SOLVED Nginx pod and configuration

[HikariNass]

<div class="bbWrapper">Hello everyone,<br /> <br /> I would appreciate some guidance on certain concepts. I've set up an nginx server on my TrueNAS Scale 23.10.1 server. Having grasped the workings of images and Docker containers, I initiated the installation in my NAS shell with the following command:<br /> <br /> ```<br /> k3s kubectl exec -n &lt;NAMESPACE&gt; --stdin --tty &lt;POD&gt; -- /bin/bash<br /> ```<br /> <br /> This command takes me directly into my pod shell, if I understand correctly. Within this container, I installed Nano and Certbot using the following commands:<br /> <br /> ```<br /> apt-get update<br /> apt-get install certbot python3-certbot-nginx<br /> apt-get install nano<br /> ```<br /> <br /> I began by launching Certbot with the command:<br /> <br /> ```<br /> certbot certonly --nginx -d &lt;MY DOMAIN&gt; -v<br /> ```<br /> <br /> I then modified my configuration in `/etc/nginx/nginx.conf` by adding the following:<br /> <br /> ```<br /> server {<br /> listen 443 ssl;<br /> server_name MY DOMAIN;<br /> <br /> ssl_certificate /etc/letsencrypt/live/MY DOMAIN/fullchain.pem;<br /> ssl_certificate_key /etc/letsencrypt/live/MY DOMAIN/privkey.pem;<br /> ssl_protocols TLSv1.2 TLSv1.3;<br /> ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384';<br /> }<br /> ```<br /> <br /> Afterward, I ran `nginx -t` to ensure that `nginx.conf` had no errors, followed by `service nginx restart`. Everything seemed to work well; I set up NAT redirection to pass the `http_01` test by Let's Encrypt, and my domain name pointed to my box.<br /> <br /> However, issues arose. Certbot worked fine when launched, but the certificate never initiated. When I mistakenly relaunched my Nginx application, the pod changed names, and all modifications within the container vanished.<br /> <br /> The second problem arose when I could only use one web-connected application on my NAS. This led me to explore reverse proxies, and Nginx Proxy Manager seemed like the ideal solution. I redirected my NAT on my router to TCP internal port 30022 and external port 443, which redirects to the HTTPS port of Nginx Proxy Manager. I created a proxy host with my domain name as a target and <a href="https://192.168.1.149:443" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://192.168.1.149:443</a> as a destination.<br /> <br /> Now, when I go to my domain name, I encounter a 502 error and find myself blocked. Could someone kindly help me with this?</div>

 

[sretalla]

<div class="bbWrapper">You've almost entirely misunderstood how kubernetes is supposed to work and you're set up for some bad experiences at some point soon.<br /> <br /> Any modifications you make inside a container will not persist when the container is redeployed or updated, so your certbot install will disappear together with your certs and config modifications at some point.<br /> <br /> Separately to the fact that you're doing it all wrong...<br /> <blockquote data-attributes="member: 131080" data-quote="HikariNass" data-source="post: 804174" class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch"> <div class="bbCodeBlock-title"> <a href="/community/goto/post?id=804174" class="bbCodeBlock-sourceJump" rel="nofollow" data-xf-click="attribution" data-content-selector="#post-804174">HikariNass said:</a> </div> <div class="bbCodeBlock-content"> <div class="bbCodeBlock-expandContent js-expandContent "> I created a proxy host with my domain name as a target and <a href="https://192.168.1.149:443" target="_blank" class="link link--external" rel="nofollow ugc noopener">https://192.168.1.149:443</a> as a destination. </div> <div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div> </div> </blockquote>It's unlikely that your NAS is set up to allow port 443 to be used by a container (since TrueNAS will already be listening on that port with its management UI).<br /> <br /> If I recall correctly from a day or 2 ago, you would have set the web port(s) to something above 9000 as I suggested to you, so you need your port forwards to go from port 443 on your router/external IP to the port you selected for the container to listen on (which will not be 443).</div>