825071750290210916 #general

bored-island-21407

04/28/2022, 12:50 PM

error from mq container on server ?

miniature-judge-91363

04/28/2022, 12:52 PM

and i also happened to notice this

few-airline-95046

04/28/2022, 12:54 PM

1651150428: New connection from 129.151.216.73:42236 on port 8883.
1651150428: OpenSSL Error[0]: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
1651150428: Client <unknown> disconnected: Protocol error.

delightful-address-65579

04/28/2022, 12:54 PM

on the 0.13 update it does not seem to automatically check and apply configuration updates for VPN-nodes. I need to manually pull the latest config on all the servers. Looking in the status of the netclient.service there doesn't seem anything wrong. Is this a known issue?

bored-island-21407

04/28/2022, 12:55 PM

now i think you willl have to do the deletion of certs on server, restart and do client pull

few-airline-95046

04/28/2022, 12:56 PM

Where are they located on the server? In one of the containers?

bored-island-21407

04/28/2022, 12:56 PM

in /root/certs/ on the server

few-airline-95046

04/28/2022, 1:04 PM

Removed * from /root/certs on netmaker machine, restarted netmaker and did pull from client specifying the network. Got new certs (atleast according to timestamps) but the mosquitto_pub command fails with the same error.

root@testmaskin:~# mosquitto_pub -t hello -m world -d -h nm.129-151-201-102.nip.io -p 8883 --cafile /etc/netclient/broker.nm.129-151-201-102.nip.io/root.pem --cert /etc/netclient/broker.nm.129-151-201-102.nip.io/client.pem --key /etc/netclient/client.key
Client mosq-szbc7XacaYejOpmFbc sending CONNECT
Error: host name verification failed.
OpenSSL Error[0]: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Error: A TLS error occurred.

bored-island-21407

04/28/2022, 1:05 PM

what do you have as SERVER_NAME in the docker-compose file

few-airline-95046

04/28/2022, 1:08 PM

ooh, not the nm..nip.io, but my own domain. So the nm-quick only wrote the docker-compose once, and then never modified it when running it without extra parameters?

bored-island-21407

04/28/2022, 1:08 PM

not sure

few-airline-95046

04/28/2022, 1:08 PM

Alright, let's redo it and wipe the docker-compose file first

few-airline-95046

04/28/2022, 1:09 PM

Is there any other files/folders that I need to manually remove that remains on the netmaker machine after wiping the docker volumes?

bored-island-21407

04/28/2022, 1:10 PM

root/certs

few-airline-95046

04/28/2022, 1:10 PM

Yes, that I remembered 🙂

few-airline-95046

04/28/2022, 1:17 PM

ugh, my brain needs sleep or something. I didn't look at the correct docker-compose file @bored-island-21407.

SERVER_NAME: "broker.nm.129-151-201-102.nip.io"

few-airline-95046

04/28/2022, 1:27 PM

So running the mosquitto_pub command against broker.nm.129-151-201-102.nip.io instead of just nm.129-151-201-102.nip.io and it worked better 🙈

few-airline-95046

04/28/2022, 1:29 PM

But with all this sorted, I suspect that I had issues when using my own domain that the files in /root/certs on the netmaker machine was created for the nip.io domain which I tested first?

bored-island-21407

04/28/2022, 1:31 PM

That was probably the cause. When netmaker starts up, it only creates new certs if they are missing or near expiration.

few-airline-95046

04/28/2022, 1:33 PM

Yeah that's understandable. And changing domain settings might be a corner case 😄

few-airline-95046

04/28/2022, 1:34 PM

But it might be good to have some documentation regarding uninstalling and removing leftover files 🙂

miniature-judge-91363

04/28/2022, 1:36 PM

Also, nodes going from warning to error seem all to be ingress gateways.

few-airline-95046

04/28/2022, 2:10 PM

Netmaker is now running fine using my domain, so the old certs in /root/certs was the culprit. Thanks for all the help @bored-island-21407 💯

few-airline-95046

04/28/2022, 2:44 PM

The only thing I'm missing now is to have the netclient daemon running on my unraid servers (which doesn't have systemd) :/

bored-island-21407

04/28/2022, 2:48 PM

start netclient daemon manually

few-airline-95046

04/28/2022, 3:00 PM

How do I do that? 🙂

creamy-judge-86664

04/28/2022, 3:02 PM

There something strange with the password input on the ui.

creamy-judge-86664

04/28/2022, 3:02 PM

It is not found by firefox and bitwarden as well.

bored-island-21407

04/28/2022, 3:03 PM

cp netclient to sbin/ and run /sbin/netclient daemon -vvvv

few-airline-95046

04/28/2022, 3:30 PM

Cool, I'll try that!