Join the conversation

Sign in to join this conversation, and others like it, in the communities you care about.

Wekan

General

Wekan is an open-source kanban board (Trello like) which allows a card-based task and to-do management.

More active conversations

Wekan / General

Caddy https

Caddy https

Wekan/General · April 6, 2020 at 5:17pm

Ahmad Arshad

@muji786
rep
54

Caddy https

Wekan / General · April 6, 2020 at 5:17pm

Dear all, Need a little help running wekan in production. Installed wekan via the snapd method on ubuntu 18. Followed the following:

https://github.com/wekan/wekan-snap/wiki/Install

On step 8 and 9, I installed caddy and get root@dai2:/home/ubuntu# snap services Service Startup Current Notes wekan.caddy enabled active - wekan.mongodb enabled active - wekan.wekan enabled active -

My caddyfile looks like (xxx to mask IP address) https://128.122.xxx.xxx { tls { alpn http/1.1 } proxy / localhost:3001 { websocket transparent } }

Do I need to take extra steps to use https? if so what are those? because I get

This site can’t provide a secure connection128.122.xxx.xxx sent an invalid response. ERR_SSL_PROTOCOL_ERROR

many thanks for help

April 6, 2020 at 6:06pm
Ahmad Arshad@muji786
6:06pm

root@dai2:/home/ubuntu# snap logs wekan.wekan 2020-04-06T18:02:52Z wekan.wekan[30014]: ATTACHMENTS_STORE_PATH= (default value) 2020-04-06T18:02:52Z wekan.wekan[30014]: SCROLLINERTIA=auto (default value) 2020-04-06T18:02:52Z wekan.wekan[30014]: error: error running snapctl: get which option? 2020-04-06T18:02:52Z wekan.wekan[30014]: SCROLLAMOUNT= (default value) 2020-04-06T18:02:52Z wekan.wekan[30014]: caddy is enabled, adjusting ports 2020-04-06T18:02:52Z wekan.wekan[30014]: CADDY_PORT=3001 2020-04-06T18:02:52Z wekan.wekan[30014]: PORT=3001 2020-04-06T18:02:52Z wekan.wekan[30014]: MONGO_URL=mongodb://127.0.0.1:27019/wekan 2020-04-06T18:02:55Z wekan.wekan[30014]: Presence started serverId=iiRNmCTdCwnHG3nJE 2020-04-06T18:02:56Z wekan.wekan[30014]: Meteor APM: completed instrumenting the app

    • reply
    • like
    6:07pm

    root@dai2:/home/ubuntu# snap logs wekan.caddy 2020-04-06T18:01:50Z wekan.caddy[29215]: SCROLLINERTIA=auto (default value) 2020-04-06T18:01:50Z wekan.caddy[29215]: error: error running snapctl: get which option? 2020-04-06T18:01:50Z wekan.caddy[29215]: SCROLLAMOUNT= (default value) 2020-04-06T18:01:50Z wekan.caddy[29215]: caddy is enabled, adjusting ports 2020-04-06T18:01:50Z wekan.caddy[29215]: CADDY_PORT=3001 2020-04-06T18:01:50Z wekan.caddy[29215]: PORT=3001 2020-04-06T18:01:50Z wekan.caddy[29215]: Activating privacy features... done. 2020-04-06T18:01:50Z wekan.caddy[29215]: Serving HTTPS on port 443 2020-04-06T18:01:50Z wekan.caddy[29215]: https://128.122.xxx.xxx 2020-04-06T18:01:50Z wekan.caddy[29215]: WARNING: File descriptor limit 1024 is too low for production servers. At least 8192 is recommended. Fix with ulimit -n 8192.

      • reply
      • like
      6:08pm

      root@dai2:/home/ubuntu# curl https://128.122.xxx.xxx curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

        • reply
        • like
        April 6, 2020 at 8:09pm
        Ahmad Arshad@muji786
        8:09pm

        The one thing that comes to mind is that 128.122.xxx.xxx is a floating IP address that is bound to the 10.0.0 ip

        ens3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9000 inet 10.0.3.165 netmask 255.255.255.0 broadcast 10.0.3.255 inet6 fe80::f816:3eff:fe51:4142 prefixlen 64 scopeid 0x20<link> ether fa:16:3e:51:41:42 txqueuelen 1000 (Ethernet) RX packets 29015 bytes 85825692 (85.8 MB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 19790 bytes 1735777 (1.7 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

        ens4: flags=4098<BROADCAST,MULTICAST> mtu 8950 ether fa:16:3e:52:cd:29 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

          • reply
          • like
          April 7, 2020 at 8:28am
          Lauri Ojansivu@xet7
          Team
          8:28am

          IP address can not have https

            • reply
            • like
            8:28am

            you need for example subdomain name like https://boards.example.com

              • reply
              • like
              8:28am

              See https://github.com/wekan/wekan/wiki/Settings

                • reply
                • like
                8:29am

                You can get domain name for example from https://namecheap.com

                  • reply
                  • like
                  8:31am

                  And then in those nameserver settings set A record pointing to your IP address

                    • reply
                    • like
                    8:31am

                    and after that set caddy config

                      • reply
                      • like
                      8:31am

                      and sudo snap set caddy-enabled='true'

                        • reply
                        • like
                        8:32am

                        If you don't need SSL/HTTPS, then it's not needed to use Caddy

                          • reply
                          • like
                          8:33am

                          In that case you can: sudo snap set caddy-enabled='false'

                            • reply
                            • like
                            8:33am

                            and sudo snap set wekan port='80'

                              • reply
                              • like
                              8:34am

                              For my servers, I use https://www.cloudflare.com/ SSL and nameservers

                                • reply
                                • like
                                8:35am

                                Info about CloudFlare settings is here https://github.com/wekan/wekan/wiki/Caddy-Webserver-Config

                                  • reply
                                  • like
                                  8:35am

                                  because from CloudFlare there is wildcard SSL for about 15 years and nameserver web interface for free

                                    • reply
                                    • like
                                    8:36am

                                    it's better than Let's Encrypt for me, because I had problems activating Let's Encrypt on those servers

                                      • reply
                                      • like
                                      8:36am

                                      although, on some other webservers Let's Encrypt has worked fine

                                        • reply
                                        • like
                                        8:37am

                                        You get list of all Wekan settings at server bash like this: wekan.help | less

                                          • reply
                                          • like
                                          8:37am

                                          less paginates long results

                                            • reply
                                            • like