What could possibly be wrong with my ZNC setup? (Dockerised, behind a
dockerised nginx rev. proxy). How can I debug the issue better?
reddit / irc

----------------------------------------------------------------------
Jack-o-tall-tales · 2021-05-11 22:39

*Sorry I've included so much information. I just don't know what else
to try, so this is a dump of everything that could possibly be
relevant.*
***
I'm tryin to setup ZNC on my home server. I'm using docker, and the
docker-compose file looks like this:

    version: "3"

    services:
      znc:
        image: znc:latest
        container_name: znc
        restart: unless-stopped
        networks:
          - znc
        volumes:
          - ./data:/znc-data

    networks:
      znc:
        name: znc
        driver: bridge

Initial setup went fine. I created an admin account, set up all the
basic config etc.

The config (at time of writing):

    AnonIPLimit = 10
    AuthOnlyViaModule = false
    ConfigWriteDelay = 0
    ConnectDelay = 5
    HideVersion = false
    LoadModule = webadmin
    MaxBufferSize = 500
    Motd = Testing MOTD
    Motd = @@@@@@
    ProtectWebSessions = true
    SSLCertFile = /znc-data/znc.pem
    SSLDHParamFile = /znc-data/znc.pem
    SSLKeyFile = /znc-data/znc.pem
    ServerThrottle = 30
    Skin = dark-clouds
    StatusPrefix = *
    Version = 1.8.2

    <Listener listener0>
        AllowIRC = true
        AllowWeb = false
        IPv4 = true
        IPv6 = true
        Port = 4798
        SSL = false
        URIPrefix = /
    </Listener>

    <Listener listener1>
        AllowIRC = false
        AllowWeb = true
        IPv4 = true
        IPv6 = true
        Port = 4799
        SSL = false
        URIPrefix = /
    </Listener>

    <User admin>

        // user info

        <Pass password>
            // password info
        </Pass>
    </User>

    <User me>

        // user info

        <Network Undernet>
            Encoding = ^UTF-8
            FloodBurst = 9
            FloodRate = 2.00
            IRCConnectEnabled = true
            JoinDelay = 0
            LoadModule = simple_away
            Server = irc6.undernet.org 6660
            TrustAllCerts = false
            TrustPKI = true
        </Network>

        <Pass password>
            // password info
        </Pass>
    </User>


I'm running it behind a reverse proxy. The nginx docker-compose file:

    version: '3'

    services:
      nginx:
        image: nginx:stable
        container_name: nginx
        restart: unless-stopped
        networks:
          - wallabag
          - gitea
          - znc
        volumes:
          - /home/jack/myDomain.com/:/var/www/myDomain.com/
          - ./data/nginx:/etc/nginx
          - ./data/certbot/conf:/etc/letsencrypt
          - ./data/certbot/www:/var/www/certbot
        ports:
          - '80:80'
          - '443:443'
          - '4798:4798'
        command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx
-s reload; done & nginx -g \"daemon off;\"'"
      certbot:
        image: certbot/certbot
        container_name: certbot
        restart: unless-stopped
        volumes:
          - ./data/certbot/conf:/etc/letsencrypt
          - ./data/certbot/www:/var/www/certbot
        entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot
renew; sleep 12h & wait $${!}; done;'"

    networks:
      wallabag:
        external: true
      gitea:
        external: true
      znc:
        external: true


I'm using a subdomain. I have: a DNS C record for `znc.myDomain.com`
pointing at `myDomain.com`. I have a certbot certificate for
`myDomain.com`, which includes `znc.myDomain.com`.

I host a few web services already, so I thought I would get that
working first.
So in `nginx/sites-enabled`:
    # ZNC webadmin

    server {
        listen 443 ssl;
        server_name znc.myDomain.com;

        access_log /etc/nginx/logs/access.log;
        error_log /etc/nginx/logs/error.log debug;

        # SSL options
        add_header Strict-Transport-Security "max-age=31536000;
includeSubDomains; preload" always;

        ssl_certificate
/etc/letsencrypt/live/myDomain.com/fullchain.pem;
        ssl_certificate_key
/etc/letsencrypt/live/myDomain.com/privkey.pem;
        ssl_trusted_certificate
/etc/letsencrypt/live/myDomain.com/chain.pem;

        location / {
            proxy_pass http://znc:4799;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
        }
    }

This works fine. I can access the webadmin interface, log in as the
admin and change things. I created a user account, which I can also
succesfully log in with. I've added undernet as my only network so
far.

So then having read [this thread](https://www.reddit.com/r/irc/comment
s/k1m54u/help_reverse_proxying_znc/) I have this in the nginx.conf
(_not_ in the http section, but outside it) for the actual irc
connection:

    stream {

        upstream znc {
            server znc:4798;
        }

        server {

            listen 4798 ssl;
            listen      [::]:4798 ssl;

            # SSL options
            ssl_certificate
/etc/letsencrypt/live/myDomain.com/fullchain.pem;
            ssl_certificate_key
/etc/letsencrypt/live/myDomain.com/privkey.pem;
            ssl_trusted_certificate
/etc/letsencrypt/live/myDomain.com/chain.pem;

            proxy_pass znc;
        }

    }

Notice that I'm using the same ssl certificates here as I used for the
web interface above. I'm assuming this should work, because I'm also
using exactly the same address (the URI prefixes in the config are the
same for the two listeners too).

The `znc` in `server znc:4798` is the docker network znc.

I then `proxy_pass` the irc connection onto znc _without_ ssl (notice
ssl is disabled in the irc listener in the config).

I've made sure that ufw allows incoming traffic on 4798, and that 4798
is forwarded on my router, to my machine. I've restarted the router
and the machine.

I can't see what I could possibly be doing wrong, but... I have my
server
configured in Weechat. `/server listfull znc` gets me:

    Server: znc [not connected]
      addresses. . . . . . : 'znc.myDomain.com/4798'
      proxy. . . . . . . . :   ('')
      ipv6 . . . . . . . . :   (on)
      ssl. . . . . . . . . : on
      ssl_cert . . . . . . :   ('')
      ssl_priorities . . . :   ('NORMAL:-VERS-SSL3.0')
      ssl_dhkey_size . . . :   (2048)
      ssl_fingerprint. . . : ''
      ssl_verify . . . . . : on
      password . . . . . . : (hidden)
      capabilities . . . . :   ('')
      sasl_mechanism . . . :   ('plain')
      sasl_username. . . . :   ('')
      sasl_password. . . . :   (hidden)
      sasl_key. .  . . . . :   ('')
      sasl_timeout . . . . :   (15 seconds)
      sasl_fail. . . . . . :   ('continue')
      autoconnect. . . . . :   (off)
      autoreconnect. . . . : off
      autoreconnect_delay. :   (10 seconds)
      nicks. . . . . . . . :   ('jack,jack1,jack2,jack3,jack4')
      nicks_alternate. . . :   (on)
      username . . . . . . : 'myNick/Undernet'
      realname . . . . . . :   ('')
      local_hostname . . . :   ('')
      usermode . . . . . . :   ('')
      command. . . . . . . :   ('')
      command_delay. . . . :   (0 seconds)
      autojoin . . . . . . :   ('')
      autorejoin . . . . . :   (off)
      autorejoin_delay . . :   (30 seconds)
      connection_timeout . :   (60 seconds)
      anti_flood_prio_high :   (2 seconds)
      anti_flood_prio_low. :   (2 seconds)
      away_check . . . . . :   (0 minutes)
      away_check_max_nicks :   (25)
      msg_kick . . . . . . :   ('')
      msg_part . . . . . . :   ('WeeChat ${info:version}')
      msg_quit . . . . . . :   ('WeeChat ${info:version}')
      notify . . . . . . . :   ('')
      split_msg_max_length :   (512)

But `/connect znc` just immediately gets `connection refused`. I've
tried finding the SSL fingerprint manually and including it in the
config, same result. I have no idea what else to check/try.
Frustratingly, I also have no idea how to debug this. Normally I would
use the relevant logging flag, something like `/connect znc --log-
level all`, but I can't find any such option.

Any help would be appreciated!! I'm really frustrated by this one.

TIA!

----------------------------------------------------------------------
krista · 2021-05-12 05:42

use netcat and see what's going on. you have a lot of layers of
abstraction going on, so *exactly* which layer is blocking will likely
tell you what is wrong.


if you can, start from within your znc docker and work outwords.


otherwise, start with your server's root os and work inward.

----------------------------------------------------------------------
webvictim · 2021-05-12 13:03

It should work - was your nginx compiled with stream
support? Do you get any errors in the nginx log?

Why do you need nginx at all? Personally I would just run certbot in a
separate container with `-d znc.mydomain.com` to add the SAN to the
cert, store its output somewhere on disk that ZNC can access, then
load the certs directly into ZNC (via the `SSLCertFile` and
`SSLKeyFile` directives) and have it serve the web interface and IRC
listener with SSL itself. I do this and it works great - no need to
add additional layers of complication.

----------------------------------------------------------------------
[deleted] · 2021-05-12 13:20

[deleted]

----------------------------------------------------------------------
[deleted] · 2021-05-13 15:41

[removed]

----------------------------------------------------------------------
guldonian · 2021-11-14 01:03

Can you try to just use the certificate you have generated through
your reverse proxy?

From your nginx, copy your `fullchain.pem,` `chain.pem`, and your
`privkey.pem.`

Change in `znc.conf`:

    SSLCertFile = /znc-data/fullchain.pem
    SSLDHParamFile = /znc-data/chain.pem
    SSLKeyFile = /znc-data/privkey.pem

And in your listener, change SSL = true:

    <Listener listener0>
        AllowIRC = true
        AllowWeb = false
        IPv4 = true
        IPv6 = true
        Port = 4798
        SSL = true
        URIPrefix = /
    </Listener>

IRC Traffic is not http/https Traffic. You will have to add labels to
your container to make it go through a reverse proxy. Or something,
something.

[https://wiki.znc.in/Reverse\_Proxy](https://wiki.znc.in/Reverse_Proxy
)

Edit: I think I just did
```
cat privkey.pem > znc.pem
cat fullchain.pem >> znc.pem
```
and used that file. I opened a port in the firewall, and I also added
a host override with the DNS service so I can now connect to
irc.example.com:4798 without a Certificate warning. I have to manually
copy the new certs whenever it is renewed with my Nginx proxy manager.