[Intranet] Install cloudron in a corporate network environment

[nebulon]

The setup token here would be sent to the Cloudron backend on the VM and that will attempt to verify it calling api.cloudron.io so I guess that connection does not work. Not sure what would need to be configured to make the box nodejs process use the proxy...

[rmdes]

@rmdes said in [Intranet] Install cloudron in a corporate network environment:

Perhaps related to how (see first post) I had to comment the "check version" part of the cloudron-setup and manually set the box_src_dir and the version (7.7.1)

requestedVersion="7.7.1"
version="7.7.1"

Perhaps something should have been done to that VERSION thing when it's retrieved via the api ?

just for the sake of leaving a trail about this :

I had to manually add 7.7.1 inside the VERSION file at /home/yellowtent/box

[rmdes]

@nebulon is it using one of the scripts inside /home/yellowtent/box/scripts to make this call ?

[nebulon]

It is a nodejs process called box managed by systemd via https://git.cloudron.io/cloudron/box/-/blob/master/setup/start/systemd/box.service?ref_type=heads

[rmdes]

in line with different issues I was having earlier (no DIST folder inside ~/box/dashabord/dist)
I tested zipping and copying a dist folder from another cloudron to this intranet VM and that's when I managed to have the nginx service to run and the box to actually start, I searched for why the dist folder wasn't being built but I could not find a root cause, since I did manage to run each part of the cloudron-setup, in the end, even if I had to run the last part multiples times to get it done in full without any issues.

$ sudo docker ps
CONTAINER ID   IMAGE                                           COMMAND                CREATED          STATUS          PORTS                      NAMES
68c9ba37e3fc   registry.docker.com/cloudron/sftp:3.8.6         "/app/code/start.sh"   25 minutes ago   Up 25 minutes   0.0.0.0:222->22/tcp        sftp
d2b73ebf372d   registry.docker.com/cloudron/graphite:3.4.3     "/app/code/start.sh"   25 minutes ago   Up 25 minutes   127.0.0.1:2003->2003/tcp   graphite
d92d85ddd963   registry.docker.com/cloudron/mongodb:6.0.0      "/app/code/start.sh"   26 minutes ago   Up 26 minutes                              mongodb
7abb3c530b8e   registry.docker.com/cloudron/postgresql:5.2.1   "/app/code/start.sh"   26 minutes ago   Up 26 minutes                              postgresql
198524bd2eff   registry.docker.com/cloudron/mysql:3.4.2        "/app/code/start.sh"   27 minutes ago   Up 27 minutes                              mysql
f3dd10277ac2   registry.docker.com/cloudron/turn:1.7.2         "/app/code/start.sh"   27 minutes ago   Up 27 minutes                              turn
8381d2785cf4   registry.docker.com/cloudron/mail:3.12.1        "/app/code/start.sh"   27 minutes ago   Up 27 minutes                              mail
cloudron@T00MID01:/home/yellowtent$

[rmdes]

@nebulon hmm interesting, let me check what I can do

[girish]

@rmdes if you are feeling brave, you have to wrap that service via redsocks. https://superuser.com/questions/1401585/how-to-force-all-linux-apps-to-use-socks-proxy .

[rmdes]

Or I could add this below directly to the box.service file ?

Environment="http_proxy=http://myproxy:1234" "https_proxy=http://proxy:1234"

[girish]

@rmdes apparently, node.js does not respect those variables. See thread at https://groups.google.com/g/nodejs/c/2ZFLIAUfTFs?pli=1 . Maybe https://github.com/TooTallNate/proxy-agents/tree/main/packages/proxy-agent

[rmdes]

I'm going to investigate redsocks

in the meantime the only error remaining has to do with collectd, the service appears to be running fine
but the graphie containers freaks out as if graphite had never been initialized

┐
│                                                                                                                                                                   │
│   WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x55988453aa90 pid: 19 (default app)                                                               │
│   *** uWSGI is running in multiple interpreter mode ***                                                                                                           │
│   spawned uWSGI master process (pid: 19)                                                                                                                          │
│   spawned uWSGI worker 1 (pid: 26, cores: 1)                                                                                                                      │
│   spawned uWSGI worker 2 (pid: 27, cores: 1)                                                                                                                      │
│   2024-04-02 09:38:27,960 INFO success: uwsgi entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)                                       │
│   2024-04-02 09:38:27,960 INFO success: carbon-cache entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)                                │
│   2024-04-02 09:38:27,963 INFO spawned: 'whisper-cleanup' with pid 28                                                                                             │
│   Cleanup old whisper databases...                                                                                                                                │
│   find: ‘/var/lib/graphite/whisper/collectd/localhost/’: No such file or directory                                                                                │
│   2024-04-02 09:38:27,978 INFO exited: whisper-cleanup (exit status 1; not expected)                                                                              │
│   2024-04-02 09:38:29,984 INFO spawned: 'whisper-cleanup' with pid 30                                                                                             │
│   Cleanup old whisper databases...                                                                                                                                │
│   find: ‘/var/lib/graphite/whisper/collectd/localhost/’: No such file or directory                                                                                │
│   2024-04-02 09:38:30,000 INFO exited: whisper-cleanup (exit status 1; not expected)                                                                              │
│   2024-04-02 09:38:33,007 INFO spawned: 'whisper-cleanup' with pid 32                                                                                             │
│   Cleanup old whisper databases...                                                                                                                                │
│   find: ‘/var/lib/graphite/whisper/collectd/localhost/’: No such file or directory                                                                                │
│   2024-04-02 09:38:33,022 INFO exited: whisper-cleanup (exit status 1; not expected)                                                                              │
│   2024-04-02 09:38:34,023 INFO gave up: whisper-cleanup entered FATAL state, too many start retries too quickly     

[girish]

@rmdes you docker stop graphite, rm -rf /home/yellowtent/platformdata/graphite/* and then docker start graphite.

[rmdes]

@girish just did, but it stays in the same state :

[rmdes]

Hmm redsocks is difficult, I need more time to analyze which local IP I have to configure so that requets are temporarily routed to it

2024/04/02 14:44:39 [error] 88905#88905: *1350 upstream prematurely closed connection while reading response header from upstream, client: 10.200.3.157, server: my.c
loudron.***.****.***, request: "POST /api/v1/appstore/register_cloudron_with_setup_token HTTP/2.0", upstream: "http://127.0.0.1:3000/api/v1/appstore/register_cloudro
n_with_setup_token", host: "my.cloudron.***.****.***", referrer: "https://my.cloudron.***.****.***/"
2024/04/02 14:44:39 [error] 88905#88905: *1350 connect() failed (111: Unknown error) while connecting to upstream, client: 10.200.3.157, server: my.cloudron..***.****.***, request: "GET /api/v1/cloudron/status HTTP/2.0", upstream: "http://127.0.0.1:3000/api/v1/cloudron/status", host: "my.cloudron.***.****.***", referrer: "https:/
/my.cloudron.***.****.***/"

i'm wondering if there is a curl command I could do to register this token and then a file I could edit with the token

[nebulon]

The cloudron will rely more on the api server for example to contact the app store, so the Cloudron will need to be able to reach that anyways.

[rmdes]

@girish i'm able to get npm packages just fine by having my .npmrc configured to use my intranet proxy, I wonder if the systemd box service couldn't be used to also use npmrc ?

[girish]

@rmdes no, we have to write code to make box code work with a http proxy. node.js does not support it out of the box. npm has written special code to make this work.

[rmdes]

huh okay, but does this mean I'm the only one having deployed (more or less) cloudron in this context ?

[girish]

@rmdes yes, we am not aware of anyone deploying cloudron with just a http(s) proxy. It's not tested or supported. there's probably more failures down the line. Basically, anything non-http won't work (dns,email etc)

[rmdes]

Indeed I'm aware of this, my goal was more the access to app-store and smooth app upgrades and of course : Active Directory support to enable easy SSO in my context.

And because we have our self-signed certificate deployed across our entire Windows Desktop park, I was thinking that would have been enough to sign my "cloudron.intranet.domain" with our root certificate and then enable anyone in the IT dept to access a set of applications.