How to connect to gateway:80 from agent?

[hut36]

I run both gateway and agent in docker container, and gateway is reverse-proxyed by traefik. Now that gateway and agent are connected in docker internal network, it would be convenient to connect from agent to gateway directly on port 80.

Currently, this will result an error on agent:

Unable to connect to the gateway: E-UnableToUpgrade, Error(404)

[SajjadPourali]

I run both gateway and agent in docker container, and gateway is reverse-proxyed by traefik. Now that gateway and agent are connected in docker internal network, it would be convenient to connect from agent to gateway directly on port 80.

Currently, this will result an error on agent:

Unable to connect to the gateway: E-UnableToUpgrade, Error(404)

There may be a configuration issue. Could you please verify the following statuses:

1. Ensure that the agent's configuration matches the domain name set in the gateway configuration. In other words, if you've set an IP address in the agent configuration while using a domain name in the gateway configuration, the agent will not be accepted. Both configurations should match.

2. When you open the gateway address directly in your web browser, do you see the message "Powered By Narrowlink"?

3. Are you sure that your Traefik installation supports WebSocket?

If you can confirm the above questions, could you please provide a sample configuration (with domain names and secrets hidden) and run these components using RUST_LOG=trace variable.

[hut36]

Hi,

I forgot to mention that my narrowlink setup works properly as per the documentation, except that instead of of having lines:

gateway: mydomain.com:443
...
service_type: Wss

in the agent config file, I want these lines:

narrowlink-gateway-container:80
...
service_type: Ws

to work too.

I run both gateway and agent in docker container, and gateway is reverse-proxyed by traefik. Now that gateway and agent are connected in docker internal network, it would be convenient to connect from agent to gateway directly on port 80.
Currently, this will result an error on agent:
Unable to connect to the gateway: E-UnableToUpgrade, Error(404)

There may be a configuration issue. Could you please verify the following statuses:

1. Ensure that the agent's configuration matches the domain name set in the gateway configuration. In other words, if you've set an IP address in the agent configuration while using a domain name in the gateway configuration, the agent will not be accepted. Both configurations should match.

Could this be the cause? Because in my agent config file the domain is the gateway container name, while in the gateway config file
the domain name is the real domain name.

2. When you open the gateway address directly in your web browser, do you see the message "Powered By [Narrowlink](https://narrowlink.com/)"?

Yes, 404 with a line "Powered By Narrowlink"

3. Are you sure that your Traefik installation supports WebSocket?

It actually works if I put the real domain name in the agent config file.

If you can confirm the above questions, could you please provide a sample configuration (with domain names and secrets hidden) and run these components using RUST_LOG=trace variable.

[SajjadPourali]

Hello

Could this be the cause? Because in my agent config file the domain is the gateway container name, while in the gateway config file the domain name is the real domain name.

Yes, as defined here: https://github.com/narrowlink/narrowlink/blob/main/gateway/src/service/ws.rs#L138-L139
You need to use the same domain name in both the agent and the gateway. If you only want to use it for the HTTP protocol, you can only add the domain name to the WS configuration; which does not perform automatic certificate provisioning and doesn't require a real domain name.

[hut36]

My files are:

docker-compose.yaml:

version: '3.8'

networks:
  main:

secrets:
  cf_api_token:
    file: ./secrets/cf_api_token

services:
  traefik:
    image: traefik:v2.9
    restart: "always"
    command:
      - --providers.docker
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --accesslog
      - --log.level=DEBUG
      #- --api=true
      #- --api.insecure=true
      - --certificatesresolvers.cf.acme.dnschallenge=true
      - --certificatesresolvers.cf.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cf.acme.dnschallenge.delayBeforeCheck=10
      - --certificatesresolvers.cf.acme.email=${EMAIL}
      - --certificatesresolvers.cf.acme.storage=/letsencrypt/cf-cert.json
    ports:
      - "80:80"
      - "443:443"
      # The Web UI (enabled by --api.insecure=true)
      #- "8080:8080"
    secrets:
      - 'cf_api_token'
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./cf-cert.json:/letsencrypt/cf-cert.json
    networks:
      - main
    labels:
      - traefik.http.routers.http-all.rule=HostRegexp(`{host:.+}`)
      - traefik.http.routers.http-all.entrypoints=http
      - traefik.http.routers.http-all.middlewares=redirect-to-https

      # middleware: redirect to https
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https

  narrowlink-gateway:
    build:
      context: ./narrowlink/gateway
      network: host
    volumes:
      - ./narrowlink/gateway/config.yaml:/app/gateway.yaml:ro
    networks:
      - main
    labels:
      - traefik.http.routers.narrowlink-gateway.entrypoints=https
      - traefik.http.routers.narrowlink-gateway.rule=Host(`nl.${HOSTNAME}`)
      - traefik.http.services.narrowlink-gateway.loadbalancer.server.port=80
      - traefik.http.routers.narrowlink-gateway.tls=true
      - traefik.http.routers.narrowlink-gateway.tls.certresolver=cf
      - traefik.http.routers.narrowlink-gateway.tls.domains[0].main=${HOSTNAME}
      - traefik.http.routers.narrowlink-gateway.tls.domains[0].sans=*.${HOSTNAME}

  narrowlink-agent:
    build:
      context: ./narrowlink/agent
      network: host
    networks:
      - main
    volumes:
      - ./narrowlink/agent/config.yaml:/app/agent.yaml:ro

narrowlink/gateway/Dockerfile:

FROM rust

WORKDIR /app
RUN cargo install narrowlink-gateway

EXPOSE 80
CMD [ "narrowlink-gateway", "-c", "/app/gateway.yaml" ]

narrowlink/gateway/config.yaml:

name: basic-tutorial # name of the gateway, it currently has no effect
secret: [1,2,3,4] # secret key for the gateway is used to authenticate clients and agents, at least 8 bytes
services: # list of services
- !Ws # insecure websocket service
  domains: ["nl.mydomain"] # list of domains that this service should listen to
  listen_addr: "0.0.0.0:80" # address to listen to

narrowlink/agent/Dockerfile:

FROM rust

WORKDIR /app
RUN cargo install narrowlink-agent

EXPOSE 80
CMD [ "narrowlink-agent", "-c", "/app/agent.yaml" ]

narrowlink/agent/config.yaml:

gateway: nl.mydomain:443
token: token
service_type: Wss

[hut36]

Hi,

I solved it like this:

In the agent config file, use the gateway container name as domain name and Ws protocol:

gateway: narrowlink-gateway:80
token: token
service_type: Ws

And add narrowlink-gateway to the domain list of gateway config file:

...
- !Ws
  domains: ["nl.mydomain", "narrowlink-gateway"]
  listen_addr: "0.0.0.0:80"

Thank you for your help!