825071750290210916 #general

mammoth-zoo-95458

04/29/2022, 1:18 PM

and my nodes are healthy in the dashboard so I guess I'm ok

mammoth-zoo-95458

04/29/2022, 1:18 PM

even though the "join" process hanged

jolly-london-20127

04/29/2022, 1:18 PM

i thiiiink these logs are fine, @bored-island-21407 probably knows better. Are joins still hanging?

mammoth-zoo-95458

04/29/2022, 1:52 PM

I just tried joining a new node and it didn't hang

jolly-london-20127

04/29/2022, 1:54 PM

so working currently?

mammoth-zoo-95458

04/29/2022, 2:11 PM

yes

mammoth-zoo-95458

04/29/2022, 2:11 PM

thanks

mammoth-zoo-95458

04/29/2022, 2:15 PM

@jolly-london-20127 I was wondering why netmaker didn't go with a design where everything is encapsulated in wg, like innernet does? I understand mqtt uses TLS and cert auth but when I tried different solutions "similar" to netmaker I really liked innernet's approach of encapsulating everything in wg.

mammoth-zoo-95458

04/29/2022, 2:15 PM

Being a pentester I'm a bit paranoid and I really like the idea of exposing as few ports/services as possible

jolly-london-20127

04/29/2022, 2:18 PM

we were actually going that way, but it ends up being a lot more complicated to manage in practice

jolly-london-20127

04/29/2022, 2:19 PM

you end up with a lot of chicken and egg problems, because Netmaker is managing all the WireGuard connections, but it's also sending out WireGuard config updates over WireGuard meaning, if anything goes wrong, you lose the connection to the clients and there's no way to recover

jolly-london-20127

04/29/2022, 2:20 PM

it also leads to needing an extra network (the "comms" network we had in 0.12), which can be annoying to manage for users

mammoth-zoo-95458

04/29/2022, 2:22 PM

I see. I guess a possible approach would be to not consider the management wg network as a netmaker network, but something "static" where you know the config will never change and its related config is part of the join payload

mammoth-zoo-95458

04/29/2022, 2:23 PM

if you revoke a key/node, the target node would still have access to that "network", but it's already better than exposing it publicly

jolly-london-20127

04/29/2022, 2:28 PM

yeah that was a possibility as well, maintain a static WG connection to the server, but still, it's not easily recoverable if anything goes wrong. Still, all traffic is encrypted with our approach, and the MQ certs even have key pairs per client, so it should be as secure as using WireGuard

jolly-london-20127

04/29/2022, 2:28 PM

or "close to" as secure

mammoth-zoo-95458

04/29/2022, 2:30 PM

I understand. I'll still adapt my old PR to match the changes in 0.13 to "fix" the exposed ports in docker-compose, it would be great if it got merged

microscopic-appointment-2506

04/30/2022, 3:32 PM

I have traefik running exposing most docker containers. Can I expose mq via traefik, and have traefik manage the public letsencrypt cert and proxy the tcp port. Would that interfere with how netmaker wants to use mq with certs?

bored-island-21407

04/30/2022, 3:41 PM

Yes it would

hallowed-finland-99691

05/01/2022, 9:13 AM

Win11 client accidentally disconnected, after the network is restored, you can ping netmaker-1, but it is not possible with any client until it restarts win11, this needs to be fixed.

hallowed-finland-99691

05/01/2022, 9:47 AM

because it is a home network, after the disconnection and reconnection, the IP has changed,

microscopic-appointment-2506

05/01/2022, 12:57 PM

ah right, as netmaker is configured to use client certs with MQ, which is not advised in combination with lets encrypt: https://community.letsencrypt.org/t/can-i-create-client-certificates-for-a-received-letsencrypt-certificate/78627

few-airline-95046

05/02/2022, 4:22 PM

Is the upgrade path from 0.13.0 -> 0.13.1 as simple as doing a docker pull and then updating the netclient binary on the nodes? 🙂

jolly-london-20127

05/02/2022, 4:50 PM

yup, much more simple this time

jolly-london-20127

05/02/2022, 4:50 PM

only very tiny server/client changes

few-airline-95046

05/02/2022, 5:16 PM

Yeah that went smooth. But it still says

UI: v0.13.0
Server: v0.13.0

on the menu to the left

few-airline-95046

05/02/2022, 5:38 PM

Nwm, netmaker didn't get updated by the docker-compose pull. Running the nm-quick script solved it though

jolly-london-20127

05/02/2022, 5:40 PM

you have to change the versions in the compose and then docker-compose down/up

few-airline-95046

05/02/2022, 5:52 PM

Ah, of course 😊

few-airline-95046

05/02/2022, 6:01 PM

Is there any plans to have the gui work better on mobile btw? There's quite a lot of overlapping areas right now