

    command: [ "--port", "443", "--log-file", "console", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.example.com", "--dns-domain=cloud72.netb" ] networks:

  • netbird

    Coturn

    coturn: image: coturn/coturn:latest restart: unless-stopped domainname: netbird.example.com volumes:

  • ./turnserver.conf:/etc/turnserver.conf:ro

    - ./privkey.pem:/etc/coturn/private/privkey.pem:ro

    - ./cert.pem:/etc/coturn/certs/cert.pem:ro

    network_mode: host command:

  • -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: networks: netbird: external: true