Understanding the internal mapping

[Honest-Objections]

Hello! Thanks for the work on this project as a preface, I must admit, I'm finding a bit of a learning curve trying to glue things together and have hit an impass with my current knowledge. So..

I'm trying to get home assistant setup, to be proxied from the outside world. Here is the docker-compose relevant bits:

networks:
  proxy:
    external: true

  homeassistant:
    privileged: true
    container_name: homeassistant
    image: homeassistant/home-assistant:stable
    devices:
      - ${ZWAVE_USB}:/dev/zwaveusb
    volumes:
      - ./services/home_assistant:/config
    restart: always
    environment:
      - TZ=${TZ}
      - VIRTUAL_HOST=homeassistant.${DOMAIN_NAME}
      - LETSENCRYPT_HOST=homeassistant.${DOMAIN_NAME}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
      - VIRTUAL_PORT=8123
    depends_on:
      - deconz
    networks:
      - ${PROXY_NETWORK}
    ports:
      - 8123:8123

This then generates the following in the nginx default.conf:

server {
       listen 443 ssl http2 ;
        ...
        location / {
                proxy_pass http://homeassistant.my.domain;
        }
}

Obviously this then redirects back to http, so when I try and access it, I get "too many redirects" warning. So, I could manually edit this, but that seems to defeat the point. What am I missing?

[evertramos]

Hello @Honest-Objections! Thanks for you message.

The 'too many redirects" is not really due to the proxy itself... there is a few thing you might can look at to find what is really happening.

1. Do you have a fixed IP Address?
2. At home, can you reach out from the internet using this IP?
3. Have you tried to issue a Let's Encrypt certificate by yourself using this IP? (it seems by your default.conf you already has a certificate, though)
4. Are you using CloudFlare or any CDN or DNS Proxy?
5. Have you installed this proxy using the fresh-start.sh script?
6. What are the logs saying? (nginx-proxy / homeassistent)
7. What is your environment (linux version, hardware, docker and docker-compose version)?

[evertramos]

nice!

Remove the lines below from your compose and try again:

      - LETSENCRYPT_HOST=homeassistant.${DOMAIN_NAME}
      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}

We might need to activate the cloudflare conf options in the proxy... using the following option:

./fresh-start.sh ....... --use-nginx-conf-files

When removing letsencrypt from the compose file.. kill all compose services, wait a few seconds... and start again.

[Honest-Objections]

Amazing!

Simply removing those lines did the trick thank you! It's now working great.

Do you mind expanding a bit on what each value is for then? I assumed the email was required for SSL setup, so is that not required? Same with the LETSENCRYPT_HOST

Thanks so much for help

[evertramos]

The ssl you are using is from CloudFlare not LetsEncrypt, you will only be able to issue a letsencrypt certificate if you do some specific settings in Cloudflare... so you would use the proxy with letsencrypt... right now you have the ssl from cloudflare and this proxy behind the cloudflare does not need the ssl in order to work.

[Honest-Objections]

Sorry to come back to this after a while, I've been distracted with other things, but it would be good to understand what I need to change to get it working out the box for next time, so..

The SSL cert is definitely coming from let's encrypt, as Cloudflare is only being used for the DDNS (and when you check the issuer, it's letsencrypt)

So initially adding the LETS_ENCRYPT_HOST and LETS_ENCRYPT_EMAIL helped generate the cert, presumably, but led to an incorrect nginx config, then removing them fixed the config while the certs already exist.

I'll check the new config when I get chance to see if I can better understand. Just didn't want to leave it at that being the correct answer just yet!

[evertramos]

Your certificates were probably never issued... that's why the redirects. In order to issue certificate using CloudFlare you must the setting informed in the issue #238

Please check:

#238 (comment)

After doing that you can add the lets encrypt variables in order to use the ssl between the cloudflare and the proxy.

There is a few caveats on that, so, go a little deeper on that before putting it up.