Welcome to ztnet Discussions!

[sinamics]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[mvpdms]

I'm attempting to install ztnet on a digital ocean machine running docker but I'm not sure what the best course is to properly install it. I'm new to using docker. Just a nudge in the right direction would be much appreciated.

[sinamics]

Hi, from the top of my head:
Create a new folder under home named ztnet.
mkdir /home/ztnet

Then copy the content of docker-compose.yml
https://github.com/sinamics/ztnet#using-docker-compose

Create a new file in DO,
nano /home/ztnet/docker-compose.yml and paste the content in that file. Ctrl+x to save.

Now pull containers and start the app.
docker-compose up -d

Application should now be accessable at do_ip:3000.

However, i highly recommend to use a reverse proxy such as nginx with a domain name when accessing ztnet remotely.
This will give you secure ssl connection if you add letsencrypt certificate.

[mvpdms]

Thank you for the reply. I was able to get it up and running on Digital Ocean. Now I just have to figure out how to get my domain name up and running with nginx.

[mvpdms]

Got everything up and running beautifully. Thanks again!

[tinola]

However, i highly recommend to use a reverse proxy such as nginx with a domain name when accessing ztnet remotely.
This will give you secure ssl connection if you add letsencrypt certificate.

That's absolutely true, but we must constantly keep in mind to block direct WAN access to default port 3000, because nodejs www server is listening wide open on all interfaces via unencrypted HTTP protocol, so there is possibility to compromise access to webUI.
I did this using a firewall rule on my Mikrotik router.

[tinola]

To be more precise...
My suggestion is to implement ability to run the NodeJS server on a lo interface, for example as a variable in the .env file.

Let's say introduce a new variable:
ZTNET_BIND=
Default empty -> same as now - listen on all (*) NICs

ZTNET_BIND=127.0.0.1 -> the server listens only on the localhost interface

In this case, we can safely run a reverse proxy on HTTPS with a letsencrypt certificate without configuring the firewall rules.

[sinamics]

@tinola
You can bind the application to the loopback interface using the ip:port in docker-compose

  ztnet:
    ports:
      - 127.0.0.1:3000:3000   

Then use reverse proxy to point to the lo interface.

[tinola]

I would love to help you with this, but as you probably remember, I use FreeBSD system without docker support, so in my case (and probably a lot of other non-Linux users) ztnet is working as a standalone application...

I don't know if it's possible, but if we add a new variable to the .env file, let's say:

ZTNET_BIND_IFACE="127.0.0.1"

then the server.js would only listen on the loopback interface, instead of all interfaces (*).

In my case... I have got ztnet WWW "core" unencrypted server running on port 4000 (set by env PORT variable in ~/.cshrc file).
Let's run FreeBSD's command sockstat:

# sockstat -4 | grep 4000
ztnet   node       78949 16 tcp46  *:4000                *:*

Now: *:4000 is crucial... asterisk (*) before port means "listen on all interfaces", but we want to listen on 127.0.0.1 (lo) only...

That's why I created firewall rule to secure webUI from WAN :)

[mvpdms]

What is the best/easiest way to update ztnet if its running on docker?

[sinamics]

if you have image: sinamics/ztnet:latest in you docker-compose.yml file, then simply run these commands:

docker-compose pull
docker-compose up -d

[mvpdms]

I updated the file and it confirmed the update of zerotier and ztnet. I'm still getting the all white background with white text when I initially go to the login. Any suggestions?

[sinamics]

Its probably a cache issue. Try to hit shift + f5, or try icognito mode

[mvpdms]

When I go incognito is when I see the issue. I was trying to replicate a new user going to the site.

…

On Fri, Nov 3, 2023 at 3:03 PM Bernt Christian Egeland < ***@***.***> wrote: Its probably a cache issue. Try to hit shift + f5, or try icognito mode — Reply to this email directly, view it on GitHub <#56 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHX7MWO4S6LVSQ57ONF4ZXTYCVEXLAVCNFSM6AAAAAA2R62LHSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TINZQGU2TE> . You are receiving this because you commented.Message ID: ***@***.***>

[sinamics]

and you are 100% sure you actually using the new version, 0.4.0 ?

[mvpdms]

It upgraded to 0.4.0 and is working now. As always thank you for the help!

[wmd1942]

I got it running within a few min on the Ubuntu container inside my Promox. Thanks a lot for Sinamics' fantastic work.