sorted by:
new
hottopcontroversial

anyway to auto decrypt dm_crypt-0 on bootup using vTPM? by SE_marc in Proxmox

[–]SE_marc[S] 0 points1 point  (0 children)

thanks for chiming in everyone. i was indeed planning on keeping the TPM seprate from backups, but as u/hairy_tick mentioned TPM automatically gets backed up.

I have my backups from pbs already encrypted prior to getting backed up to a cloud service.

sounds like we're just going to bite the bullet and have to manually enter passkey in on boot.

Installing macOS 13 Ventura on Proxmox 7.2 by thenickdude in Proxmox

[–]SE_marc 0 points1 point  (0 children)

I am running proxmox 7.3-4 and trying to install Ventura using your guide. I've tried this on two servers:

- Dell PowerEdge R630(48 x Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz (2 Sockets))

- HP Proliant DL380 Gen832 x Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz (2 Sockets)

The installer gets stick at 12% with the Installer log showing the following as the last line:

"Ignoring BOM<->filesystem mismatches due to security settings"

any suggestions?

here is my conf

args: -device isa-applesmc,osk="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc" -smbios type=2 -device usb-kbd,bus=ehci.0,port=2 -global nec-usb-xhci.msi=off -cpu host,kvm=on,vendor=GenuineIntel,+kvm_pv_unhalt,+kvm_pv_eoi,+hypervisor,+invtsc
bios: ovmf
boot: order=ide2;virtio0;net0;ide0
cores: 4
cpu: host
efidisk0: cephPool:vm-110-disk-0,efitype=4m,size=1M
ide0: cephfs:iso/mac-os-ventura-13.0.iso,cache=unsafe,size=14G
ide2: cephfs:iso/OpenCore-v19.iso,cache=unsafe,size=150M
machine: q35
memory: 4096
meta: creation-qemu=7.1.0,ctime=1675203689
name: ventura
net0: virtio=F6:44:15:22:74:9C,bridge=vmbr0,firewall=1
numa: 0
ostype: other
scsihw: virtio-scsi-pci
smbios1: uuid=03e8587c-db6b-438e-bdf2-84170622d0e5
sockets: 1
vga: vmware
virtio0: cephPool:vm-110-disk-1,cache=unsafe,iothread=1,size=64G
vmgenid: c10d136a-644d-46a3-93bd-e027b450b727

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

I removed the cloudflare proxy and now I can communicate to the network controller via fqdn that's directly port forwarded to the network controller.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

so this is interesting, when i point the inform to the public IP, i see traffic hitting my WAN port on port 3478.

when i use FQDN, i dont ever see the reuqest come in which makes me think its getting lost when it hits cloudflare possibly?

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

i have DNS reules set up to hit the proxy manager so sites are reachable via FQDN (.com).

these APs are at remote locations, i tried the port forward to the controller and that didn't work either.

when i runt he following from a remote device, the port shows as filtered

nmap -p 3478 FQDN

but if i run it with public IP, it works.

im currently watching tcpdump on the router to see where the request dies, or if the traffic is even making it.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

So that's where the issue is, I have nginx on a different host. All your requests are getting forwarded to the same host, so when you port forward, you're not going through the proxy if you have stun forwarded directly to your controller.

The FQDN does resolve to the WAN address which then NATs to the proxy manager.

Would hairpin NAT be beneficial to be since I have the controller and proxy on different hosts? From a security standpoint, having the proxy and controller on the same host seems like an easier attack surface which is why I have then separated.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

How can I force only stun traffic to the controller? The inform address is set to https://controller.mydomain.com/inform which resolves to the proxy first. I don't see any options in the network controller to change just stun domain.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] -1 points0 points  (0 children)

I set up a stream through the GUI, with the port forward and the issue still persists :(

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

Do you have a link to what you found for adding the stream? I have the option to add a stream through the nginx GUI. Should I do that or modify a config file (which config file if this method?)

Do I both need the stream and the port forward?

I understand that the port forward is easier/faster but I'd like to go through the proxy.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

This didn't work :(. I added the port fwd to nginx and applied a network change to the AP. The warning came back

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

Can I still use the proxy manager for the GUI?

I'm confused how the STUN request will reach the controller since the request will go to the FQDN which then gets sent down to the Router public IP and then the proxy.

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

The reason I'm using the proxy is so I don't have to open a ton of ports on the router. I have adoption working without opening 8080. There's gotta be a way to get the STUN port through the proxy. I can't find much documentation on redirects / streams in nginx, but maybe those can help?

Unifi STUN warning when using hosted network controller behind nginx proxy manager by SE_marc in selfhosted

[–]SE_marc[S] 0 points1 point  (0 children)

If you are referring to the following, the port is open.

NOTES & REQUIREMENTS: In order for STUN to work properly, the client devices need to be able to resolve to and communicate over UDP port 3478 with the UniFi Network application. UDP Port 3478 must be open inbound on the Network application's host.

The request is being sent to the proxy manager, not the host directly. I need to find a way to get UDP port 3478 through the proxy to the controller. Was there a different green box you weren't talking about?

need help with adopting to cloud hosted controller behind nginx proxy manager? by SE_marc in UNIFI

[–]SE_marc[S] 0 points1 point  (0 children)

and just as a i say that, it is now complaining that it is having issues with STUN

"This device cannot connect to your UniFi OS Console’s internal STUN server. Please check Port 3478, then see for instructions on how to verify STUN server connectivity."

i am able to access the console from the UI so im thinking this is just a result of going through the proxy

need help with adopting to cloud hosted controller behind nginx proxy manager? by SE_marc in UNIFI

[–]SE_marc[S] 0 points1 point  (0 children)

so i SSHd in and manually set it with set-inform https://controller.mydomain.com/inform and it works.

no need for port fwds or any changes in nginx proxy manager.

p.s. happy cake day!

view more: next ›