MotionEye - Outside access with SSL

server {

listen 443 ssl;

listen [::]:443 ssl;

server_name motioneye.*;

include /config/nginx/ssl.conf;

client_max_body_size 0;

# enable for ldap auth, fill in ldap details in ldap.conf

#include /config/nginx/ldap.conf;

# enable for Authelia

#include /config/nginx/authelia-server.conf;

location / {

# enable the next two lines for http auth

#auth_basic "Restricted";

#auth_basic_user_file /config/nginx/.htpasswd;

# enable the next two lines for ldap auth

#auth_request /auth;

#error_page 401 =200 /login;

# enable for Authelia

#include /config/nginx/authelia-location.conf;

include /config/nginx/proxy.conf;

resolver 127.0.0.11 valid=30s;

set $upstream_app motioneye; # use ip instead of name if name is not working

set $upstream_port 8765; # note: as trilium is sharing the same docker network as letsencrypt, internal port to be used

set $upstream_proto http;

proxy_pass $upstream_proto://$upstream_app:$upstream_port;

}

}

If i type in "https://motioneye.****.duckdns.org/cams/" i get this

and if i type "https://*****.duckdns.org/motioneye" i get

Zitat von macom

Seems like STUKguy is using subfolder, not subdomain.

that was from your Nextcloud guide

for this set up i am following what you both are saying

Zitat von Morlan

Code

server {

listen 443 ssl;

listen [::]:443 ssl;


server_name motioneye.*;


include /config/nginx/ssl.conf;


client_max_body_size 0;

location /cams/ {
        
        include /config/nginx/proxy.conf;

        resolver 127.0.0.11 valid=30s;

        set $upstream_app motioneye; # use ip instead of name if name is not working

        set $upstream_port 8765; # note: as trilium is sharing the same docker network as letsencrypt, internal port to be used

        set $upstream_proto http;

        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
        proxy_read_timeout 120s;
        access_log off;

}
}

Alles anzeigen

restart your swag container

and try to reach motioneye with https://motioneye.yourdomain.duckdns.org/cams/

Now im getting this when i look at the logs for SAWG

But i cant see whats wrong

Zitat von macom

Sorry, I was assuming you were using subdomain method.

You need to use the same method (subdomain or subfolder) for motioneye as you used for nextcloud.

Thats ok, i wasent very clear when i posted so i have made up a subfolder.conf usinf the nextcloud one as a template. the text in red im assuming should be changed to motioneye?

## Version 2020/12/09

# Assuming this container is called "swag", edit your nextcloud container's config

# located at /config/www/nextcloud/config/config.php and add the following lines before the ");":

# 'trusted_proxies' => ['swag'],

# 'overwritewebroot' => '/nextcloud',

# 'overwrite.cli.url' => 'https://your-domain.com/nextcloud',

#

# Also don't forget to add your domain name to the trusted domains array. It should look somewhat like this:

# array (

# 0 => '192.168.0.1:444', # This line may look different on your setup, don't modify it.

# 1 => 'your-domain.com',

# ),

# Redirects for DAV clients

location = /.well-known/carddav {

return 301 $scheme://$host/nextcloud/remote.php/dav;

}

location = /.well-known/caldav {

return 301 $scheme://$host/nextcloud/remote.php/dav;

}

location /motioneye {

return 301 $scheme://$host/motioneye/;

}

location ^~ /motioneye/ {

include /config/nginx/proxy.conf;

resolver 127.0.0.11 valid=30s;

set $upstream_app motioneye;

set $upstream_port 443;

set $upstream_proto https;

proxy_pass $upstream_proto://$upstream_app:$upstream_port;

rewrite /motioneye(.*) $1 break;

proxy_max_temp_file_size 1024m;

proxy_set_header Range $http_range;

proxy_set_header If-Range $http_if_range;

proxy_redirect off;

proxy_ssl_session_reuse off;

}

Zitat von macom

Those only apply to nextcloud.

So if i # the lines will that work?

Thank you, think i may need to abandon this as i just got this

so in motioneye.subfolder.conf

set $upstream_port was orignally set to 443 - which came up with Bad gateway

then change to

set $upstream_port was orignally set to 8765 - just had the loading symbol and "waiting for ****.duckdns.org" and then it would time out

not sure what else todo? any ideas

So here is my Nextcloud

and this is my motioneye

everything looks correct

Thought i would try something completely differant today since trying to get this to run through th Nextcloud set up..

Created a 2nd container called it Swag2

---
version: "2.1"
services:
  swag:
    image: ghcr.io/linuxserver/swag
    container_name: swag2
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=998
      - PGID=100
      - TZ=Europe/London
      - URL=****.duckdns.org
      - SUBDOMAINS=www,motioneye
      - VALIDATION=http
      - DUCKDNSTOKEN=32ceb33b-2e54-4325-9895-86c0d6c68812 #optional
      - EMAIL=******@gmail.com #optional
    volumes:
      - /var/lib/docker/containers/swag2:/config
    ports:
      - 500:8765 
    restart: unless-stopped

Changed Swag from listening on port 443 to listening on port 500 (to prevent it messing with the other swag container

Forwarded ports 500 to 192.168.68.114:8765 on my router

Created/edted "motioneye.subdomain.conf" with the following from thie github forum

server {
    listen 500;
    server_name motioneye;
    location /cams/ {
        proxy_pass http://192.168.68.114:8765/;
        proxy_read_timeout 120s;
        access_log off;
    }
}

Restarted swag2, went to check on the log file got this

,
-------------------------------------,
          _         (),
         | |  ___   _    __,
         | | / __| | |  /  \ ,
         | | \__ \ | | | () |,
         |_| |___/ |_|  \__/,
,
,
Brought to you by linuxserver.io,
-------------------------------------,
,
To support the app dev(s) visit:,
Certbot: https://supporters.eff.org/donate/support-work-on-certbot,
,
To support LSIO projects visit:,
https://www.linuxserver.io/donate/,
-------------------------------------,
GID/UID,
-------------------------------------,
,
User uid:    998,
User gid:    100,
-------------------------------------,
,
[cont-init.d] 10-adduser: exited 0.,
[cont-init.d] 20-config: executing... ,
[cont-init.d] 20-config: exited 0.,
[cont-init.d] 30-keygen: executing... ,
using keys found in /config/keys,
[cont-init.d] 30-keygen: exited 0.,
[cont-init.d] 50-config: executing... ,
Variables set:,
PUID=998,
PGID=100,
TZ=Europe/London,
URL=*****.duckdns.org,
SUBDOMAINS=www,motioneye,
EXTRA_DOMAINS=,
ONLY_SUBDOMAINS=false,
VALIDATION=http,
CERTPROVIDER=,
DNSPLUGIN=,
EMAIL=*****@gmail.com,
STAGING=,
,
Using Let's Encrypt as the cert provider,
SUBDOMAINS entered, processing,
SUBDOMAINS entered, processing,
Sub-domains processed are:  -d www.*****.duckdns.org -d motioneye.*****.duckdns.org,
E-mail address entered: ******@gmail.com,
http validation is selected,
nerating new certificate,
Saving debug log to /var/log/letsencrypt/letsencrypt.log,
Plugins selected: Authenticator standalone, Installer None,
Requesting a certificate for *****.duckdns.org and 2 more domains,
Performing the following challenges:,
http-01 challenge for *****.duckdns.org,
http-01 challenge for motioneye.*****.duckdns.org,
http-01 challenge for www.*****.duckdns.org,
Waiting for verification...,
Challenge failed for domain *****.duckdns.org,
Challenge failed for domain motioneye.*****.duckdns.org,
Challenge failed for domain www.*****.duckdns.org,
http-01 challenge for *****.duckdns.org,
http-01 challenge for motioneye.*****.duckdns.org,
http-01 challenge for www.*****.duckdns.org,
Cleaning up challenges,
Some challenges have failed.,
IMPORTANT NOTES:,
 - The following errors were reported by the server:,
,
   Domain: *****.duckdns.org,
   Type:   unauthorized,
   Detail: Invalid response from,
   https://*****.duckdns.org/.well-known/acme-challenge/Q-dMznmaz_dOmnEjlrLGtvkG6g-8pdCG23TH_zHCmb0,
   [77.102.40.55]: "    <html>\n        <head>\n,
   <title>Welcome to our server</title>\n            <style>\n,
   body{\n               ",
,
   Domain: motioneye.*****.duckdns.org,
   Type:   unauthorized,
   Detail: Invalid response from,
   https://motioneye.*****.duckdns.org/.well-known/acme-challenge/RYQR5p6TppAP_8WEC625QYp6B1z1lzLYPkB8pM2M_8w,
   [77.102.40.55]: "    <html>\n        <head>\n,
   <title>Welcome to our server</title>\n            <style>\n,
   body{\n               ",
,
   Domain: www.*****.duckdns.org,
   Type:   unauthorized,
   Detail: Invalid response from,
   https://www.*****.duckdns.org/.well-known/acme-challenge/jAlRawHfmPl3DDZSIyceP4YVLLon28QoeEChT5jNTSY,
   [77.102.40.55]: "    <html>\n        <head>\n,
   <title>Welcome to our server</title>\n            <style>\n,
   body{\n               ",
,
   To fix these errors, please make sure that your domain name was,
   entered correctly and the DNS A/AAAA record(s) for that domain,
   contain(s) the right IP address.,
ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container,

but that didnt work either, had a look around online for video/tutorails but nothing really help. I did ask the question on the Motioneye forums but was shot down.

Any last suggestions before i abandon this?

Zitat von Morlan

it sort of worked for (interface was looking strange) with this config:

Code

server {

listen 443 ssl;

listen [::]:443 ssl;


server_name motioneye.*;


include /config/nginx/ssl.conf;


client_max_body_size 0;

location /cams/ {

        include /config/nginx/proxy.conf;
        resolver 127.0.0.11 valid=30s;
        set $upstream_app motioneye; 
        set $upstream_port 8765; 

        set $upstream_proto http;

        proxy_pass $upstream_proto://$upstream_app:$upstream_port/;

        access_log off;

}
}

Alles anzeigen

Running a secound swag container is complicated. Its not advised...

After I sent the last message I reverted to just one swag container, I tried the code you used but I had no luck.

Zitat von Morlan

Are the container still in a docker network together?

Yes

Zitat von Morlan

And do you still have the subdomain in the docker-compose.yml?

yes, here is the compose file

version: "2"
services:
  nextcloud:
    image: linuxserver/nextcloud
    container_name: nextcloud
    environment:
      - PUID=998 #change PUID if needed
      - PGID=100  #change PGID if needed
      - TZ=Europe/London #change Time Zone if needed
    volumes:
      - /var/lib/docker/containers/nextcloud/nextcloud/config:/config #/srv/dev-disk-by-label-disk1 needs to be adjusted
      - /srv/dev-disk-by-label-MyCloud/Nextcloud/data:/data     #/srv/dev-disk-by-label-disk1 needs to be adjusted
    depends_on:
      - mariadb
#    ports: # uncomment this and the next line if you want to bypass the proxy
#      - 450:443
    restart: unless-stopped
  mariadb:
    image: linuxserver/mariadb
    container_name: nextclouddb
    environment:
      - PUID=998 #change PUID if needed
      - PGID=100  #change PGID if needed
      - MYSQL_ROOT_PASSWORD=*****  #change password
      - TZ=Europe/London #Change Time Zone if needed
    volumes:
      - /var/lib/docker/containers/nextcloud/nextclouddb:/config    #/srv/dev-disk-by-label-disk1 needs to be adjusted
    restart: unless-stopped
  swag:
    image: linuxserver/swag         #swag is the replacement for letsencrypt (see link below)
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=998 #change PUID if needed
      - PGID=100  #change PGID if needed
      - TZ=Europe/London # change Time Zone if needed
      - URL=****.duckdns.org #insert your domain name - yourdomain.url
      - SUBDOMAINS=www,nextcloud,motioneye
      - VALIDATION=http
      - EMAIL=****@gmail.com # define email; required to renew certificate
    volumes:
      - /var/lib/docker/containers/nextcloud/swag:/config  #/srv/dev-disk-by-label-disk1 needs to be adjusted
    ports:
      - 444:443
      - 81:80
    restart: unless-stopped