Posts made by opensourced

Yes, I did remount the shares.

@nebulon I actually run in the same issue on several instances. On some it still works however... I am using TrueNAS as the NFS server and it would be nice if i could keep using it. Any hint on where that error is coming from?

@nebulon See that point. Two use cases are:

WordPress exposes the example.com/xmlrpc.php API per default. We already had several issues where attackers used those APIs to send spam mails from our applications. To fix this issue, either you need to install a plugin that disables the API (however, dose plugins which are available for free are crapy and I dont trust them), or you just disable those requests in the nginx.conf of the application. This is what I did, but through updates those custom lines were deleted.

I would like to restrict the Synapse Admin API to certain IPs.

I would find it very useful if i could enter custom nginx rules (generally or per application), that would survive updates. Is this possible at the time beeing?

@nebulon nice! looking forward to this.. do you already know the release date?

@nebulon The instance that crashed on sunday is (and was at that time) running v7.2.5

Within the last month, I had 3 cloudron instances (running productive apps for clients) crashing, because the NFS mount could not be mounted and the root filesystem was used instead.

I find it frustrating to run into this issue so often. Mostly because I know it can happen every moment and I cant do anything about it.

How about adding a checkbox in the backup settings with the title "Skip backup if storage is not available"?

@girish I'm glad to see your efforts put in this issue. I think we are getting closer! I looked at the sip-communicator config of yunohost - as their jitsi is working on my systems and they actually set those variables.

A further indication that this is the only missing piece is this thread here...

Are there environment variables for the local and the public IPs? I would like to test this.

@girish We do have our own server farm in a data center. As host for our VMs, we use Proxmox.

@nebulon I actually have set up several Cloudron instances and none of them is able to get Jitsi to work. I suppose that if I provide a fresh VM, it wont be able to get it working either. Therefore it might be suitable for debugging.

(I still want to mention at this point that its neither port related, nor a networking issue as I have a working Jitsi (from Yunohost) on one of my VMs)

What do you think?

@potemkin_ai Well thats pretty frustrating... jitsi would be a key feature for my clients to decide for cloudron. Anyway, I guess i will invest another afternoon before i will drop my work on this front.

@nebulon If you are interested in debugging this issue, I would be happy to provide a vm with ssh access to get this issue solved. Where can i actually find the cloudron-jitsi repo? Didnt find it on your Github...

@potemkin_ai have you made progess so far?

I have been running into the similar (if not even the same) issue here. My VM is behind a firewall in a LAN. Ports are open and everything is ready to go, but sound and image doesn't work.

The interesting thing is, that running Jitsi on Yunohost, works like a charm. Compared to your situation with your other working instance of Jitsi, i would assume a configuration issue. I have started analyzing the config files, however not found a solution so far.

If i find a solution, i will post it here...

Cheers

In case of dns sinkholes, spamhaus even tells you date & time when the server tried to establish a tcp connection to the sinkholed domain (incl IP). Therefore i know that it is not the previous owner, but my cloudron instance, which apparently made that request.

SSH has never been accessible from wan (furthermore only ssh pub key authentication is set and root login is disabled.

So my question is: I know, that my running cloudron instance (or some app within) is the source of tcp connections targeting sinkhole domains. -> Do I have a possibility within cloudron (, docker or nginx generally) to filter (not block) traffic for certain IPs? I need to find the compromised container.

Traffic analysis on firewall level wont give me the container, therefore it is not really useful.

So I just ran a check on check.spamhaus.org and fount that one of my cloudron instances made a tcp connection to a suspicious ip address, that is part of a dns sinkhole. Therefore it got on a list of probably exploited machines. I checked logs on the server, mail logs, and so on, but could not trace down the application, from which the connection was made.

How can i get more insight in these kind of issues?

@nebulon the oposite is the case. for now i only allowed udp on port 10000.

@nebulon So i see there are several references to conference.jitsi.mydomain.com, should there be an DNS entry for that?

In the last line there might be something: No socket found for 172.18.19.68:10000/udp->10.1.23.114:47429/udp

Jun 29 15:16:07 Jicofo 2022-06-29 15:16:07.207 INFO: [18] [room=test@conference.jitsi.mydomain.com meeting_id=760ece5a-d598-44bd-8fbc-fa7a703cb364] ColibriV2SessionManager.updateParticipant#463: Updating Participant[test@conference.jitsi.mydomain.com/606b8125]@389775379 with transport=org.jitsi.xmpp.extensions.jingle.IceUdpTransportPacketExtension@7685622d, sources=null
Jun 29 15:16:07 172.18.0.1 - - [29/Jun/2022:15:16:07 +0000] "POST /http-bind?room=test HTTP/1.1" 200 346 "-" "okhttp/3.12.1"
Jun 29 15:16:07 JVB 2022-06-29 15:16:07.214 INFO: [58] [confId=ce7c241269d72044 conf_name=test@conference.jitsi.mydomain.com epId=606b8125 stats_id=Darlene-XN4 local_ufrag=7iv6f1g6o0h983 ufrag=7iv6f1g6o0h983 name=stream-606b8125 componentId=1] Component.addUpdateRemoteCandidates#345: Update remote candidate for stream-606b8125.RTP: 10.1.23.114:47429/udp
Jun 29 15:16:07 JVB 2022-06-29 15:16:07.216 INFO: [58] [confId=ce7c241269d72044 conf_name=test@conference.jitsi.mydomain.com epId=606b8125 stats_id=Darlene-XN4 local_ufrag=7iv6f1g6o0h983 ufrag=7iv6f1g6o0h983 name=stream-606b8125 componentId=1] Component.updateRemoteCandidates#482: new Pair added: 172.18.19.68:10000/udp/host -> 10.1.23.114:47429/udp/host (stream-606b8125.RTP).
Jun 29 15:16:07 JVB 2022-06-29 15:16:07.227 INFO: [61] [confId=ce7c241269d72044 conf_name=test@conference.jitsi.mydomain.com=606b8125 stats_id=Darlene-XN4 local_ufrag=7iv6f1g6o0h983 ufrag=7iv6f1g6o0h983] ConnectivityCheckClient.startCheckForPair#350: Could not start connectivity check: No socket found for 172.18.19.68:10000/udp->10.1.23.114:47429/udp

@nebulon I checked the logs but the turn service didn't log anything. I also tried to start the app in recovery mode, but the /var/log/ didnt have anything useful. Are there other ways to get more information out of it?

@nebulon I just tried both modes (i set them in the .json config file) with 3 participants. None was working.

I have been trying to use jitsi for several times now. Until now, I haven't managed to get video and sound to work.

My cloudron instance is running on a vm in a LAN, with a public IP assigned (NAT) which is assigned by a firewall. Ofc i opened the port 10000 (i even opened all ports when i tried to get it to working last time).

Am I the only one with that problem or is further configuration required? I guess its possible that jitsi thinks that the LAN IP is its pub IP, although its not & therefore runs into a problem.

With yunohost, it was very easy to install jitsi -> install & open ports -> done. So i checked some configs there and tried out some things but without success. Help is very much appreciated

If you need some logs (i didn't get useful output in the container logs), tell me which ones...

Thanks in advance

@girish Basically these are php files that make use of db variables and properties defined in the GUI. However, to make (in my opinion essential) customizations, I need to edit these templates. These changes however are mostly to optimize the user experience.

For me they dont need to be editable during runtime. If i could make the changes persist in recovery mode and the restart the app with the adapted files in readonly, that would be perfect.

Best

@girish Any news on how to accomplish that? Thanks a lot!

@girish I moved the appsdata folder to another mounted drive -> after creating the symlink (as root) i didn't propperly set the permissions. I fixed it, so all good now. Thanks!

@girish just hit the same error...

May 28 14:27:13 box:tasks update 186: {"percent":50,"message":"Creating app data directory"}
May 28 14:27:13 box:apptask run: app error for state pending_install: BoxError: Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'
at createAppDir (/home/yellowtent/box/src/apptask.js:119:22)
at async install (/home/yellowtent/box/src/apptask.js:358:5) {
reason: 'FileSystem Error',
details: {}
May 28 14:27:13 box:taskworker Task took 12.297 seconds
May 28 14:27:13 box:tasks setCompleted - 186: {"result":null,"error":{"stack":"BoxError: Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'\n at createAppDir (/home/yellowtent/box/src/apptask.js:119:22)\n at async install (/home/yellowtent/box/src/apptask.js:358:5)","name":"BoxError","reason":"FileSystem Error","details":{},"message":"Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'"}}
May 28 14:27:13 box:tasks update 186: {"percent":100,"result":null,"error":{"stack":"BoxError: Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'\n at createAppDir (/home/yellowtent/box/src/apptask.js:119:22)\n at async install (/home/yellowtent/box/src/apptask.js:358:5)","name":"BoxError","reason":"FileSystem Error","details":{},"message":"Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'"}}
Error creating directory: EACCES: permission denied, mkdir '/home/yellowtent/appsdata/8076edfc-1155-43e1-9bc1-f00aa3f207c5'
at createAppDir (/home/yellowtent/box/src/apptask.js:119:22)
at async install (/home/yellowtent/box/src/apptask.js:358:5)

my outputs are as followed:

root@host:/home/# systemctl show box | grep User=
User=yellowtent
DynamicUser=no

root@host:/home/# su - yellowtent
This account is currently not available.

What could be the reasons for my yellowtent not to be availlable?

Thanks in advance!

@girish one of the files i want to change is htdocs/public/members/new.php

On my dolibarr instance, i would like to edit some php templates. Once i placed the app in recovery mode and made the desired changes. After running ./start.sh the changes are visible and running fine. However, when i disable the recovery state, my changes are somehow reset to the original state.

How can i make the changes persist?
Thanks in advance!

After the setup and entering all required information, the test email works fine. However the automail configuration is not working.

When I go to Members > create a new Member > click Validate > In the modal, The "sender" field is empty > I get the error "Click here to setup mandatory parameters"

Additional information: When i go to Home > Setup > Email > Field "Sender email for automatic emails (default value in php.ini: Undefined)" is to the correct email address.

I tried to set this variable (MAIN_INFO_SOCIETE_MAIL) on my own in the settings, but that did not fix the issue.

Can anyone confirm this issue & possibly provide a fix?

Thanks in advance!

I am running my instance of Rocket.Chat and still have not managed to get the push notifications working.

Around one month ago, I have opened a thread in the RC forum, because I thought the error i got was more relied to their side. As I am not getting an answer there, I decided to link this one here as well.

So I have set up my RC instance and I registered it on RC Cloud.

The Push Gateway is enabled and set to https://gateway.rocket.chat/.

I installed the RC apps on an iPhone, an android phone as well as on my Macbook. Finally I also managed to send test-push-notifications via the dedicated button. It tells me that it has successfully sent a test notification to 1 device. However, having checked the settings and permissions on the phones, I to not receive any notification on either of them.

When I look at the Log I can see two suspicious entries. What is the remoteIP? The VM of the RC is NATed by a firewall and does have a dedicated public IP, which is obviously not the remoteIP. May that be the problem? How could I change this?

{"level":35,"time":"2021-11-01T09:15:10.813Z","pid":1,"hostname":"ca5sdgh54-1a8d-4564-b816-8d3e5edffd65","name":"API","method":"POST","url":"/api/v1/method.call/push_test","userId":"So49htrw","userAgent":"Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0","length":"87","host":"rocketchat.foobar.com","referer":"https://rocketchat.foobar.com/admin/Push",**"remoteIP":"172.16.115.1"**,"status":200,"responseTime":67} {"level":50,"time":"2021-11-01T09:15:11.118Z","pid":1,"hostname":"ca35684-1a484-b816-8d3e5d65","name":"Push","msg":"Error sending push to gateway (0 try) -> {\"response\":{\"statusCode\":404,\"content\":\"404 page not found\",\"headers\":{\"access-control-allow-headers\":\"Content-Type, Authorization, Content-Length, X-Requested-With\",\"access-control-allow-methods\":\"GET, PUT, POST, DELETE, OPTIONS\",\"access-control-allow-origin\":\"*\",\"access-control-expose-headers\":\"Content-Type, Authorization, Cache-Control, Expires, Pragma, X-powered-by\",\"cache-control\":\"private, no-cache, no-store, must-revalidate\",\"content-length\":\"18\",\"content-type\":\"text/plain\",\"date\":\"Mon, 01 Nov 2021 09:15:11 GMT\",\"expires\":\"-1\",\"pragma\":\"no-cache\",\"x-powered-by\":\"Rocket Fuel and Rocketeers\",\"connection\":\"close\"},\"data\":null}}"} 

The second entry I do not understand is this…

{"level":50,"time":"2021-11-01T09:11:15.118Z","pid":1,"hostname":"ca54-b816-8d3edffd65","name":"Push","msg":"Error sending push to gateway (4 try) -> {\"response\":{\"statusCode\":404,\"content\":\"404 page not found\",\"headers\":{\"access-control-allow-headers\":\"Content-Type, Authorization, Content-Length, X-Requested-With\",\"access-control-allow-methods\":\"GET, PUT, POST, DELETE, OPTIONS\",\"access-control-allow-origin\":\"*\",\"access-control-expose-headers\":\"Content-Type, Authorization, Cache-Control, Expires, Pragma, X-powered-by\",\"cache-control\":\"private, no-cache, no-store, must-revalidate\",\"content-length\":\"18\",\"content-type\":\"text/plain\",\"date\":\"Mon, 01 Nov 2021 09:11:15 GMT\",\"expires\":\"-1\",\"pragma\":\"no-cache\",\"x-powered-by\":\"Rocket Fuel and Rocketeers\",\"connection\":\"close\"},\"data\":null}}"} {"level":30,"time":"2021-11-01T09:11:15.119Z","pid":1,"hostname":"ca5e0f54-1a4d-4594-b816-8d3e5edffd65","name":"Push","msg":"Trying sending push to gateway again in 960000 'milliseconds'"} 

Follow the thread here:
https://forums.rocket.chat/t/getting-push-notifications-to-work/12513

Thanks in advance!

ejabberd would be freakin amazing!!

@girish thanks a lot! I can confirm that its working now.

@opensourced nevermind, i figured it out!

@jdaviescoates So I took another approach and setup another vm running an nfs-server. With that advice i was ableto connect it to the cloudron.

@girish Next to the main cloudron instance (which is paid plan), i do have another cloudron instance running (free plan). On this one I am not able to connect the same nfs share. Is that feature only working for paid plans?

@scooke
@murgero

I am working on get my FreeNAS NFS mount working for the backups, but that seems to be a bit difficult to get the permissions working.

If you have experience with NFS, you might have an answer on my problem here...

https://forum.cloudron.io/topic/5927/cloudron-backups-on-truenas-nfs-mount/3?_=1636891033300

However thanks!

I configured a monitoring in Grafana and would like to make Grafana send me alerts via email.

When I add the notification channel in the Alert settings and try to send a test notification, i get an error. Any idea on how to fix this?

INFO[11-13|23:27:20] Sending alert notification to logger=alerting.notifier.email addresses=[root@mydomain.com] singleEmail=false

Nov 13 23:27:20 EROR[11-13|23:27:20] Failed to send alert notification email logger=alerting.notifier.email error="Failed to send notification to email addresses: root@mydomain.com: unencrypted connection"

Nov 13 23:27:20 EROR[11-13|23:27:20] failed to send notification logger=alerting.notifier uid= error="Failed to send notification to email addresses: root@mydomain.com: unencrypted connection"

Nov 13 23:27:20 EROR[11-13|23:27:20] failed to send notification logger=alerting.notifier uid= error="Failed to send notification to email addresses: root@mydomain.com: unencrypted connection"

Nov 13 23:27:20 EROR[11-13|23:27:20] Failed to send alert notifications logger=context userId=2 orgId=1 uname=root error="Failed to send notification to email addresses: root@mydomain.com: unencrypted connection" remote_addr=172.17.2.1

Nov 13 23:27:20 EROR[11-13|23:27:20] Request Completed logger=context userId=2 orgId=1 uname=root method=POST path=/api/alert-notifications/test status=500 remote_addr=172.17.2.1 time_ms=27 size=48 referer=https://grafana.mydomain.com/alerting/notification/3/edit

Thanks in advance!

A backup task was filling up the whole storage of my VM & killed the cloudron instance. I removed the backup in /var/backup and restarted the VM. cloudron showed me:

«You are seeing this page because this domain points to Cloudron server IP but no app is installed on that domain.»

I checked the box status and all seemed good, however I didnt got it back to running. After trying some things, I recovered the whole vm from a backup.

How can i prevent this from happening next time?

@girish Thanks for the superfast reply! I checked the web and the TrueNAS Forum for a hint where I can change this setting. Didn't find it though. Do you have that information handy as well?

So I am trying out the backup capability of cloudron using NFS shares. After setting up the NFS share on TrueNAS and opening the permissions, I managed to attach the share to cloudron.
However, the backup fails and I receive the following log message:

Oct 30 12:52:49 box:backupupload v8 heap : used 22807312 total: 24461312 max: 4345298944
Oct 30 12:52:53 box:tasks 306: {"percent":93.30769230769232,"message":"Uploading backup 2M@2MBps (box)"}
Oct 30 12:53:14 box:tasks 306: {"percent":93.30769230769232,"message":"Uploading backup 2M@2MBps (box)"}
Oct 30 12:53:14 box:shell backup-snapshot/box (stdout): 2021-10-30T12:53:14.420Z box:backupupload upload completed. error: BoxError: Unable to chown:EINVAL: invalid argument, chown '/mnt/cloudronbackup/snapshot/box.tar.gz'
at WriteStream.<anonymous> (/home/yellowtent/box/src/storage/filesystem.js:138:95)
at WriteStream.emit (events.js:327:22)
at finish (internal/streams/writable.js:657:10)
at finishMaybe (internal/streams/writable.js:644:9)
at internal/streams/writable.js:617:7
at WriteStream._final (internal/fs/streams.js:355:3)
at callFinal (internal/streams/writable.js:610:10)
at processTicksAndRejections (internal/process/task_queues.js:80:21) {
reason: 'External Error',
details: {}
Oct 30 12:53:14 box:backups runBackupUpload: result - {"result":"Unable to chown:EINVAL: invalid argument, chown '/mnt/cloudronbackup/snapshot/box.tar.gz'"}

Cloudron was able to make a directory on the share, however, the owner of the file is «nobody».

Is this somehow related to the permission settings on TrueNAS?

Thanks in advance!