Thaddeus’s Personal Site

If you’ve ever set up an application like Plex with a web server on a non-standard port, wanted a bit more security to go into accessing applications over networks that you may not fully trust, or even just wanted to ensure all of your requests to your web services just go to one place so you don’t have to mess with firewall rules every time you make something new then this article is for you. My start with NGINX reverse proxies came out of my laziness to remember to specify ports when accessing different apps I had set up and its turned into a powerful tool that allows me to access certain resources that I’m either to lazy to configure for HTTPS or it simply isn’t supported. Don’t get me wrong, I’m not being disingenuous , if you have an insecure HTTP application, the traffic between the proxy and the app will be via HTTP, but what makes this cool is that the subsequent traffic between you and the proxy is all via HTTPS, meaning as long as you trust your LAN this makes accessing those applications from the greater internet a bit more safe.

When creating applications that you’d like to run over a continuous period of time, you’re eventually going to need to worry about timing, system integration, and startup/exit behavior, but while creating your own methods to do so I’m sure you’ll learn a lot about the Linux operating system, but often times its a bit more work than one would like just to get a simple application running. For this tutorial I’m going to show you how I created a service to run my Eva Unit-01 discord bot. Eva is a python script that runs out of a virtual environment. I would like for it to be run on startup with any issues or output logged to the systemd journal.

Bash scripts are very sensitive to line endings which can cause some portability issues between windows and unix-like systems (depending on how the text editor encodes line breaks). If you would like to see the invisible characters that are making your life confusing simply type:

cat -v <FILE>

The easiest solution to this issue is a simple sed replace line:

sed -i -e 's/\r$//' <FILE>

So for some reason in v2021.7.0 HomeAssistant introduced a bug that breaks a lot of systems that rely on its NGINX reverse proxy add-on to provide ssl capabilities. Thankfully the fix itself is pretty simple.

• To begin, try to navigate to the site to produce the error, then in the HAS web GUI navigate to the Supervisor Logs (Settings>System>Logs)

• Grab the IP that shows up in the error that reads

  Read more >

So for some reason in v2021.7.0 HomeAssistant introduced a bug that breaks a lot of systems that rely on its NGINX reverse proxy add-on to provide ssl capabilities. Thankfully the fix itself is pretty simple.

• To begin, try to navigate to the site to produce the error, then in the HAS web GUI navigate to the Supervisor Logs (Settings>System>Logs)

• Grab the IP that shows up in the error that reads

  Read more >

The Proxmox team doesnt really have any plans on changing the default port assigned to Proxmox (8006) and their documentation just tells you to use nginx to proxy the traffic if you want to change the default port so the following script should change your port to the port of your choosing [with 443 as the default].

#!/bin/bash
#Install nginx
apt install nginx

#Checks for your default nginx file and deletes it
FILE=/etc/nginx/conf.d/default
if [-f "FILE"];then
	rm $FILE
else
	rm /etc/nginx/sites-enabled/default
fi

#Pull the FQDN out of the hosts file
read -p "Enter the FQDN of your server or [ENTER] to set to default from /etc/hosts file" FQDN
if [ -z FQDN ]
then FQDN=$(hostname -f)
fi

#Create your new nginx File
cat > /etc/nginx/conf.d/proxmox.conf << EOF
upstream proxmox {
    server "$FQDN";
}

server {
    listen 80 default_server;
    rewrite ^(.*) https://$host$1 permanent;
}

server {
    listen 443;
    server_name _;
    ssl on;
    ssl_certificate /etc/pve/local/pve-ssl.pem;
    ssl_certificate_key /etc/pve/local/pve-ssl.key;
    proxy_redirect off;
    location / {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade"; 
        proxy_pass https://localhost:8006;
	proxy_buffering off;
	client_max_body_size 0;
	proxy_connect_timeout  3600s;
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        send_timeout  3600s;
    }
}
EOF

#test your config
nginx -t
#reload nginx
nginx -s reload

#creating some dependencies via systemd overrides
cat > /etc/systemd/system/nginx.service.d/override.conf << EOF
[Unit]
Requires=pve-cluster.service
After=pve-cluster.service
EOF

systemctl restart nginx
systemctl enable --now nginx

I don’t really like like allowing servers to set their own IP addresses, i think its kinda weird and i like to handle things at the network level so I typically have all my servers as DHCP clients and I set their addresses statically on the network device they’re attached to. Unfortunately proxmox doesn’t like that so it doesn’t include DHCP in the installer, which is fine. Its easily fixed.

As much as I love Home assistant there are some small papercuts that can make it annoying to deal with, this is one of them. Every time you elect to “stay signed in” and you don’t sign out before exiting the page you’ll have a nice token sitting in this long list of your previous mistakes. I found this quick fix on Reddit, but understand that this will clear ALL the tokens in your home assistant (even the session that youre currently in) so you’ll have to log back in. In order to do it, just pop open your web console and paste the following javascript in there, your browser might bark at you saying something about pasting untrusted code, just allow pasting and keep it pushing.

This tutorial is assuming that you already have Tailscale installed on your Proxmox hosts, if you havent done so look at the installation for Tailscale on Debaian Bullseye.

Install#

1. Because /etc/hosts has priority in all host lookups we are just going to edit the these files on any of the machines that we would like to connect. To do so you can simply vim /etc/hosts and your new host files will end up looking like this with host being the node you want to start the cluster on and remote being the node that will join the cluster

   Read more >

I ran into this issue today so I thought that i would put a solution that I found on here. If you ever run into a situation in which you need to copy your ssh keys to another box but you dont have the handy dandy ssh-copy-id tool, the following one liner should work. Check out this oracle web page for more info.

cat ~/.ssh/id_rsa.pub | ssh <USER>@<IP> 'cat >> .ssh/authorized_keys && echo "Done"'