https port issue

[matbe81]

Hi all,

Can you please explain how to generate a certificate with Let's Encrypt on the OnPrem version on Ubuntu for:

• securing the HTTPS access to the hosted environement
• securing the PDF (not manually though /settings/esign)

Thank you !

[omohokcoj]

@matbe81 certificate is automatically issued by caddy (the reverse proxy used in the default docker-compose.yaml):
https://www.docuseal.co/install

[matbe81]

Got this error message:
"WARN[0000] /home/xxx/docker-compose.yml: version is obsolete
[+] Running 2/0
✔ Container xxx-postgres-1 Created 0.0s
✔ Container xxx-app-1 Created 0.0s
Attaching to app-1, caddy-1, postgres-1
Error response from daemon: driver failed programming external connectivity on endpoint xxx-caddy-1 (9b7c40931c215c528def764caedsqdqsdqsq8fe7bb04fb6b6fe607121c9): Error starting userland proxy: listen tcp4 0.0.0.0:443: bind: address already in use
"

after running those commands:
curl https://raw.githubusercontent.com/docusealco/docuseal/master/docker-compose.yml > docker-compose.yml
sudo HOST=your-domain-name.com docker compose up

[omohokcoj]

listen tcp4 0.0.0.0:443: bind: address already in use

@matbe81 443 https port on your server is already occupied by another process

[matbe81]

Indeed. Apache2 use it by default on Ubuntu.
I changed those ports but still cannot manage to get port 443 pointing to DocuSeal/Docker?

Should I do that?
sudo HOST=xxx docker run --name docuseal -p 3000:3000 -v.:/data --restart=always docuseal/docuseal

Thanks again.

[matbe81]

Port are corrected routed and I uninstalled apache and nginx.

But still got the same error:
Error response from daemon: driver failed programming external connectivity on endpoint xxx-app-1 (48710ffd1f7e9f1d9ee5b1bf49b2b3eb9b671de58c1deezezf747bb0ee2e98): Bind for 0.0.0.0:3000 failed: port is already allocated

When I check what process use the port, I got:

xxx@xxx:~$ sudo lsof -i:443
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
docker-pr 3833 root    4u  IPv4  32262      0t0  TCP *:https (LISTEN)
docker-pr 3840 root    4u  IPv6  30008      0t0  TCP *:https (LISTEN)
docker-pr 3854 root    4u  IPv4  33591      0t0  UDP *:https
docker-pr 3860 root    4u  IPv6  33593      0t0  UDP *:https

It seems Docker is using the port but I have no other container than DocuSeal.

Another interesting informations on running container on docker:

xxx@xxx:~$ sudo docker ps
CONTAINER ID   IMAGE               COMMAND                  CREATED        STATUS                   PORTS                                                                                                                       NAMES
092dd240c360   docuseal/docuseal   "/app/bin/bundle exe…"   44 hours ago   Up 37 minutes            0.0.0.0:3000->3000/tcp, :::3000->3000/tcp                                                                                   docuseal
cdd24242ca77   postgres:15         "docker-entrypoint.s…"   10 days ago    Up 6 minutes (healthy)   5432/tcp                                                                                                                    xxx-postgres-1
51be5159349e   caddy:latest        "caddy reverse-proxy…"   10 days ago    Up 6 minutes             0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:443->443/udp, :::443->443/udp, 2019/tcp   xxx-caddy-1

Any help please?

[omohokcoj]

@matbe81 could you please run docker ps -a and share the output to see which docker processes are running on your server?
Maybe you already have docuseal already running on :3000 port

[matbe81]

Here you go:

xxx@xxx:~$ sudo docker ps -a
CONTAINER ID   IMAGE                      COMMAND                  CREATED          STATUS                    PORTS                                                                                                                       NAMES
f57d57fe33d3   docuseal/docuseal:latest   "/app/bin/bundle exe…"   58 minutes ago   Created                                                                                                                                               xxx-app-1
092dd240c360   docuseal/docuseal          "/app/bin/bundle exe…"   44 hours ago     Up 41 minutes             0.0.0.0:3000->3000/tcp, :::3000->3000/tcp                                                                                   docuseal
cdd24242ca77   postgres:15                "docker-entrypoint.s…"   10 days ago      Up 10 minutes (healthy)   5432/tcp                                                                                                                    xxx-postgres-1
51be5159349e   caddy:latest               "caddy reverse-proxy…"   10 days ago      Up 10 minutes             0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:443->443/udp, :::443->443/udp, 2019/tcp   xxx-caddy-1

An instance is running but isn't it required for the proxy to work?

You instructions on this page didn't say that commande
sudo HOST=your-domain-name.com docker compose up
should be run in place of this command:
sudo docker run --name docuseal -p 3000:3000 -v.:/data docuseal/docuseal

[omohokcoj]

@matbe81 for HTTPS/SSL you need to use sudo HOST=your-domain-name.com docker compose up (but not docker run)

Try to run the following commands:
sudo docker rm -f docuseal
sudo docker compose down
sudo HOST=your-domain-name.com docker compose up

Let me know if it solves the issue

[matbe81]

xxx@xxx:~$ sudo docker rm -f docuseal docuseal xxx@xxx:~$ sudo docker compose down WARN[0000] The "HOST" variable is not set. Defaulting to a blank string. WARN[0000] The "HOST" variable is not set. Defaulting to a blank string. WARN[0000] The "HOST" variable is not set. Defaulting to a blank string. WARN[0000] /home/xxx/docker-compose.yml: versionis obsolete [+] Running 4/4 ✔ Container xxx-caddy-1 Removed 1.3s ✔ Container xxx-app-1 Removed 0.1s ✔ Container xxx-postgres-1 Removed 1.2s ✔ Network xxx_default Removed 0.1s xxx@xxx:~$ sudo HOST=xxx.domain.com docker compose up WARN[0000] /home/xxx/docker-compose.yml:versionis obsolete [+] Running 4/4 ✔ Network xxx_default Created 0.1s ✔ Container xxx-caddy-1 Created 0.4s ✔ Container xxx-postgres-1 Created 0.4s ✔ Container xxx-app-1 Created 0.4s Attaching to app-1, caddy-1, postgres-1 caddy-1 | {"level":"warn","ts":1716985018.6840758,"logger":"admin","msg":"admin endpoint disabled"} caddy-1 | {"level":"info","ts":1716985018.6841664,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"proxy","https_port":443} caddy-1 | {"level":"info","ts":1716985018.6841767,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"proxy"} caddy-1 | {"level":"info","ts":1716985018.6846015,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"} caddy-1 | {"level":"info","ts":1716985018.684662,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."} caddy-1 | {"level":"info","ts":1716985018.6848302,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000166700"} caddy-1 | {"level":"info","ts":1716985018.6849837,"logger":"http.log","msg":"server running","name":"proxy","protocols":["h1","h2","h3"]} caddy-1 | {"level":"info","ts":1716985018.6850393,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]} caddy-1 | {"level":"info","ts":1716985018.6850474,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["xxx.domain.com"]} caddy-1 | Caddy proxying https://xxx.domain.com -> app:3000 caddy-1 | {"level":"info","ts":1716985018.685452,"logger":"tls.obtain","msg":"acquiring lock","identifier":"xxx.domain.com"} postgres-1 | postgres-1 | PostgreSQL Database directory appears to contain a database; Skipping initialization postgres-1 | caddy-1 | {"level":"info","ts":1716985018.7208345,"logger":"tls.obtain","msg":"lock acquired","identifier":"xxx.domain.com"} caddy-1 | {"level":"warn","ts":1716985018.7209456,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/data/caddy","instance":"41db5604-fc43-4871-85fc-814d38eca15c","try_again":1717071418.7209437,"try_again_in":86399.999999658} caddy-1 | {"level":"info","ts":1716985018.7210789,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"xxx.domain.com"} caddy-1 | {"level":"info","ts":1716985018.7217765,"logger":"http","msg":"waiting on internal rate limiter","identifiers":["xxx.domain.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""} caddy-1 | {"level":"info","ts":1716985018.7217913,"logger":"http","msg":"done waiting on internal rate limiter","identifiers":["xxx.domain.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""} caddy-1 | {"level":"info","ts":1716985018.765265,"logger":"tls","msg":"finished cleaning storage units"} postgres-1 | 2024-05-29 12:16:58.824 UTC [1] LOG: starting PostgreSQL 15.7 (Debian 15.7-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit postgres-1 | 2024-05-29 12:16:58.824 UTC [1] LOG: listening on IPv4 address "0.0.0.0", port 5432 postgres-1 | 2024-05-29 12:16:58.824 UTC [1] LOG: listening on IPv6 address "::", port 5432 postgres-1 | 2024-05-29 12:16:58.892 UTC [1] LOG: listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432" postgres-1 | 2024-05-29 12:16:58.897 UTC [28] LOG: database system was shut down at 2024-05-29 12:16:44 UTC postgres-1 | 2024-05-29 12:16:58.903 UTC [1] LOG: database system is ready to accept connections caddy-1 | {"level":"info","ts":1716985019.7043202,"logger":"http.acme_client","msg":"trying to solve challenge","identifier":"xxx.domain.com","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"} app-1 | Puma starting in single mode... app-1 | * Puma version: 6.4.2 (ruby 3.3.1-p55) ("The Eagle of Durango") app-1 | * Min threads: 15 app-1 | * Max threads: 15 app-1 | * Environment: production app-1 | * PID: 1 caddy-1 | {"level":"error","ts":1716985030.5391028,"logger":"http.acme_client","msg":"challenge failed","identifier":"xxx.domain.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"xxxx: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]}} caddy-1 | {"level":"error","ts":1716985030.539134,"logger":"http.acme_client","msg":"validating authorization","identifier":"xxx.domain.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"xxx Timeout during connect (likely firewall problem)","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/xxx/xxx","attempt":1,"max_attempts":3} app-1 | WARNING: Nokogiri was built against libxml version 2.12.7, but has dynamically loaded 2.11.8 caddy-1 | {"level":"info","ts":1716985031.878379,"logger":"http.acme_client","msg":"trying to solve challenge","identifier":"xxx.domain.com","challenge_type":"http-01","ca":"https://acme-v02.api.letsencrypt.org/directory"} app-1 | * Listening on http://0.0.0.0:3000 app-1 | Use Ctrl-C to stop app-1 | 2024-05-29 12:17:16 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> app-1 | 2024-05-29 12:17:16 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> app-1 | 2024-05-29 12:17:19 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> caddy-1 | {"level":"error","ts":1716985042.6844063,"logger":"http.acme_client","msg":"challenge failed","identifier":"xxx.domain.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"85.201.185.212: Fetching http://xxx.domain.com/.well-known/acme-challenge/E6kYYbRIQWU7PVLFouT10RenYXofr3tUTTVDvgKRHBg: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]}} caddy-1 | {"level":"error","ts":1716985042.68446,"logger":"http.acme_client","msg":"validating authorization","identifier":"xxx.domain.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"85.201.185.212: Fetching http://xxx.domain.com/.well-known/acme-challenge/E6kYYbRIQWU7PVLFouT10RenYXofr3tUTTVDvgKRHBg: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1733618092/273622650972","attempt":2,"max_attempts":3} caddy-1 | {"level":"error","ts":1716985042.6844952,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"xxx.domain.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - 85.201.185.212: Fetching http://xxx.domain.com/.well-known/acme-challenge/E6kYYbRIQWU7PVLFouT10RenYXofr3tUTTVDvgKRHBg: Timeout during connect (likely firewall problem)"} caddy-1 | {"level":"info","ts":1716985042.6849835,"logger":"http","msg":"waiting on internal rate limiter","identifiers":["xxx.domain.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"caddy@zerossl.com"} caddy-1 | {"level":"info","ts":1716985042.685,"logger":"http","msg":"done waiting on internal rate limiter","identifiers":["xxx.domain.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"caddy@zerossl.com"} caddy-1 | {"level":"info","ts":1716985043.77774,"logger":"http.acme_client","msg":"trying to solve challenge","identifier":"xxx.domain.com","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"} app-1 | 2024-05-29 12:17:26 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> app-1 | 2024-05-29 12:17:28 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> app-1 | 2024-05-29 12:17:34 +0000 HTTP parse error, malformed request: #<Puma::HttpParserError: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?> ^CGracefully stopping... (press Ctrl+C again to force)

[omohokcoj]

@matbe81 it was not possible to connect to your server on PORT :80 to issue the cert - it must be a firewall, make sure ports 80 and 443 are opened on your ubuntu VPS

[matbe81]

Indeed.
How to identify the external IP to allow please?

[omohokcoj]

@matbe81 which VPS are you using? - there must be some network settings section on their admin side to allow :80 port

[matbe81]

I use my own vM. It work fine when I open all connection but prefer to limit to the strict limited amount of required IP for security purpose.
According what I read here, it's not really possible...

Last questions:

• why do I reach the initial setup screen? Does it create a new database?
• do the sudo HOST=your-domain-name.com docker compose up command should be run at each reboot of the server?
• what commands should I use to start/stop/upgrade while using compose for https reason?

[omohokcoj]

1. it created a new app with docker-compose which uses postgresql database (the app you accesses previously was from docker run command and used sqlite)
2. You can make your containers restart automatically on reboot - add restart: always to docker-compose file the the definition of every container.
3. You can find the command to update the app here:
   https://www.docuseal.co/docs/update-docuseal-to-the-latest-version
   Also here is a list of available docker compose commands: https://devhints.io/docker-compose

[matbe81]

Hi. Thank you again;

1.OK. Clear
2.
a) Thanks. Should i add restart: always to the 3 sections of the docker-compose.yml file (app, postgres & caddy) ?
b) Should a run command after having made the change of the file to be effective?
3. So this command docker-compose up --force-recreate will re-create the container but will keep the database, correct?

[omohokcoj]

3. @matbe81 yes correct - the data is stored on file system in docuseal/ pg_data/ folders - so recreating the container won't cause any data loss

[matbe81]

a) Thanks. Should i add restart: always to the 3 sections of the docker-compose.yml file (app, postgres & caddy) ?
b) Should a run command after having made the change of the file to be effective?

[omohokcoj]

a) yes
b) yes run docker-compose up --force-recreate