NS8 / MeshCentral - migrate meshcentral-data folder/files and mongo database

Shadowfire · March 15, 2025, 12:13am

NethServer Version: NS8
Module: mechcentral

Originally after switching to NS8 I got most things I needed running on again. I was lacking one item, and that was migrating meshcentral to NS8.

Unfortunately, the meshcentral migration was not available at the time when I did my migration of NS7,9 to NS8. I’m not even sure if there is a clean/clear migration path with the NS8 migration tool at this time for meshcentral from NS7.9 to NS8.

So I was trying just recently to install meshcentral on NS8 to get to the part of trying to migrate the old NS7.9 MeshCentral to NS8.

The first try of just loading meshcentral app on NS8 gave me errors and did not look like it took. So I tried again, and then I had the first install (botched - failed) and a second install that looks like everything worked, except it is not started - I guess. So I uninstalled the first botched/failed install and kept the second install.

This is what it shows now -

As you can see above, the meshcetnral app is inactive and disabled, as well as the mongo-app.

I thought that the meshcentral install would have started and have a working version of meshcentral. I was also hoping that the working version of meshcental app in NS8 would have a restore backups and autobackups into the now running NS8 meshcentral app. As far as I know, it does not. So it seems that I would have to somehow do it manually through CLI on server.

Looked through the forums, it’s possible I have overlooked someone asking for help on this issue in the forums, but didn’t see anything to my searching.

I am hoping someone may be able to shed some light on the proper way to take the autobackups from the old NS7.9 and manually install them in NS8 meshcentral.

Thanks

mrmarkuz · March 15, 2025, 12:26pm

You’re right, there’s no migration path yet and meshcentral doesn’t support restoring via web UI and I think one also needs to restore mongodb manually.
I’m going to test it and report my findings.

EDIT:

It seems to work, I documented the migration process here: ns8-meshcentral/README.md at main · mrmarkuz/ns8-meshcentral · GitHub

Shadowfire · March 15, 2025, 6:41pm

Awesome that it worked for you. Thats super encouraging. I will try it out, I should see the same results. I will report back.

Thanks mrmarkuz

Shadowfire · March 15, 2025, 8:14pm

So i got to the following part -

Start mongo container named restore_db:

podman run \
  --rm \
  --detach \
  --interactive \
  --network=none \
  --volume mongo-app:/data/db:Z \
  --replace --name=restore_db \
${MONGO_IMAGE}

Do I need to change anything like --name=restore_db. With the database name or is that just script object and place holder for the command.

I tried it like it was and then it spits out a large alpha-numeric

So I am guessing it completed correctly, so I did the next

podman cp backup.archive restore_db:/

So for me this should it be as follows -

podman cp mongodump-2025-02-25-03-40.archive restore_db:/

But when I run it, I get the following

Error: container “restore_db” does not exist

Obviously, I have done something incorrectly, but I am unsure if the last commands I did have script object holders or placeholders for the real names of the files.

I must be thinking too hard.

mrmarkuz · March 15, 2025, 8:27pm

Yes, that should be ok.

You could check the running containers using

podman ps

If the container db_restore is not running, you could check if there’s an error in the container by running it without --detach like

podman run \
  --rm \
  --interactive \
  --network=none \
  --volume mongo-app:/data/db:Z \
  --replace --name=restore_db \
${MONGO_IMAGE}

EDIT:

These steps need to be done as app user → runagent -m meshcentral1

Shadowfire · March 15, 2025, 9:50pm

I am working with meshcentral2 (not meshcentral1 - I uninstalled that one)

Well, I am still getting a challenge. Here is a screenshot for you to see what I am seeing when I run the commands.

Thoughts?

mrmarkuz · March 15, 2025, 9:52pm

It seems the container is not running.

mrmarkuz:

If the container db_restore is not running, you could check if there’s an error in the container by running it without --detach like
podman run \
  --rm \
  --interactive \
  --network=none \
  --volume mongo-app:/data/db:Z \
  --replace --name=restore_db \
${MONGO_IMAGE}

EDIT:

root@debianns8test:~# runagent -m meshcentral1
runagent: [INFO] starting bash -l
runagent: [INFO] working directory: /home/meshcentral1/.config/state
meshcentral1@debianns8test:~/.config/state$ systemctl --user stop meshcentral
meshcentral1@debianns8test:~/.config/state$ podman run \
  --rm \
  --detach \
  --interactive \
  --network=none \
  --volume mongo-app:/data/db:Z \
  --replace --name=restore_db \
${MONGO_IMAGE}
4ad4bf7db13a6cb48b3c179b1b1269b9754ec8a8ff7d07fd44acf3b7ab06c1f4
meshcentral1@debianns8test:~/.config/state$ podman ps
CONTAINER ID  IMAGE                           COMMAND     CREATED        STATUS            PORTS       NAMES
4ad4bf7db13a  docker.io/library/mongo:7.0.17  mongod      9 seconds ago  Up 5 seconds ago              restore_db
meshcentral1@debianns8test:~/.config/state$

Shadowfire · March 15, 2025, 10:01pm

You are correct!

WARNING: MongoDB 5.0+ requires a CPU with AVX support, and your current system does not appear to have that!
see https://jira.mongodb.org/browse/SERVER-54407
see also MongoDB 5.0 CPU Intel G4650 compatibility - #2 by Stennie_X - Installation & Upgrades - MongoDB Developer Community Forums
see also Mongo 5.0.0 crashes but 4.4.6 works · Issue #485 · docker-library/mongo · GitHub

Looks like the equipment I am running is the challenge. It doesn’t have a CPU with AVX support.

Thanks for you help on this. Let me fix that issue first and I believe that will fix the other issue.

I will update you further, when I get that adjusted.

Thanks again mrmarkus!

mrmarkuz · March 15, 2025, 10:02pm

If you use Proxmox, set CPU to host, see also GitHub - mrmarkuz/ns8-meshcentral

To check AVX support:

If AVX isn’t supported by the CPU you could switch to GitHub - mrmarkuz/ns8-meshcentral-light without mongodb but db migration may be hard.

Shadowfire · May 22, 2025, 2:43pm

Well I finally got a chance to work out the AVX issue that you had me look in too…

The processor was ok and did support AVX. I changed settings for CPU in Proxmo to HOST at recommendation per the link and info you provided to helped fix the problem with AVX issue.

Sorry it took so long. I had other items pressing. Now that I got that done…

I am still working on importing the data over to the NS8 server and in to MeshCentral. I will let you know what happens next.

Thx!

Shadowfire · May 22, 2025, 3:55pm

Ok. I was able to pull over data directory and the database. I got MeshCentral working. Was able to sign in and it looked like groups, users and items where there. But pc’s were not showing any to be active.

Of course working with it with NS7, it was a bit easier to work with out containers of course. So I was not completely thinking since this is now hosted differently on NS8,

of course I forgot to go do a quick backup in NS8 after I got it up and running.
I did an update to MeshCentral to (unstable) … I have done them in the past on NS7 and they seem to work fine.

So I jumped the gun this time. Unfortunately I updated MechCentral in settings, it now is stuck at the following screen

I am guessing I can’t update internally anymore like use too with NS7 through the MeshCentral settings then update?

Of course I have clicked the refresh, but that doesn’t do anything.

Not sure what to do now.

Shadowfire · May 22, 2025, 4:01pm

Hmmm… Interesting. I stopped it. I did a restart. Its working again. Feuu! The update didn’t take.

Now I have to figure out why I see no connections.

Guess who’s doing a backup right now!!!

Shadowfire · May 22, 2025, 4:39pm

So now that I got it backed up. I am seeing computers and groups, but they are all grey’d out and I can not connect to them. So I went to the “Show server error log”. Here is what I found.

-------- 5/22/2025, 3:59:08 PM ---- 1.1.44 --------

(node:34) [DEP0040] DeprecationWarning: The punycode module is deprecated. Please use a userland alternative instead.
(Use node --trace-deprecation ... to show where the warning was created)

Where would I use “node --trace-deprecation”? I am guessing in MeshCentral. But where in MeshCentral?

I am guessing I would do the trace here in MeshCentral. If so I am not sure what to select to be able to do the correct trace…

I did find this…

I when through it and it had dev saying they had to do something, but nothing that actually points me to an answer that I can see that would help.

Any thoughts?

mrmarkuz · May 22, 2025, 8:08pm

I also get this depreciation warning, I think it’s not related to the issue and can be ignored.

Maybe a firewall issue like wrong port forwarding or reverse proxy setting so that the agents are not reachable?

Does it help to reinstall the meshcentral agent on a client?

The greyed out device groups could be a permission issue. Maybe try another user?

Shadowfire · May 24, 2025, 7:10am

I found this on that has to do with the depreciation warning -

They were pointing to a possible old node js that might be causing the depreciation warning.

I found this on the meshcentral github-

I know it is not my firewall / port forwarding. Because I am longing in from a remote location and I can logon just fine. I would guess the reverse proxy settings would be ok to because I can logon and see the groups / pc’s / users.

I added a new user administrator and logged in as them. It did not fix the issue with the pc’s staying grey’d out.

I also tried to install a client on one of my laptops to see if it would allow me to see the laptop through the MeshCentral Dashboard, but it did not.

Any thoughts in to what I can do to check it from the docker side? What I would do to check the logs on the MechCentral docker side?

I went into NS8 loki and did a search under APP > MeshCentral - Node1 > Search.

Got the following -

Did not know if I could show some of those items. Wasn’t sure about when it say Agent bad web cert hash?

I also found this… could this be related?

Shadowfire · May 24, 2025, 7:53am

@mrmarkuz Okay hold on… I found this…

github.com/Ylianst/MeshCentral

Traefik Reverse Proxy - Agent bad web cert hash Error

opened 04:34AM - 25 Dec 22 UTC

closed 03:58AM - 26 Dec 22 UTC

raghu-mp

question

**Describe your issue** Followed the user guide to setup Traefik reverse proxy …with Meshcentral running in Docker. But agents are unable to connect with the following error though the cert hash are an exact match. When "ignoreAgentHashCheck": true, is enabled agent is able to connect successfully. Installing otplib@10.2.3... MeshCentral HTTP redirection server running on port 8080. MeshCentral v1.1.2, Hybrid (LAN + WAN) mode, Production mode. MeshCentral Intel(R) AMT server running on meshcentral.homelab.com:4433. Server homelab.com has no users, next new account will be site administrator. Loaded web certificate from "https://meshcentral.homelab.com:443/", host: "meshcentral.homelab.com" SHA384 cert hash: aa18d33e788ef3ab4d6c54321344823f6223e1ec97e4e6b8774be18a7cc3a7907b9670c364bc0a00de0ee6f8da798a81 SHA384 key hash: --redacted-- MeshCentral HTTP server running on port 8443, alias port 443. Agent bad web cert hash (Agent:aa18d33e78 != Server:f4fc5ee906 or 0da5338314), holding connection (10.0.0.186:51700). Agent reported web cert hash:aa18d33e788ef3ab4d6c54321344823f6223e1ec97e4e6b8774be18a7cc3a7907b9670c364bc0a00de0ee6f8da798a81. **Screenshots** If applicable, add screenshots to help explain your problem. **Server Software (please complete the following information):** - Virtualization: **Docker** - Network: **Traefik Reverse Proxy** - Version: **1.1.2** - Node: **9.2.0** **Client Device (please complete the following information):** - Device: Thin Client - OS: OSX - Network: Local to Meshcentral - Browser: Firefox - MeshCentralRouter Version: N/A **Remote Device (please complete the following information):** - Device: Thin Client - OS: Debian - Network: Local to Meshcentral - Current Core Version (if known): [**HINT**: Go to a device then `console` Tab then type `info`] **Your config.json file** ``` { "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json", "settings": { "Cert": "meshcentral.homelab.com", "WANonly": false, "LANonly": false, "_sessionKey": "MyReallySecretPassword1", "Port": 8443, "AliasPort": 443, "RedirPort": 8080, "AgentPong": 300, "TLSOffload": "172.18.0.2,10.0.0.193", "SelfUpdate": false, "AllowFraming": "false", "_ignoreAgentHashCheck": true, "WebRTC": "true" }, "domains": { "homelab.com": { "NewAccounts": "false", "certUrl": "https://meshcentral.homelab.com:443/", "agentConfig": ["webSocketMaskOverride=1"] } } }

Here is my srv config file and the WANONLY" and “LANONLY” settings … you can see it in the picture below.

I tried to change it in MeshCentral… that didn’t work. If that is the problem? How do I get in to the docker and change those to false?

Do you thing setting them to false is the correct move to get the pc’s to become active? That seems to be what they did in the Traefik Reverse Proxy - Agent bad web cert hash Error #4879 I believe…

mrmarkuz · May 24, 2025, 8:16am

Yes, but they didn’t update it to version 22 in their container, they still use version 21.

github.com/Typhonragewind/meshcentral-docker

builds/mongoDB/Dockerfile

main


      
          FROM mongo:latest
          
          ENV SESSION_KEY=""
          
          # Disable Prompt During Packages Installation
          ARG DEBIAN_FRONTEND=noninteractive
          
          #install dependencies
          RUN apt-get update && apt-get install -y curl && curl -fsSL https://deb.nodesource.com/setup_21.x | bash - && apt-get install -y nodejs && rm -rf /var/lib/apt/lists/*
          
          #Add non-root user, add installation directories and assign proper permissions
          RUN mkdir -p /opt/meshcentral
          
          #meshcentral installation
          WORKDIR /opt/meshcentral
          
          RUN npm install meshcentral && npm install nedb
          
          ARG PREINSTALL_LIBS="false"

If they don’t update I can do it but I still don’t think that’s the issue as it’s working here with the depreciation warning.

Here is a command to edit the config.json:

runagent -m meshcentral1 podman unshare nano /home/meshcentral1/.local/share/containers/storage/volumes/meshcentral-data/_data/config.json

To get into the meshcentral container to check things:

runagent -m meshcentral1 podman exec -ti meshcentral-app bash

EDIT:

To restart the service after config changes:

runagent -m meshcentral1 systemctl --user restart meshcentral

I don’t think so as these settings are working here but please try it, I could be wrong.
Maybe also the certUrl is wrong.

Consider that settings with “_” prepended are NOT used, so for example to set "_LANonly": true you need to change it to "LANonly":true

I’m going to recheck the migration instructions, maybe somethings wrong…

Shadowfire · May 24, 2025, 9:07pm

If your Meshcentral is running fine with out that changing of node js, and your getting the same message I am getting, then that is not the main issue. Just a side issue that can be delt with later.

Yes, I think your right. I see that in my loki logs for meshcentral.

mycomputervisions.com is the main domain of course.
mesh.mycomputervisions.com is the subdomain of course.

Isn’t the :443 added by the meshcental setup in NS8 dashboard? I think when you say force HTTPS. right?

Does that setting in meshcentral setup cause the docker to be setup with this settings added in meshcentral NS8 settings / setup?

or do you think it is because it has the url has the :443 at the end?

Should it just be mesh.mycomputervisions.com, or mycomputervisions.com? If not what else would I change the certUrl to cause the “Failed to load web certificate at:” from happening.

I am guessing I would use the same method to change the LANOnly and WANOnly in the server config file to change the certUrl?

Would it be possible for you to show me what your full config.json as a sample of what you had adjusted. Please.

I am going to try to find a little more info on the settings for the config.json file.

mrmarkuz · May 25, 2025, 9:02am

No, the setup just adds the traefik FQDN without changing the port. It’s possible to use another port than the default https port. It may also work without the port but I don’t think that’s the issue in that case.

Here is how the config file is changed by the NS8 setup: ns8-meshcentral/imageroot/systemd/user/meshcentral-app.service at main · mrmarkuz/ns8-meshcentral · GitHub

Here is the used image: GitHub - Typhonragewind/meshcentral-docker

config.json

{
  "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json",
  "settings": {
    "cert": "mesh.domain.tld",
    "_WANonly": true,
    "_LANonly": true,
    "sessionKey": "RdmhpxrJtshhCb38lU8bFnhCjSiR2vAl",
    "port": 8989,
    "aliasPort": 443,
    "redirPort": 0,
    "_redirAliasPort": 80,
    "AgentPong": 300,
    "TLSOffload": "127.0.0.1",
    "SelfUpdate": false,
    "AllowFraming": "false",
    "mongodb": "mongodb://mongo-app:27017/mesh",
    "mongodbcol": "mesh",
    "WebRTC": "false"
  },
  "domains": {
        "": {
        "_title": "MyServer",
    "_title2": "Servername",
    "_minify": true,
    "NewAccounts": "false",
        "_userNameIsEmail": true,
    "certUrl": "https://mesh.domain.tld:443"
        }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before>",
    "_email": "myemail@mydomain.com",
    "_names": "myserver.mydomain.com",
        "production": false
  }
}

mrmarkuz · June 18, 2025, 8:47am

Hi @Shadowfire ,

I updated meshcentral to fix a bug in the path of the certUrl, maybe it was the cause that the migration didn’t work.
Thanks to @Shane_Treweek for finding the bug and also providing a fix.