Repository navigation
Potential cert error macOS #1584
Description
I've decided to create this issue because of another comment I saw on gitter node-solid-server channel regarding Docker setup on MacOS.
For about 3-4 weeks now when I cloned and setup SolidOS it is not trusted in Chrome and I have to type the following command
sendCommand(SecurityInterstitialCommandId.CMD_PROCEED) in the console to be able to use the data browser.
I thought it was me, but after reading that post I think it might be a problem with node-solid-server certs for MacOS.
Activity
SharonStrats commentedon Mar 19, 2021
Here is the post
Any help for NSS on macOS and Docker with data persistence would be much appreciated.
Following (with wildcard cert and key for ~ "*.solid.domain.com" in "cert" folder) works on Ubuntu but not macOS:
mkdir data db config
sudo chown -R 1000:1000 data db config
docker run -it --rm -p 8443:8443 --name node-solid-server
--mount src="$(pwd)/data",target=/opt/solid/data,type=bind
--mount src="$(pwd)/db",target=/opt/solid/.db,type=bind
--mount src="$(pwd)/config",target=/opt/solid/config,type=bind
--mount src="$(pwd)/certs",target=/opt/solid/certs,type=bind
-e SOLID_SERVER_URI="https://solid.domain.com:8443"
-e SOLID_SSL_KEY="/opt/solid/certs/key.pem"
-e SOLID_SSL_CERT="/opt/solid/certs/cert.pem"
nodesolidserver/node-solid-server start --multiuser --port 8443
On macOS (latest), it quickly exits with:
checking preconditions...
✗ /opt/solid/config not writable by node
✗ /opt/solid/data not writable by node
✗ /opt/solid/.db not writable by node
✓ /opt/solid/certs/key.pem is accessible by node
✓ /opt/solid/certs/cert.pem is accessible by node
Finished: ERROR
Same thing if I don't do chown..
rmdir data db config
mkdir data db config
Same thing if I change from --mount to -v:
-v $(pwd)/data:/opt/solid/data:rw
-v $(pwd)/db:/opt/solid/.db:rw
-v $(pwd)/config:/opt/solid/config:rw
-v $(pwd)/certs:/opt/solid/certs:ro
Same thing if I have Docker create the folders:
rmdir data db config
...
-v $(pwd)/data:/opt/solid/data:rw
-v $(pwd)/db:/opt/solid/.db:rw
-v $(pwd)/config:/opt/solid/config:rw
Same thing if I give full path to each folder:
-v /Users/.../solid/data:/opt/solid/data:rw
-v /Users/.../solid/db:/opt/solid/.db:rw
-v /Users/.../solid/config:/opt/solid/config:rw
Same thing if I use Docker-managed volumes:
docker volume prune
docker volume create solid-data
docker volume create solid-db
docker volume create solid-config
...
--mount src=solid-data,target=/opt/solid/data,type=volume
--mount src=solid-db,target=/opt/solid/.db,type=volume
--mount src=solid-config,target=/opt/solid/config,type=volume
What's worse, if I try using the image's own data/db/config folders on macOS or Ubuntu:
docker run -it --rm -p 8443:8443 --name node-solid-server
-v $(pwd)/certs:/opt/solid/certs:rw
-e SOLID_SERVER_URI="https://solid.domain.com:8443"
-e SOLID_SSL_KEY="/opt/solid/certs/key.pem"
-e SOLID_SSL_CERT="/opt/solid/certs/cert.pem"
nodesolidserver/node-solid-server start --multiuser --port 8443
Then I get:
No ACL found for https://solid.domain.com:8443/, searched in
https://solid.domain.com:8443/.acl
Only if I use the most basic setup (with localhost certs) can I get the Docker image to work on macOS (also works on Ubuntu):
docker run -it --rm -p 443:443 --name node-solid-server nodesolidserver/node-solid-server start --port 443
.....
Another issue I had (when running the Docker with wildcard certs and locally persisted data/db/config folders) was trying to get https://podbrowser.inrupt.com to connect to my ID Provider... https://solid.domain.com:8443. It prompted for permissions, loaded the main page, but just kept spinning in the upper right or any other content areas that tried loading.
Are there known issues with the Docker image, where I should just roll my own ?
SharonStrats commentedon Mar 19, 2021
One other thing to note is that when MacOS upgrade to Catalina (from bash to zsh) that caused quite a few problems with SolidOS setup which I resolved but maybe this could be a factor.
[-]Potential cert error[/-][+]Potential cert error macOS[/+]bourgeoa commentedon Mar 19, 2021
Can you be more precise. Pod name, port, installation mode, Chrome version, other browser test, os version, type of certs ...
SharonStrats commentedon Mar 25, 2021
Lets close this. I was under the impression that the solidos build created the certs for me, but I realize now I need to add the certs myself to node-solid-server.