search

ronivay / XenOrchestraInstallerUpdater

Xen Orchestra install/update script
GNU General Public License v3.0
1.16k stars 189 forks source link

AUTOCERT="true" doesn't seem to be working #130

Closed doonga closed 2 years ago

doonga commented 2 years ago

OS Version: Ubuntu 22.04 Node.js version: v16.15.1 Yarn version: 1.22.19

Server specs 2vCPU 4GB RAM

Issue On initial install, I set up xo-install.cfg as per the wiki for auto generated certificates, at the end of the install the certificate and key were not created and xo-server failed to start. I manually created them and ran an update which ended up working fine. I'm also using a non-root user if that matters.

Installation logfile Attach complete log as a file. xo-install.log

ronivay commented 2 years ago

Hi,

Yeah, looking at logs: 

Jun 22 13:50:03 xo xo-server[12980]:   error: [Error: EACCES: permission denied, open '/opt/xo/xo.crt'] {

Certificate is created by XO and the non-root user running it does not have permission to that directory, hence it can't generate those files. I could make sure permissions are set during the installation, but as that directory can be basically anywhere and not necessarily only used by XO, i'd rather not do that. I can update documentation though.

doonga commented 2 years ago

Ok fair enough, it's not a huge deal to create my own anyway. Might be worth a comment on the wiki that this will be an issue and to create your own certs ahead of time. Thanks!

ronivay commented 2 years ago

Default values in config are pointing to /opt/xo, so i totally understand it's not obvious. I'll see if there's an easy and sane way to make it work with defaults at least. Will add mention to documentation anyway.

Thanks for reporting this.

ronivay commented 2 years ago

Looked into this a bit. Only sane option would've been to just use filenames without path in sample config for cert/key, that would cause XO to write cert/key to installation directory. That would cause it to recreate certificate after every update which would then introduce a new warning in browser etc so probably not the best idea. Decided to just add a mention to wikipage about permissions when using non-root user.