Hey there,
first of all, really great work. I love Teddycloud and all the possibilities. It works like a charm so far.
Now I have a question, which maybe, is also nice to know for others.
I have 2 Tonieboxes at home which I have added to Teddycloud. But my mother has also 1 Toniebox for the kids at her home. Unfortunately she has an Router which does not support VPN, so I thought I can put Teddycloud with nginx to the internet with a subdomain which I have.
That also worked and I think it would be possible to adjust the patch to use that domain name instead of my local one. But that brings me to security. Of course everybody who knows, or find out the domain can access the webui. And I couldn’t find a solution to secure somehow.
Is there some solution for that? Can I secure the WebUI by password or can I create access to the teddycloud for the toniebox without putting the webui also out there?
Or is anything like that planned?
In case of having it secure in the www, you should do a few things:
use the lets encrypt feature to get the ssl certificate for the gui
limit access with basic auth or the private certificate feature (i use the private certificates)
limit box access with the boxes certificates (so only your boxes can access the instance)
this should be done by the following:
On the first run select:
Mode: nginx (proxy)
type: extended
Domain: your domain (if you use a sub-domain, then the subdomain)
https mode: letsencrypt
security mode: client certificate
This will create a new teddycloud instance.
After that copy the legacy teddycloud data into the new one.
Then do the following to allow the boxes to access the new instance. Ensure you have for each box the certificates in the designated subfolder named after the boxes mac. Those files will be used for that!
Return to TeddycloudStarter again and
--> Application Management --> Extract Toniebox information
Now only your boxes can access your Teddycloud instance, only people who installed your client certificate (you can create one for each target user) can access the web ui.
@Quentendo64 : Did I forget something or mixed something up? Quite a while ago, i set it up
unfortunately it looks that I am too stupid for that. Or there is something I miss.
I run a docker of teddycloud on my unraid. So far everything worked.
Since you mentioned that TeddyCloudStarter, I created a vm running ubuntu-server on unraid and tried to install that there. I selected to install docker during ubuntu install. then I installed pip, I installed docker-compose.
I ran pip install TeddyCloudStarter and it was a little pain since it restricts it with error: externally-managed-environment.
I googled it and the “good” solution is the virtual environment ‘venv’.
So I did it with that. I installed TeddyCloudStarter, than I ran the wizard.
And boy that is somehow confusing. But I tried. Selected the path /home/usr/TeddyCloud. Then I select nginx mode, but there was no option to select “extended” only “Standard”. I got a warning that ports 80 and 443 are already in use and I want to proceed anyway. → Yes.
I put in my domain name. But Let’s Enrypt did not work. Then I got an
? Select HTTPS mode: Let's Encrypt (automatische Zertifikate)
[DEBUG] boxes for docker-compose: []
Docker Compose configuration generated successfully.
[DEBUG] boxes for nginx-auth: []
Nginx configurations generated successfully.
unknown shorthand flag: 'f' in -f
See 'docker --help'
........
Run 'docker COMMAND --help' for more information on a command.
For more help on how to use Docker, head to https://docs.docker.com/go/guides/
Failed to create staging certificate. Offering self-signed fallback.
? Would you like to generate a self-signed certificate instead? Yes
So I needed to create a self-signed certificate.
Then I created the Client certificates.
I disabled IP Restrictions (at least at the beginning)
Then I got an error
Client certificate successfully created and saved to config.
? Do you want to restrict access to the Server by IP address? No
IP restrictions disabled.
Deployment mode set to: nginx
Configuration saved to /home/mario/.teddycloudstarter/config.json
Configuration saved to /home/mario/.teddycloudstarter/config.json
Configuration completed successfully!
Generating configuration files...
[DEBUG] boxes for docker-compose: []
Docker Compose configuration generated successfully.
Successfully generated docker-compose.yml
[DEBUG] boxes for nginx-auth: []
Nginx configurations generated successfully.
Successfully generated nginx configuration files
Configuration files generated successfully!
? Want to start/restart services with the new configuration? Yes
Docker ist nicht verfügbar.
Current Configuration
╭───────────────────┬─────────────────────────────────────────────╮
│ Setting │ Value │
├───────────────────┼─────────────────────────────────────────────┤
│ Status │ Corrupt Configuration │
│ Validation Errors │ - Missing required configuration keys: mode │
╰───────────────────┴─────────────────────────────────────────────╯
╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ WARNING - Configuration Validation Failed │
│ │
│ Your configuration file contains errors: │
│ - Missing required configuration keys: mode │
│ │
│ It is recommended to reset your configuration by choosing: │
│ Configuration management → Delete configuration and start over │
│ │
╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
? Configuration is corrupt. What would you like to do? Exit
Right now I am “mit meinem Latein am Ende”…
Would ubuntu desktop be better than server? I just wanted to have the lowest possible load on the vm since my NAS with Unraid is not the most powerfull in the world and already runs several dockers container (jellyfin with encoding for example)…
Hi @MaDiz,
sorry for the late reply. Sadly I have have to handle a massive workload at the moment.
I would suggest the following for the moment:
Package:
Install pipx in ubuntu to correctly handle the python package installation:
sudo apt install pipx
Install TeddyCloudStarter via pipx:
pipx install TeddyCloudStarter
Add TeddyCloudStarter to your path via pipx:
pipx ensurepath
sudo pipx ensurepath --global
This offers you a correct and pain-less installation.
Docker:
It seems that in the ubuntu repositorys are old versions of docker. I will verify this in a later stage. For now follow the docker best practice and install Docker from the official ubuntu repository:
When the official docker is installed just retry your approach with TeddyCloudStarter but without the mentioned extended mode. The ‘Extended’ Mode is not visible via the Wizard yet. Wait for the new version 0.7.0.
Extended Mode:
If you want to use the ‘Extended’ mode before 0.7.0.
You can switch to the ‘Extended’ Mode manually after successfully run the wizard and add the first box to your teddycloud.
When this is done you can just change the “nginx_type” to “extended” in the config file ~/.teddycloudstarter/config.json.
Start TCS and do the following:
--> Application Management --> Extract Toniebox information
--> Configuration Managment -> Refresh server config
--> Docker Management -> Stop & Start all services
Hey @Quentendo64
thanks for the reply. I found out some solutions with that.
First it is necessary to add the user to the group docker. Then the problem with “permission denied” is done.
Now I have another problem. (I edited the domain name)
✔ Container teddycloud-certbot Started 0.9s
Certbot failed!
Account registered.
Requesting a certificate for mydomain.eu
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: mydomain.eu
Type: unauthorized
Detail: 2606:4700:3037::ac43:d288: Invalid response from http://mydomain.eu/.well-known/acme-challenge/AqytZ3u3VG0POKLbJSt8R96hWutYZ-WFblB6Lb3r9PM: 522
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided
--webroot-path/-w and that files created there can be downloaded from the internet.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Failed to create staging certificate. Offering self-signed fallback.
Also, when I try to start the wizard again and I move to Certificate Management I gett errors than
? Was möchten Sie tun? Certificate management
? Certificate Management Let's Encrypt Certificate Management
? Let's Encrypt Certificate Management Force refresh Let's Encrypt certificates
? Would you like to receive email notifications about certificate expiry? No
? Would you like to add additional domain names (SANs) to the certificate? No
Traceback (most recent call last):
File "/home/mario/.local/bin/TeddyCloudStarter", line 8, in <module>
sys.exit(main())
^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/main.py", line 175, in main
result = menu.show_main_menu()
^^^^^^^^^^^^^^^^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/main_menu.py", line 288, in show_main_menu
exit_menu = show_certificate_management_menu(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/ui/certificate_manager_ui.py", line 154, in show_certificate_management_menu
refresh_letsencrypt_certificates(
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/ui/certificate_manager_ui.py", line 642, in refresh_letsencrypt_certificates
result = lets_encrypt_manager.force_refresh_certificates(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'LetsEncryptManager' object has no attribute 'force_refresh_certificates'
mario@teddy:~$ TeddyCloudStarter
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ TeddyCloudStarter - v0.6.3 - Docker Setup Wizard for TeddyCloud │
│ │
│ This wizard will help you set up TeddyCloud with Docker. │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ WARNING - Early development state │
│ │
│ Keep in mind that this project is not finished yet. │
│ But it should bring you the concept of how it will work. Soon™ │
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Configuration saved to /home/mario/.teddycloudstarter/config.json
Aktuelle Konfiguration
╭────────────────┬───────────────────╮
│ Einstellung │ Wert │
├────────────────┼───────────────────┤
│ Modus │ nginx │
│ Type │ standard │
│ Domain │ tonie.kubiflix.eu │
│ HTTPS-Modus │ letsencrypt │
│ Sicherheitstyp │ client_cert │
╰────────────────┴───────────────────╯
? Was möchten Sie tun? Certificate management
? Certificate Management Let's Encrypt Certificate Management
? Let's Encrypt Certificate Management Request production certificate (webroot mode)
? Would you like to receive email notifications about certificate expiry? No
? Would you like to add additional domain names (SANs) to the certificate? No
Requesting production certificate using webroot mode...
Primary domain: tonie.kubiflix.eu
Traceback (most recent call last):
File "/home/mario/.local/bin/TeddyCloudStarter", line 8, in <module>
sys.exit(main())
^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/main.py", line 141, in main
result = menu.show_main_menu()
^^^^^^^^^^^^^^^^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/main_menu.py", line 288, in show_main_menu
exit_menu = show_certificate_management_menu(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/ui/certificate_manager_ui.py", line 122, in show_certificate_management_menu
request_letsencrypt_certificate(
File "/home/mario/.local/share/pipx/venvs/teddycloudstarter/lib/python3.12/site-packages/TeddyCloudStarter/ui/certificate_manager_ui.py", line 562, in request_letsencrypt_certificate
result = lets_encrypt_manager.request_certificate(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'LetsEncryptManager' object has no attribute 'request_certificate'
mario@teddy:~$
At least, right now I am a few steps further than before.
