basically the default network for docker images does not allow access to our Nethserver for security reasons. There is a special aqua network that will be set up with our Docker install that will allow docker images to access local ports on our Nethserver. That is how we will let Jitsi use our existing LDAP.
How can I create this special aqua network sot that I can add it to the prosody container.
I tried:
db dockrules set jitsiLdap aqua TCPPorts 389,636 status enabled
signal-event firewall-adjust
but the prosody container doesnât see it in Portainer.
What does it look like in portainer? Perhaps there was some change and aqua is not created by default, or are you trying to pre-configure everything before setting it up in Portainer?
Itâs possible their default docker container has changed (significantly) since I wrote the guide. Iâve been meaning to update my instance. Iâll give it a try this weekend and report back if I find anything special.
As you know Iâve been trying out jitsi-meet as well. As pointed out by @stephdl the aqua network is already present. To the end of the wiki post is a paragraph âAdding the Docker to the aqua networkâ describing how you can join the aqua network from portainer.
I found that adding the following to the /opt/jitsi/docker-jitsi-meet/docker-compose.yml will add the network interface when composing.
At the end of the settings for prosody (immediately above # Focus component
) add the line
I am not using nethserver-docker but all the latest components. In the latest Docker CE i.e. 20.10.6, there is no aqua network so I have to create it.
Also, if you run docker-compose down && rm -rf .jitsi-meet-cfg/ && docker-compose up -d you have to re-attach aqua to prosody again (not sure about that but with your above modifications, I think it should resolve that).
I am creating a new VM to test the creation of an aqua network based on the same parameters as the one from nethserver-docker.
I googled a lot about the creation of a network in Docker and it is not so clear how to do it but I think I have to make a âbridgedâ one which is what aqua on nethserver-docker looks like.
It looks like the reason for the aqua network is for security reasons to not let containers fool around the NS LDAP, but Jitsi Meet reads LDAP for authentication and not for the creation of a user. I am confused about that reason.
It tooks me three months to resolve Matrix installation, so I am ready to put the same time for Jitsi Meet.
I confirm, your solution is working.
Those added lines in /opt/jitsi/jitsidocker-compose.yml, will keep aqua network joined to jitsi_prosody_1 container after a reboot or after a docker-compose up -d.
â Identation is important, using no [TAB], only [SPACE].
â # Focus component is 4 [SPACE] from left margin.
â ns-aqua is 12 [SPACE] from left margin.
...
# Focus component
##### Insert start
ns-aqua:
networks:
meet.jitsi:
aliases:
- ${XMPP_SERVER}
ns-aqua:
##### Insert end
...
networks:
meet.jitsi:
##### Insert start
ns-aqua:
external:
name: aqua
##### Insert end
I completely started over using netserver-docker.
Since Iâm using a VM, I still canât connect to the local LDAP, only to the main server LDAP and even then, I had to require a new Letâs Encrypt certificate and add the CNAME of the LOCAL domain name to the new cert of the main NS server.
I had to use the FQDN of the main server, or the one from the LOCAL server, but I had to use only the LDAP main server credential to connect.
â With all that, the authentification still doesnât work.
With DockerCE-20.10.6 and no aqua network, I was able to connect to main server LDAP without the need of a new Letâs Encrypt cert on the main server
Also, when VirtualBox VM starts, my webcam disappears, on both Win-8.1 (always) and Ubuntu-20.04.02 (sometime)âŠ
Thank you so much for that tip on making aqua persistent and mainly for the one to install ldapsearch with apt-get install ldap-utils. The latter allowed me to confirm, unlike Portainer, that prosody could connect to LOCAL LDAP.
Two posts and two problems resolved, I put you on my list of The Greatests.
I donât know about that. I did find out that Prosody/saslauthd seems to be quite picky about the certificate. But⊠it works now, so no need to worry about a possible bug youâre no longer running into
I think that the problem is because Jitsi is on a LOCAL VM.
When the container make a DNS query, it ends up that it is asking the router (my main server) for the FQDNâs IP of the LOCAL LDAP server.
It is normal that the router uses its own certificate instead of using the one from the redirection as it establishes a SSL communication chanel before analysing the request from the container.
In the .env file, I should use
â LDAP_URL=ldaps://IP-ADDRESS
instead of
â LDAP_URL=ldaps://toto.org
so the container wonât have to make a DNS request before connecting to the LOCAL LDAP.
Failure
LDAP Result Code 200 âNetwork Errorâ: TLS handshake failed (x509: cannot validate certificate for 192.168.1.75 because it doesnât contain any IP SANs)
I also tried witth:
â LDAP_URL=ldaps://IP-ADDRESS:636
â LDAP_URL=ldaps://IP-ADDRESS:389
[lun. mai 10 12:33:32 EDT 2021] Getting domain auth token for each domain
[lun. mai 10 12:33:32 EDT 2021] Getting webroot for domain='micronator-dev.org'
[lun. mai 10 12:33:32 EDT 2021] Getting new-authz for domain='micronator-dev.org'
[lun. mai 10 12:33:36 EDT 2021] Could not get nonce, let's try again.
[lun. mai 10 12:33:40 EDT 2021] Could not get nonce, let's try again.
...
[lun. mai 10 12:34:49 EDT 2021] Could not get nonce, let's try again.
[lun. mai 10 12:34:53 EDT 2021] Could not get nonce, let's try again.
[lun. mai 10 12:34:56 EDT 2021] Giving up sending to CA server after 20 retries.
[lun. mai 10 12:34:56 EDT 2021] Can not get domain new authz.
[lun. mai 10 12:34:56 EDT 2021] Please add '--debug' or '--log' to check more details.
[lun. mai 10 12:34:56 EDT 2021] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
