HEALTHCHECK fails if a custom UI/API port is specified about unifi-docker

[jacobalberty]

I like it, I modified the pr a little to ensure docker-healthcheck.sh gets a chmod +x and have merged it into all of the main working branches as well as the latest tags for those branches.

Thank you.

[duaneg]

No worries and thanks very much for your work on this, it is very helpful!

[jamesmr89]

I just came across an issue where this was causing my containers to be marked as down, my system.properties was set to:

#unifi.https.port=8443

I fixed that, but I think you should think about making it default to 8443 if it is commented or absent from the file?

Also I'm now getting this unable to find systme properties, its somehow setting my data directory to /unifi/data?

"Health": {
"Status": "unhealthy",
"FailingStreak": 4,
"Log": [
{
"Start": "2017-10-16T14:12:09.828254541-07:00",
"End": "2017-10-16T14:12:09.917836561-07:00",
"ExitCode": 1,
"Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n"
},
{
"Start": "2017-10-16T14:12:39.921362077-07:00",
"End": "2017-10-16T14:12:39.993279284-07:00",
"ExitCode": 1,
"Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n"
},
{
"Start": "2017-10-16T14:13:09.99687464-07:00",
"End": "2017-10-16T14:13:10.077135305-07:00",
"ExitCode": 1,
"Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n"
},
{
"Start": "2017-10-16T14:13:40.081548099-07:00",
"End": "2017-10-16T14:13:40.168543162-07:00",
"ExitCode": 1,
"Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n"
}
]
}

[jacobalberty]

There's a new monolithic configuration directory in /unifi instead, the readme details it. The old directories should still work though I'm going to look into the system.properties stuff and see why it's not picking it up in the legacy directories On Oct 16, 2017 4:17 PM, "jamesmr89" <[email protected]> wrote: I just came across an issue where this was causing my containers to be marked as down, my system.properties was set to: #unifi.https.port=8443 I fixed that, but I think you should think about making it default to 8443 if it is commented or absent from the file? Also I'm now getting this unable to find systme properties, its somehow setting my data directory to /unifi/data? "Health": { "Status": "unhealthy", "FailingStreak": 4, "Log": [ { "Start": "2017-10-16T14:12:09.828254541-07:00", "End": "2017-10-16T14:12:09.917836561-07:00", "ExitCode": 1, "Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n" }, { "Start": "2017-10-16T14:12:39.921362077-07:00", "End": "2017-10-16T14:12:39.993279284-07:00", "ExitCode": 1, "Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n" }, { "Start": "2017-10-16T14:13:09.99687464-07:00", "End": "2017-10-16T14:13:10.077135305-07:00", "ExitCode": 1, "Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n" }, { "Start": "2017-10-16T14:13:40.081548099-07:00", "End": "2017-10-16T14:13:40.168543162-07:00", "ExitCode": 1, "Output": "grep: /unifi/data/system.properties: No such file or directory\n % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to localhost port 8443: Connection refused\n" } ] } — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#62 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AB42golSX3n_gpFgdeGQP-jb106f567Yks5ss8fjgaJpZM4P3z8o> .

[jamesmr89]

Ok, getting a bit further here:

I had to crate binds to both /var/lib/unifi and /unifi/data from my hosts /nfs/unifi folder to get it to sort of work but still having an issue with being marked as unhealthy:

"Log": [
{
"Start": "2017-10-16T14:36:39.06864002-07:00",
"End": "2017-10-16T14:36:39.202518942-07:00",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\ncurl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure\n"
},
{
"Start": "2017-10-16T14:37:09.205896619-07:00",
"End": "2017-10-16T14:37:09.354938526-07:00",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\ncurl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure\n"
},
{
"Start": "2017-10-16T14:37:39.360079102-07:00",
"End": "2017-10-16T14:37:39.471567538-07:00",
"ExitCode": 1,
"Output": " % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\ncurl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure\n"
}
]
}
},

[jacobalberty]

@jamesmr89 looking at docker-healthcheck.sh it should be defaulting to 8443 if the port isn't specified, still looking at the system.properties not existing issue, did you have a system.properties in the /var/lib/unifi volume?

[jamesmr89]

Yea, it was in that volume.

…

On Mon, Oct 16, 2017 at 2:50 PM, Jacob Alberty ***@***.***> wrote: @jamesmr89 <https://github.com/jamesmr89> looking at docker-healthcheck.sh it should be defaulting to 8443 if the port isn't specified, still looking at the system.properties not existing issue, did you have a system.properties in the /var/lib/unifi volume? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#62 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAErl9Nxl_xEP--kGYUBCJ1EqTBjLlDXks5ss8-agaJpZM4P3z8o> .

[jacobalberty]

If you're binding /unifi/data you shouldn't need the /var/lib/unifi anymore the image should actually be creating a symlink to /unifi/data

[jamesmr89]

within the container on bash:
root@ns-unifi-home:/usr/local/bin# curl -k -L --fail https://localhost:8443
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

root@ns-unifi-home:/usr/local/bin# curl -sslv3 -k -L --fail https://localhost:8443

• Rebuilt URL to: https://localhost:8443/
• Trying 127.0.0.1...
• TCP_NODELAY set
• Connected to localhost (127.0.0.1) port 8443 (#0)
• OpenSSL was built without SSLv3 support
• Curl_http_done: called premature == 0
• Closing connection 0

root@ns-unifi-home:/usr/local/bin# curl --sslv3 -k -L --fail https://localhost:8443
curl: (4) OpenSSL was built without SSLv3 support
root@ns-unifi-home:/usr/local/bin#

[jacobalberty]

Pull the newest image and recreate

[jacobalberty]

Also what filesystem are you using for the host and what storage driver for docker? aufs? overlay?

[jacobalberty]

may need to delete the keystore from your data dir and let unifi recreate it, i accidentally pushed an image that would corrupt it

[jamesmr89]

Hmm, I deleted my keystore and am still getting the ssl errors.

I'm using nfs on my hosts, aufs on docker.

[jacobalberty]

Did you pull the latest image as well? it'll be the same tag, i just updated with a fixed import_cert

[jamesmr89]

Yea, i'm pulling 5.6.18-sc

…

On Mon, Oct 16, 2017 at 3:30 PM, Jacob Alberty ***@***.***> wrote: Did you pull the latest image as well? it'll be the same tag, i just updated with a fixed import_cert — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#62 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAErl92OLLdZQepQArYThqYpNV8Kgzanks5ss9kVgaJpZM4P3z8o> .

[jamesmr89]

sha256:c8e1e21fc2a8677e1b43ef62da6fac186b3293e78c2a5977c94f7e76a2473099 On Mon, Oct 16, 2017 at 3:36 PM, James Records <[email protected]> wrote:

…

Yea, i'm pulling 5.6.18-sc On Mon, Oct 16, 2017 at 3:30 PM, Jacob Alberty ***@***.***> wrote: > Did you pull the latest image as well? it'll be the same tag, i just > updated with a fixed import_cert > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#62 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAErl92OLLdZQepQArYThqYpNV8Kgzanks5ss9kVgaJpZM4P3z8o> > . >

[jacobalberty]

I am having a hell of a time reproducing this, does server.log show something like this:

[2017-10-16 17:45:43,784] <launcher> INFO  system - Valid keystore is missing. Generating one ...
[2017-10-16 17:45:43,784] <launcher> INFO  system - Generating Certificate[UniFi]... please wait...
[2017-10-16 17:45:44,746] <launcher> INFO  system - Certificate[UniFi] generated!

and what does docker logs show?

[jamesmr89]

Here's something

[2017-10-16 21:23:03,956] INFO system - Valid keystore is missing. Generating one ...
[2017-10-16 21:23:03,956] INFO system - Generating Certificate[UniFi]... please wait...
[2017-10-16 21:23:04,661] INFO system - Certificate generation failed
java.io.FileNotFoundException: /usr/lib/unifi/data/keystore (No such file or directory)
at java.io.FileOutputStream.open0(Native Method)
at java.io.FileOutputStream.open(FileOutputStream.java:270)

[jamesmr89]

and this seems to be there:

root@ns-unifi-home:/usr/lib/unifi/data# ls /usr/lib/unifi/data/keystore
/usr/lib/unifi/data/keystore

[jamesmr89]

docker logs

root@NS-DOCKER-02:/nfs/backup/unifi-home/log# docker logs ns-unifi-home
[2017-10-16 15:29:47,156] Starting unifi controller service.
[2017-10-16 15:29:47,158] WARNING: Running UniFi in insecure (root) mode

[jacobalberty]

I mean you could try mapping to /var/lib/unifi /unifi/data and /usr/lib/unifi/data to the same volume, somethings just not making sense, on my system the links forward to /unifi/data even if i map one of them as a volume. what do you get if you ls -al /usr/lib/unifi/data and ls -al /var/lib/unifi?

[jacobalberty]

I may need to write a script to look for the real dir and update the links to compensate

[jamesmr89]

Hmm, not sure here

drwxr-xr-x 16 root root 4096 Oct 16 13:44 ..
lrwxrwxrwx 1 root root 11 Oct 16 13:44 data -> /unifi/data
root@ns-unifi-home:/var/lib/unifi# ls -al /usr/lib/unifi/data
lrwxrwxrwx 1 root root 11 Oct 16 13:44 /usr/lib/unifi/data -> /unifi/data

[jamesmr89]

mapping all 3 paths seems to work.

[jamesmr89]

well sort of, I don't have any of my old data now.

I need to run for the evening I can pick this up tomorrow

[jamesmr89]

Ok, this is as simple as I can make it:

docker service create --replicas=1 jacobalberty/unifi:5.6.18-sc

That fails to work for me, it gets marked unhealthy and dies.

[duaneg]

As Jacob said the script should default to port 8443 if it isn't present (or is commented out). I've just retested and confirmed that it does indeed do that if the unifi.https.port key is either missing or commented.

If you can reproduce this failing please attach or send me the system.properties file and I'll have a look at it.

[jacobalberty]

Alright, I think I may have it licked. Still no idea why it isn't manifesting the same in all instances but I've cleaned up the directories and symbolic links to ensure they are consistent, doing a few tests to verify it then I'll start pushing it to sc

[jamesmr89]

OK, I'm making a bit of progress to, I think i have some things worked out on my end, here is my stack compose file that seems to be working now:

https://gist.github.com/jamesmr89/544d3ee53636cade5460b34f7f3a20f4

[jacobalberty]

@jamesmr89 did you pull the latest 5.6.18-sc image? I believe I have your issue fixed there. Also 5.6.19-sc is up now

[jamesmr89]

I've been doing updates with the service so it repulls each time, I'll upgrade to 5.6.19 right now and let you know.

…

On Mon, Oct 16, 2017 at 10:14 PM, Jacob Alberty ***@***.***> wrote: @jamesmr89 <https://github.com/jamesmr89> did you pull the latest 5.6.18-sc image? I believe I have your issue fixed there. Also 5.6.19-sc is up now — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#62 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAErly5naoaiIjzUG9bxq4c09st56jjPks5stDejgaJpZM4P3z8o> .

[jamesmr89]

5.6.19-sc looks good with the above mentioned compose file.