SageTV Web + SSL + Reverse Proxy (Any interest?) (unRAID only)

[KarylFStein]

Heh, stuckless slipped in before me. It looks like his link answers both your questions .

[Taddeusz]

Just a suggestion for a future SageTV web interface. Many web apps have a configurable root path. Would be a great feature to allow the root path to be configurable. Especially for those people who seem to be running more than one SageTV server on the same network and want to proxy pass both to different root paths.

[stuckless]

Originally Posted by Taddeusz

Just a suggestion for a future SageTV web interface. Many web apps have a configurable root path. Would be a great feature to allow the root path to be configurable. Especially for those people who seem to be running more than one SageTV server on the same network and want to proxy pass both to different root paths.

That's a good suggestion. BTW, I think you suggested at one time to look at React (I think it was you), and I resisted that at first, but I've since played with it more, and React will will the base infrastructure of the new Web Server (that I'm building).

[Taddeusz]

Originally Posted by stuckless

That's a good suggestion. BTW, I think you suggested at one time to look at React (I think it was you), and I resisted that at first, but I've since played with it more, and React will will the base infrastructure of the new Web Server (that I'm building).

Yes, React is pretty cool. And from what I understand much lower footprint compared to Angular. You may also look at Redux or MobX. I don't have an opinion about either but both try to solve the problem of state management rather than the vanilla React method of directly modifying state.

[EnterNoEscape]

Originally Posted by Taddeusz

Yes, React is pretty cool. And from what I understand much lower footprint compared to Angular. You may also look at Redux or MobX. I don't have an opinion about either but both try to solve the problem of state management rather than the vanilla React method of directly modifying state.

There are so many frameworks out there.

[Taddeusz]

Originally Posted by EnterNoEscape

There are so many frameworks out there.

Yeah, JavaScript is kind of a moving target right now. But it's because there's actually a lot of new development going on with the language and there's a lot of push to make things work better cross platform.

I watched WWDC this week and was really disappointed that when they were talking about Safari they said it has full ES5 support but said nothing about ES6, which everyone should now be writing in, let alone ES2017. Guess they aren't as invested in cross platform.

[wayner]

Originally Posted by stuckless

Docker is meant to be a very lightweight container, so, it's shares lots of resources with the host. I think if you need more conrtol over networking, etc, you might need a heavyweight container, like a VM.

It looks like there is some movement in this area staring with Docker 6.3. You can now setup dockers with their own IP:

https://forums.lime-technology.com/t...id-ip-address/

edit - And it appears that this functionality will be built in starting with 6.4

[dstanley]

Originally Posted by wayner

<SNIP>.

I was able to get it working properly for my rutorrent docker but I had to change the rutorrent/nginx config so that rutorrent is now located at http://tower:7777/rutorrent rather than http://tower:7777. It looks like this reverse proxying doesn't work as well when you want to hit the root path, or at least it takes a little more configuring if it does.

Wayner - can you help me with the changes were required for ruTorrent so that I can setup my Let's Encrypt Docker for it?

I have my nextcloud, sagetv, bmt, sonarr, radarr, sabnxbd, mylar, headphones, ubooquity and deluge all working fine. Not too happy with the deluge and I am trying to work with rutorrent now.

Probably not the right place but it may help other's too!?

Dwight

[wayner]

I don’t remember off the top of my head exactly what I had to do but I am out of town until the weekend so I can’t check it out for a few days. If you don't hear from me by Sunday then post another message.

[wayner]

Here is what I have in my config file:

	location ^~ /rutorrent {
		include /config/nginx/proxy.conf;
		proxy_pass http://192.168.1.99:7777/rutorrent/;
	}

That looks pretty basic - I don't remember if I had to do anything special in the ruturrent config.

Hope that helps.

[wayner]

letsencrypt has worked great for me for a while now but it looks like something is shutting down and changes are required.

@stuckless, or anyone else - do you know where changes need to be made?

Here is the message that I received:

**Action is required to prevent your Let's Encrypt certificate renewals from breaking.**

Your Let’s Encrypt client used ACME TLS-SNI-01 domain validation to issue a certificate in the past 60 days.

TLS-SNI-01 validation is reaching end-of-life and will stop working on **February 13th, 2019.**

You need to update your ACME client to use an alternative validation method (HTTP-01, DNS-01 or TLS-ALPN-01) before this date or your certificate renewals will break and existing certificates will start to expire.

If you need help updating your ACME client, please open a new topic in the Help category of the Let's Encrypt community forum:

https://community.letsencrypt.org/c/help

Please answer all of the questions in the topic template so we can help you.

For more information about the TLS-SNI-01 end-of-life please see our API announcement:

https://community.letsencrypt.org/t/...-support/74209

Thank you,
Let's Encrypt Staff

[Taddeusz]

Originally Posted by wayner

letsencrypt has worked great for me for a while now but it looks like something is shutting down and changes are required.

@stuckless, or anyone else - do you know where changes need to be made?

Here is the message that I received:

They deprecated their TLS-SNI validation due to security problems.

If your ISP allows port 80 through you can use HTTP validation. Otherwise you may need to look into DNS validation. It's more complicated and depends on your registrar.

My ISP blocks port 80 so I had to turn to DNS validation. I use Cloudflare for my domain's DNS which is supported by the linuxserver letsencrypt Docker.

[stuckless]

Yeah, I had to port forward port 80 on my router to the container so that the letsencrypt could validate correctly.

[wayner]

I wanted to follow up on this as Let's Encrypt hasn't worked for me since this change occurred back in Feb.

What do I have to do to get things working? My Let's Encrypt docker is using port 5080 for http and 5443 for https. I have forwarded port 80 on my router to port 5080 on my unRAID server IP and port 443 to port 5443 on my unRAID server IP.

Help!

[jpwegas]

Double check which challenge type your Let's Encrypt config is using. You may need to switch to using HTTP-01 or DNS-01challenge types since they disabled the TLS-SNI-01 challenge in March 2019.

--John

[wayner]

Originally Posted by jpwegas

Double check which challenge type your Let's Encrypt config is using. You may need to switch to using HTTP-01 or DNS-01challenge types since they disabled the TLS-SNI-01 challenge in March 2019.

Where do you find the challenge? That isn't part of the docker config, so is that something that is set in config text files?

And do you have to do something initially to configure a token or something like that?

[jpwegas]

Originally Posted by wayner

Where do you find the challenge? That isn't part of the docker config, so is that something that is set in config text files?

Assuming you are using the ACME client, I think it's in the

/etc/letsencrypt/renewal/SITE.conf

file, where SITE is the hostname of the server. If the authenticator is webroot then I believe you are using HTTP-01.

Originally Posted by wayner

And do you have to do something initially to configure a token or something like that?

There is an 'account' field in that same file, but IIRC that is assigned automatically when you first start using ACME.

--John

[stuckless]

One of the things I find with unRAID docker settings is that they do not upgrade the configuration params after you've installed and configured an app. My letsencrypt does have a 'validation' field in the web config. But, I think to "upgrade" the web config, you need to actually remove the container, and then install it again, but, sadly that'll mean that you'll need to reconfigure it again as well. I've done this a couple times with other containers when I know I'm missing configurations in the web ui.

All that being said, I don't think my lestencrypt is working either, and I haven't had time to fix it

[wayner]

Anyone have any advice on how to get this functionality going again. The letsencrypt docker seems kind of dead now and/or there were certificate issues mentioned in post 31. It appears that SWAG has replaced the letsencrypt docker.

Any suggestion on other dockers to use for this purpose in unRAID? There is SWAG plus there are a few nginx dockers and an NginxProxyManager. Can one of these fulfill this purpose of acting as a gateway web page to my SageTV web service like the web UI, BMT, etc? T

I have not used that as much as I have VPN server running in a docker and I tend to make a VPN connection, but it would still useful to get this up and running.

[alfi33]

I switched over from LetsEncrypt to the SWAG Docker. I think it's basically the same...just a new name. The migration was very quick and easy. I mainly use it for Home Assistant but also still have it set up for the Sage Web Interface.