Closed aaronkanzer closed 5 months ago
aaronkanzer
commented
5 months ago If this is helpful as well here is more context for our contents of the EC2 -- my hunch here is that some step is not working appropriately where the /home/ec2-user/opt/webknossos/persistent/nginx/certs/webknossos.lincbrain.org directory should be populated, but is not.
normanrz
commented
5 months ago Hi, nginx-letsencrypt is attempting to generate its own certificates with letsencrypt. It does not use the ACM certificates. I don't know if the ACM certificates interfere with the letsencrypt validation flow.
It seems to me this is not directly a Webknossos issue. For more information about nginx-letsencrypt please refer to https://github.com/nginx-proxy/acme-companion. Alternatively, you can also set up any other reverse proxy with SSL termination, such as Caddy, traefik or ELB.
aaronkanzer
commented
5 months ago @normanrz Thanks for the response.
Unfortunately, I'm not sure I follow, as there is nothing specific to my setup that points to ACM (rather, I was just showing with the screenshot above that the DNS record we pointed already had valid SSL associated).
Is there anything else you could share for what WebKNOSSOS custom-codes for the nginx-related containers vs. what is used by default via nginx? I've been inspecting the scalableminds/nginx-proxy container to see if there is something specific here....
normanrz
commented
5 months ago I don't think there is anything Webknossos-specific here. Our nginx-proxy image just adds a few config options. Webknossos itself doesn't deal with SSL or domains. It just needs to know the domain names.
aaronkanzer
commented
5 months ago @normanrz Thanks for this -- I wasn't able to resolve the SSL cert issue unfortunately with the docker-compose steps defined in the installation.
For a work-around (to no longer be blocked), I ended up using certbot within the EC2 instance via Docker:
Firstly, removing reference to nginx-letsencrypt in the docker-compose.yml file, and updating the nginx step as such:
nginx-proxy:
image: nginx:latest
container_name: nginx-proxy
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf:ro
- ./certs:/etc/letsencrypt
depends_on:
- webknossosthen:
sudo docker run --rm -p 80:80 -v $(pwd)/certs:/etc/letsencrypt -v $(pwd)/certs-data:/data/letsencrypt certbot/certbot certonly --standalone -d <insert-dns-record.org> --email <insert-email-address> --agree-tos --non-interactivethen an nginx.conf as such mounted in the same directory (opt/webknossos)
events {}
http {
server {
listen 80;
server_name webknossos.lincbrain.org;
location /.well-known/acme-challenge/ {
root /data/letsencrypt;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 443 ssl;
server_name webknossos.lincbrain.org;
ssl_certificate /etc/letsencrypt/live/webknossos.lincbrain.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/webknossos.lincbrain.org/privkey.pem;
location / {
proxy_pass http://webknossos-webknossos-1:9000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}
I'm not 100% sure why the failures occurred here; however, if anyone hits a similar error for any reason, this workaround was fairly effortless
thanks again for all the help thus far (especially these past couple days with the /bin/webknossos issue) -- much appreciated -- closing this issue for now since we were able to resolve
Context
While going through https://docs.webknossos.org/webknossos/installation.html,
nginx-letsencryptroutinely fails to recognize valid SSL certs via just the population of the environment variable of:PUBLIC_HOST=<the-a-name-record....org>This "bug" ticket is to inquire what additional steps are being done/if there is anything hard-coded that should be abstracted so that the installation docs work as intended.
This bug was investigated via logs below. It is also worth noting that the
persistentdirectory (mounted into the webknossos API container) was empty when it came to loading in valid.crtand.keyfiles required for proper SSL cert.Cc @kabilar @satra
Expected Behavior
nginx-letsencryptshould recognize the SSL cert associated with the DNS record A name on the instance.Current Behavior
nginx-letsencryptfails to recognize/retrieve valid SSL cert associated with the DNS record A name on the instance.I have verified, from the cloud infrastructure side, that our setup is appropriate -- see screenshots below for EC2, Route 53, ACM and the associated security group
These are all linked to the URL here: https://webknossos.lincbrain.org/
Steps to Reproduce the bug
PUBLIC_HOST=<the-a-name-record....org>http://webknossos.lincbrain.org/.well-known/acme-challengeand subsequently fails with the following:Your Environment for bug
jobsEnabled=trueinapplication.conf)isDemoInstance=trueinapplication.conf)