How can I create access via an SSL subdomain to a MeshCentral Docker instance?

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu Linux 22.04.2
Webmin version 2.021
Virtualmin version 7.5
Related packages latest docker, latest apache

I have created a MeshCentral Docker instance via docker compose.

(Compare (in German) = “Installation von MeshCentral | heise online”)

I have a subdomain.domain.tdl on my server “mesh.DOMAIN.TDL” with which I want to address the instance on the server.

The problem is that in the default setting, the MeshCentral instance wants to connect to ports 443 and 80, which does not work because it is already occupied and prevented by Server / Virtualmin||Webmin.

So I try to set the port to 4040 as an example, which also works when the instance is created by Docker, and the instance starts. I set the ports in docker-compose.yaml:

  • 4041:443
  • 4040:80
    In the 443-host file of mesh.domian.tdl, I tried various settings that I “googled” together.
    None of them resulted in the web call from “mesh.domain.tdl” being passed through to the instance and the MeshCentral admin page being displayed.

My question, has anyone tried installing MeshCentral in a Docker instance and calling it from a webmin/virtuelmin with a virtual domain via a web page?
Maybe someone has an example of the “docker-compose.yaml” and the Apache website settings… or a good idea for me to follow.

The Apache modules are set up and activated for MeshCentral among others.

2

Are you trying to go to ports 4040/41 directly in the browser or are you trying to proxy them through Apache?

3

I trying it to proxy them through Apache.
I try many configuration settings like
SSLProxy or with RewriteEngine und ProxyPass

What I am missing is the right approach.
What is the better method in my Apache site.conf (433 section)?

I tried it with my settings on OnlyOffice (also via Docker in the environment) like:

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

SetEnvIf Host "^(.*)$" THE_HOST=$1
RequestHeader setifempty X-Forwarded-Proto https
RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e
ProxyAddHeaders Off
#
ProxyPassMatch (.*)(\/websocket)$ "ws://127.0.0.1:xxxxx/$1$2"
ProxyPass / "http://127.0.0.1:xxxxx/"
ProxyPassReverse / "http://127.0.0.1:xxxxx/"

I tried it with different instructions I found…example:

#################################################
RewriteEngine on
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule . "ws:///127.0.0.1:4040%{REQUEST_URI}" [P]

ProxyPassMatch ^/robots.txt !
ProxyPass / http:///127.0.0.1:4040/ connectiontimeout=86400 timeout=30
ProxyPassReverse / http://127.0.0.1:4040/
ProxyPreserveHost On
#
#SSLUseStapling on
#########################################################

None of the examples worked, but it is also possible that they do not have the same setting.

4

Another step further, now the MeshCentral server reports, but I do not get the login page displayed correctly. Only a page with a logo is displayed, even the subsequent appendix to the url " */login" does not help. So I continue to research and test.

For interested and further researchers:

Setup:

  • root server with several virtual domains installed and configured with virtualmin / webmin
  • a subdomain á la mesh.domain.tld
  • Apache domain.conf: (433 section) with two different examples:

SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
ProxyPreserveHost On
ProxyPass / https://127.0.0.1:xxxxx/
ProxyPassReverse / https://127.0.0.1:xxxxx/

or


SSLProxyEngine on
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

SetEnvIf Host "^(.*)$" THE_HOST=$1
RequestHeader setifempty X-Forwarded-Proto https
RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e
ProxyAddHeaders Off

ProxyPassMatch (.*)(\/websocket)$ "ws://127.0.0.1:yyyyy/$1$2"
ProxyPass / "https://127.0.0.1:yyyyyy/"
ProxyPassReverse / "https://127.0.0.1:yyyyyy/"
  • To do this, use docker composer to create a meshcentral installation via the docker script [docker-compose.yaml]:
version: '3'

services:
  meshcentral:
    restart: always
    container_name: meshcentral
    image: ghcr.io/ylianst/meshcentral:latest
    ports:
      - xxxx0:443
      - xxxx1:80
    environment:
      - NODE_ENV=production
      - HOSTNAME=mesh.domain.tld #Adapt domain
      - USE_MONGODB=false
      - REVERSE_PROXY=false
      - REVERSE_PROXY_TLS_PORT=
      - IFRAME=false
      - ALLOW_NEW_ACCOUNTS=false
      - WEBRTC=false
      - ALLOWPLUGINS=false
      - LOCALSESSIONRECORDING=false
      - MINIFY=true
    volumes:
      - ./meshcentral/data:/opt/meshcentral/meshcentral-data
      - ./meshcentral/user_files:/opt/meshcentral/meshcentral-files
      - ./meshcentral/backup:/opt/meshcentral/meshcentral-backups
      - ./meshcentral/web:/opt/meshcentral/meshcentral-web

Maybe someone has more ideas?

5

Login page is displayed, was just a cache problem of my FF browser.
Now I was able to create an admin account and log in, but still…
… the next problem is that the web socket cannot be connected.
Maybe someone has a solution or ideas based on my information?

Let’s see tomorrow what the log shows.
I am already a big step further. The replacement of AnyDesc and Teamviewer is getting closer.

6

Nothing in the logs? I had to turn off SSL proxy engine I think for what I was doing. But, the error in the logs were a tip off.

7

This is great quality question, however nothing to do with virtualmin…

8

Both Virtualmin and MeshCentral are WikiSuite components: https://wikisuite.org/Software-Components

Thus, I have a medium-term goal to create MeshCentral app for Virtualmin. The goal being that a Virtualmin user should install and manage MeshCentral. Something like what we are doing for Syncthing: https://gitlab.com/wikisuite/virtualmin-syncthing

A long term goal is that users can launch a virtual desktop with specific software to edit a file in Virtualmin. So instead of emailing files, or sync, all users converge to a shared desktop to edit the file.

So @Kiekomick please do keep us informed of your progress.

Thank you.

9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.