SSL Certificate for server

[stre1026]

@stre1026

@Pitou - I changed the code to launch passenger as you suggested but now I’m running into issues where I need to whitelist domains, etc. in the Ruby application. I did that and now I’m running into exceptions with the Action Controller. Before I go down that rabbit hole, did you run into any of these problems?

Never mind! I figured out that issue. I had the environment set to development.

[RickCarlino]

@stre1026 @pitou

I couldn’t figure out how to download the Gem into the container.

You need to:

• add the entry to the Gemfile, eg: add a gem "rails" entry to install rails.

• run sudo docker-compose run web bundle install.

• Restart all containers

When I disable the variable, I have a browser call to wss://my-domain.com:3002/ws (but of course no answer)

I am unsure of this one and don’t have time to investigate, unfortunately. Perhaps you need to change the ws:// to wss:// when FORCE_SSL is enabled?

Here’s how we do it in a production settings (on Heroku, not Docker):

# Notice, no `mqtt://` protocol specifier here

MQTT_HOST=foo.bar.com

# This will be system specific. The default is "/"

MQTT_VHOST=xyz

# This value is copy/pasted by the web app.

# Notice I added a protocol specifier and port number.

MQTT_WS=wss://foo.bar.com:443/ws/mqtt

[stre1026]

Thanks @RickCarlino

@Pitou

Here’s what I’m going to try for the reverse-proxy and RabbitMQ:

Secure rabbitmq connections with HAProxy

Seems simple enough, but you know how this goes!

Thanks,
Steve

[Pitou]

@RickCarlino

Perhaps you need to change the ws:// to wss:// when FORCE_SSL is enabled?

When I put wss:// the browser does the get request for a websocket again. So I think it’s not possible to force https for the web application and to use ws:// at the same time.

I am unsure of this one and don’t have time to investigate

I don’t know if it’s a rule in the browser or something in the ruby application. Don’t lose your time on this, I will setup wss:// for Rabbit

[stre1026]

@RickCarlino

I just got HaProxy working for the RabbitMQ. The problem I’m having right now is I’m getting content security errors in the browser so it doesn’t work on the site of course but it is secure. Any idea how I can get around that? I’m using the same root domain for both servers. I thought that was the only thing would affect CSP. Maybe something else I’m missing?

Thanks!

[RickCarlino]

@stre1026

I just got HaProxy working for the RabbitMQ.

This is great news! Congratulations! I hope you can share your steps with the community once we figure out the CSP issues.

RE: CSP problems- I think you probably are missing (or misconfigured) one of the following ENV vars.

I have provided example values after the # character.

Does this look similar on your end?

API_HOST      # => "foo.bar.org"
MQTT_HOST     # => "foo.bar.org"
EXTRA_DOMAINS # => "foo.bar.org" (probably not required- comman seperated list of all domains)
API_PORT      # => "443"
FORCE_SSL     # => "true"

Please let me know and if not, can keep investigating.

[stre1026]

@RickCarlino

quote=“RickCarlino, post:26, topic:6151”]
This is great news! Congratulations! I hope you can share your steps with the community once we figure out the CSP issues.
[/quote]

Absolutely. However, I think I broke it I was trying to fix the CSP issues and now I’m getting an error in the browser console that is saying: “failed: Connection closed before receiving a handshake response” so I have to figure out what I did to cause that.

But I think I’m close.

I also found another method to do this without the reverse-proxy which is along the lines of what @Pitou is doing but I have to figure out how to edit your RabbitMQ config file within the Docker container. Docker is relatively new to me.

[RickCarlino]

@stre1026 I might be able to help. At one point, FarmBot had a script that would generate the RabbitMQ config at startup, based on .env files.

[stre1026]

@RickCarlino

I want to see if I can get the reverse proxy working because I’m invested now but…

Is there a quick crash course on how to edit the config file in the Docker image you have?

[stre1026]

@RickCarlino

Here’s an odd one: I’m getting this error now:

client.js:1076 Uncaught Error: Connection refused: Bad username or password
at _._handleConnack (client.js:1076)
at _._handlePacket (client.js:365)
at d (client.js:283)
at g.n._write (client.js:294)
at m (_stream_writable.js:428)
at _ (_stream_writable.js:417)
at g.write (_stream_writable.js:334)
at _.f (_stream_readable.js:619)
at _.o.emit (events.js:152)
at S (_stream_readable.js:291)

Any idea why this would happen after going through the HAProxy? I don’t think it’s requesting credentials…

[RickCarlino]

@stre1026 A few things:

1. Not sure what’s going on with that error. It would be good to post your work onto Github (with build instructions in the README.md file) and I can take a look when I have time. In the meantime, I would try to completely log out and log back in to see if that helps.
2. Editing the RabbitMQConfig happens in this file. It is basically Ruby code that dynamically generates the RabbitMQ config before the application starts. CC: @Pitou You will need to write some Ruby to make this work. Is this what you were looking for?

[stre1026]

@RickCarlino

Thanks for your help as always!

I honestly haven’t modified much code at all. I’ve only changed the .env file and I changed the docker-compose.yml file. That’s it. I’m still running into the CSP issues on one browser but the socket appears to come up security now. It’s still not working due to that login issue which is odd but I’ll get there.

I appreciate the help with the rabbitMQ config. I will check that out. I just need to add some variables to the config so it looks like you pretty much have that outlined in there already…

I’ll report back when I have more time to work on this. The weather is supposed to be beautiful this weekend in the Northeast so I’m hoping to actually get outside and start assembling the Farmbot!