https://netmaker.org logo
Powered by
netmaker
  • j

    jolly-london-20127

    05/27/2022, 11:12 PM
    I know others have done it but haven’t myself
  • k

    kind-lizard-33284

    05/27/2022, 11:12 PM
    Hmmm alright
  • j

    jolly-london-20127

    05/27/2022, 11:12 PM
    Bc you’re trying to use both Netmakers DNS and pi-hole DNS simultaneously
  • k

    kind-lizard-33284

    05/27/2022, 11:13 PM
    Tbh i could probably abstain from the pihole dns lol
  • k

    kind-lizard-33284

    05/27/2022, 11:13 PM
    Its just an extra
  • k

    kind-lizard-33284

    05/27/2022, 11:16 PM
    what does the "Is DNS on" switch in the client settings do exactly?
  • b

    bored-island-21407

    05/27/2022, 11:19 PM
    DNS on will update the /etc/hosts file on clients so that you can do 
    ping <host>.<network>
  • k

    kind-lizard-33284

    05/27/2022, 11:22 PM
    MQ is spamming the logs with 
    OpenSSL Error[0]: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
  • k

    kind-lizard-33284

    05/27/2022, 11:22 PM
    probably because i dont use SSL inside the container but outside with nginx
  • k

    kind-lizard-33284

    05/27/2022, 11:23 PM
    how do i fix this? Use a MQ image without SSL?
  • b

    bored-island-21407

    05/27/2022, 11:24 PM
    A nginx cert will not work with MQ client certs
  • b

    bored-island-21407

    05/27/2022, 11:27 PM
    You would have to update the mosquito conf file to allow non tls and anonymous access. Doing so would allow anyone to pub or sub to MQ topics, however the MQ payloads are separately encrypted so an unauthorized subscriber would not be able to decode the payloads
  • k

    kind-lizard-33284

    05/27/2022, 11:28 PM
    Cant i just point it to my certs i use for nginx?
  • m

    mysterious-forest-94789

    05/27/2022, 11:28 PM
    I noticed one thing, the ingress/egress configuration isn't showing the same between the node list and the nodes when selected in the graph view.
  • b

    bored-island-21407

    05/27/2022, 11:31 PM
    No, client certs won't work. You could do that if you still wanted MQ over SSL but you would have to use anonymous access in lieu of client certs for authentication
  • m

    mysterious-forest-94789

    05/27/2022, 11:32 PM
    wrong person....lol
  • k

    kind-lizard-33284

    05/27/2022, 11:32 PM
    Alright, so ig i'll have to fiddle with the mq config. Thanks
  • k

    kind-lizard-33284

    05/27/2022, 11:41 PM
    mq             | 2022-05-27T23:40:54.976367947Z 1653694854: New connection from xx.xx.xx.xx:4036 on port 8883.
mq             | 2022-05-27T23:40:54.980710128Z 1653694854: Client <unknown> disconnected due to protocol error.
  • k

    kind-lizard-33284

    05/27/2022, 11:41 PM
    now im getting this after changing the conf to this:
  • k

    kind-lizard-33284

    05/27/2022, 11:41 PM
    per_listener_settings true

listener 8883
allow_anonymous true
require_certificate false
use_identity_as_username true

listener 1883 
allow_anonymous true
  • k

    kind-lizard-33284

    05/27/2022, 11:47 PM
    oh man i really have to watch the stuff i send
  • b

    bored-island-21407

    05/27/2022, 11:48 PM
    Yes, it might be more complicated than I initially thought. Have not tested. What is the objection to using the self signed certs generated by netmaker?
  • k

    kind-lizard-33284

    05/27/2022, 11:48 PM
    im not sure how to do that lol
  • k

    kind-lizard-33284

    05/27/2022, 11:49 PM
    # Dashboard
:50003 {
        # Apply basic security headers
        header {
                # Enable cross origin access to *.domain.com
                Access-Control-Allow-Origin *.c
                # Enable HTTP Strict Transport Security (HSTS)
                Strict-Transport-Security "max-age=31536000;"
                # Enable cross-site filter (XSS) and tell browser to block detected attacks
                X-XSS-Protection "1; mode=block"
                # Disallow the site to be rendered within a frame on a foreign domain (clickjacking protection)
                X-Frame-Options "SAMEORIGIN"
                # Prevent search engines from indexing
                X-Robots-Tag "none"
                # Remove the server name
                -Server
        }

        reverse_proxy http://netmaker-ui
}

# API
:50004 {
        reverse_proxy http://netmaker:8081
}
  • b

    bored-island-21407

    05/27/2022, 11:49 PM
    Just use as per normal setup
  • k

    kind-lizard-33284

    05/27/2022, 11:49 PM
    pretty much trimmed my caddy down to this
  • b

    bored-island-21407

    05/27/2022, 11:50 PM
    MQ doesn't go through caddy in normal setup
  • k

    kind-lizard-33284

    05/27/2022, 11:52 PM
    huh? Then why is it throwing those errors?
  • k

    kind-lizard-33284

    05/27/2022, 11:52 PM
    i didnt change anything of MQ and i gave it the certs from netmaker
  • k

    kind-lizard-33284

    05/27/2022, 11:52 PM
    mq:
    image: eclipse-mosquitto:2.0.11-openssl
    depends_on:
      - netmaker
    container_name: mq
    restart: unless-stopped
    ports:
      - "8883:8883"
    volumes:
      - ./mosquitto.conf:/mosquitto/config/mosquitto.conf
      - ./certs/:/mosquitto/certs/
      - mosquitto_data:/mosquitto/data
      - mosquitto_logs:/mosquitto/log
1...157158159...220Latest