Nginx pod and configuration

[HikariNass]

Hello everyone,

I would appreciate some guidance on certain concepts. I've set up an nginx server on my TrueNAS Scale 23.10.1 server. Having grasped the workings of images and Docker containers, I initiated the installation in my NAS shell with the following command:

```
k3s kubectl exec -n <NAMESPACE> --stdin --tty <POD> -- /bin/bash
```

This command takes me directly into my pod shell, if I understand correctly. Within this container, I installed Nano and Certbot using the following commands:

```
apt-get update
apt-get install certbot python3-certbot-nginx
apt-get install nano
```

I began by launching Certbot with the command:

```
certbot certonly --nginx -d <MY DOMAIN> -v
```

I then modified my configuration in `/etc/nginx/nginx.conf` by adding the following:

```
server {
listen 443 ssl;
server_name MY DOMAIN;

ssl_certificate /etc/letsencrypt/live/MY DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/MY DOMAIN/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384';
}
```

Afterward, I ran `nginx -t` to ensure that `nginx.conf` had no errors, followed by `service nginx restart`. Everything seemed to work well; I set up NAT redirection to pass the `http_01` test by Let's Encrypt, and my domain name pointed to my box.

However, issues arose. Certbot worked fine when launched, but the certificate never initiated. When I mistakenly relaunched my Nginx application, the pod changed names, and all modifications within the container vanished.

The second problem arose when I could only use one web-connected application on my NAS. This led me to explore reverse proxies, and Nginx Proxy Manager seemed like the ideal solution. I redirected my NAT on my router to TCP internal port 30022 and external port 443, which redirects to the HTTPS port of Nginx Proxy Manager. I created a proxy host with my domain name as a target and https://192.168.1.149:443 as a destination.

Now, when I go to my domain name, I encounter a 502 error and find myself blocked. Could someone kindly help me with this?

 

[sretalla]

You've almost entirely misunderstood how kubernetes is supposed to work and you're set up for some bad experiences at some point soon.

Any modifications you make inside a container will not persist when the container is redeployed or updated, so your certbot install will disappear together with your certs and config modifications at some point.

Separately to the fact that you're doing it all wrong...

I created a proxy host with my domain name as a target and https://192.168.1.149:443 as a destination.

It's unlikely that your NAS is set up to allow port 443 to be used by a container (since TrueNAS will already be listening on that port with its management UI).

If I recall correctly from a day or 2 ago, you would have set the web port(s) to something above 9000 as I suggested to you, so you need your port forwards to go from port 443 on your router/external IP to the port you selected for the container to listen on (which will not be 443).