96 lines
4.3 KiB
Markdown
96 lines
4.3 KiB
Markdown
|
# Mifos: Tunnel via NPMplus (Option — dedicated NPMplus for mifos.d-bis.org)
|
|||
|
|
|
|||
|
|
**Last Updated:** 2026-02-09
|
|||
|
|
**Status:** Optional architecture
|
|||
|
|
**Context:** Use a dedicated NPMplus VM (10237) as the tunnel origin; NPMplus proxies to VMID 5800 (Mifos). SSL and proxy managed in NPMplus UI (e.g. Let's Encrypt).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Yes, we run NPMplus
|
|||
|
|
|
|||
|
|
Existing instances:
|
|||
|
|
|
|||
|
|
| VMID | Host | IP | Role / Public |
|
|||
|
|
|-------|---------|----------------|----------------------|
|
|||
|
|
| 10233 | r630-01 | 192.168.11.167 | Main NPMplus (76.53.10.36) |
|
|||
|
|
| 10234 | r630-02 | 192.168.11.168 | Secondary |
|
|||
|
|
| 10235 | r630-01 | 192.168.11.169 | Alltra/HYBX (76.53.10.42) |
|
|||
|
|
| 10236 | r630-01 | 192.168.11.170 | Fourth – dev/Codespaces (76.53.10.40) |
|
|||
|
|
| **10237** | **r630-02** | **192.168.11.171** | **NPMplus Mifos** – tunnel origin → 5800 |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Flow: Tunnel → NPMplus (10237) → VMID 5800
|
|||
|
|
|
|||
|
|
1. **Cloudflare** terminates HTTPS for `mifos.d-bis.org` and sends traffic through the tunnel.
|
|||
|
|
2. **Tunnel connector** runs either:
|
|||
|
|
- **In 10237 (NPMplus Mifos):** cloudflared in 10237; Service = `https://127.0.0.1:443` or `https://192.168.11.171:443`.
|
|||
|
|
- **In 5800 (current):** cloudflared in 5800; Service = `https://192.168.11.171:443` (origin = NPMplus).
|
|||
|
|
3. **NPMplus (10237)** has a proxy host: **mifos.d-bis.org** → **http://192.168.11.85:80** (Mifos in 5800). SSL for mifos.d-bis.org can be Let's Encrypt in NPMplus.
|
|||
|
|
4. **5800** serves Mifos on port 80 only; no Nginx/SSL on 5800 if you use this path.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 1. Create NPMplus Mifos container (10237)
|
|||
|
|
|
|||
|
|
From project root:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
./scripts/npmplus/create-npmplus-mifos-container.sh
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- **VMID:** 10237
|
|||
|
|
- **Host:** r630-02 (192.168.11.12)
|
|||
|
|
- **IP:** 192.168.11.171
|
|||
|
|
- **Overrides:** `STORAGE_R630_02_NPMPLUS_MIFOS`, `TEMPLATE`
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 2. Install NPMplus in 10237
|
|||
|
|
|
|||
|
|
Inside 10237 (same pattern as other NPMplus containers):
|
|||
|
|
|
|||
|
|
- Install Docker, then Nginx Proxy Manager: `./scripts/npmplus/install-npmplus-mifos.sh`.
|
|||
|
|
- **Credentials:** All five NPMplus instances use the **same** `NPM_EMAIL` and `NPM_PASSWORD` (in `.env`). Use them to log in at **https://192.168.11.171:81**. For a newly created instance, first log in with the auto-generated password (`ssh root@<host> 'pct exec 10237 -- cat /opt/.npm_pwd'`), then change the admin password in the UI to match `NPM_PASSWORD` so it stays in sync with the others.
|
|||
|
|
- Add **Proxy Host:**
|
|||
|
|
- **Domain:** `mifos.d-bis.org`
|
|||
|
|
- **Forward hostname / IP:** `192.168.11.85`
|
|||
|
|
- **Forward port:** `80`
|
|||
|
|
- **SSL:** Request Let's Encrypt for `mifos.d-bis.org` (or use existing cert).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 3. Point the tunnel at NPMplus
|
|||
|
|
|
|||
|
|
**Option A — Tunnel connector in 10237 (recommended for this design)**
|
|||
|
|
- Install cloudflared in 10237 with the same tunnel token (or a dedicated tunnel for Mifos).
|
|||
|
|
- **Zero Trust** → **Published application routes:**
|
|||
|
|
- **Domain:** `mifos.d-bis.org`
|
|||
|
|
- **Service:** `https://127.0.0.1:443` (NPMplus in same container) or `https://192.168.11.171:443`
|
|||
|
|
- Add **Origin configuration** → **No TLS Verify** only if NPMplus uses a self-signed cert for the origin; if NPM has Let's Encrypt for mifos.d-bis.org, verification can stay on.
|
|||
|
|
|
|||
|
|
**Option B — Tunnel connector stays in 5800**
|
|||
|
|
- **Published application routes:** Service = `https://192.168.11.171:443`.
|
|||
|
|
- cloudflared in 5800 connects to NPMplus at 192.168.11.171:443; NPMplus proxies to 192.168.11.85:80.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 4. DNS
|
|||
|
|
|
|||
|
|
Unchanged: **mifos.d-bis.org** → **CNAME** to `<tunnel-id>.cfargotunnel.com` (Proxied).
|
|||
|
|
Script: `MIFOS_DNS_MODE=tunnel ./scripts/cloudflare/configure-mifos-dns.sh`
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## 5. Summary
|
|||
|
|
|
|||
|
|
| Step | Action |
|
|||
|
|
|------|--------|
|
|||
|
|
| 1 | Create 10237: `./scripts/npmplus/create-npmplus-mifos-container.sh` |
|
|||
|
|
| 2 | Install NPM in 10237 (Docker + NPM); add proxy mifos.d-bis.org → http://192.168.11.85:80; SSL in NPM (Let's Encrypt) |
|
|||
|
|
| 3 | Install cloudflared in 10237 (or keep in 5800); set tunnel Service to https://192.168.11.171:443 (or https://127.0.0.1:443 if connector in 10237) |
|
|||
|
|
| 4 | DNS: CNAME mifos → tunnel (already done if using tunnel) |
|
|||
|
|
|
|||
|
|
**Config:** `IP_NPMPLUS_MIFOS`, `NPMPLUS_MIFOS_VMID` in `config/ip-addresses.conf`; VMID 10237 → r630-02 in `scripts/lib/load-project-env.sh`.
|
|||
|
|
**Credentials:** All five NPMplus instances (10233, 10234, 10235, 10236, 10237) use the same `NPM_EMAIL` and `NPM_PASSWORD` in `.env`.
|