Ansible issues and how do I access the WebUI?

[kaasneus]

Hi there,

I just managed to finish running the ansible playbook. There were a few hiccups:

1: ansible host needs rsync, otherwise ansible fails at task "Copy liberator role source to target host"
2: target host (Debian 10) needs python-pip package otherwise ansible fails with "No setuptools found in remote host" at task "Install specified python requirements".
3: target host (Debian 10) needs full aptitude package otherwise ansible fails with "Unable to find APTITUDE in path" at task "Update all packages to their latest version". Maybe consider setting 'force_apt_get=True'.

But with those fixed, the ansible run works fine. Just wondering "what now". I can't seem to access the UI or even the apidocs here: https://10.1.1.26:8443/apidocs
I see nginx is running and is using libre.apigw.conf, but I can't get to it at all.

From checking this morning, it doesn't even respond to SYN packets. There's no firewall running on the system. It was Debian 10 netinst with just SSH selected before I started.

[kaasneus]

Turns out it was the default nftables config that ansible pushes.
When I added my local range to accept it worked fine, eg. ip saddr 10.1.1.0/24 accept
I can get to the API now.

[hnimminh]

Hi @kaasneus,
Thank for your sharing, I'm appreciate it!
#1. I will mention rsync is a required for ansible host in to document
#2 & #3 which one is your provider of Debian? AWS, Google Cloud or just a bare-metal hardware? - I have some test but it may not cover all real-life scenario

[kaasneus]

I'm running it on my own server. So it's the basic netinst iso + SSH. One network interface.
So maybe add the localnet ranges from rfc1918 to nftables.conf?

 10.0.0.0        -   10.255.255.255  (10/8 prefix)
 172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
 192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

At least SSH worked so I could access it again, this was due to your SSH rate-limiting rule. If that wasn't there all remote access would have been lost.

[hnimminh]

I got your idea!
In some of existing deployment, only some of IP is allowed to access the Libresbc, and the rest is not allowed. This change might effect to their side and implicit declaration. So I suggest to use the whitelist firewall api:
/libreapi/base/firewall/whitelist
you can found detail of apidocs as well