Bug 51365 - Using Let's Encrypt with Jitsi App breaks access
Summary: Using Let's Encrypt with Jitsi App breaks access
Status: NEW
Alias: None
Product: UCS
Classification: Unclassified
Component: Let's Encrypt
Version: UCS 4.4
Hardware: amd64 Linux
: P5 minor
Target Milestone: ---
Assignee: UCS maintainers
QA Contact: UCS maintainers
URL: https://help.univention.com/t/jitsi-p...
Keywords:
Depends on:
Blocks:
 
Reported: 2020-05-27 23:16 CEST by Kevin
Modified: 2021-06-26 03:18 CEST (History)
6 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 4: Minor Usability: Impairs usability in secondary scenarios
Who will be affected by this bug?: 3: Will affect average number of installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.206
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): External feedback
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin 2020-05-27 23:16:54 CEST
Using Let's Encrypt with Jitsi app results in non-functional jitsi proxy config.

It looks like the config file for lets encrypt doesn't generate properly.

The file, /etc/apache2/sites-enabled/univention-letsencrypt.conf, simply leaves out the proxy config for jitsi in the virtual host generated for jitsi.

i.e. I get a virtual host section with the jitsi.domain.com server name, but it's missing the proxy config for jitsi.

ProxyPass / http://localhost:8888/ retry=0
ProxyPassReverse / http://localhost:8888/

Adding that proxy config into the file makes jitsi work properly, but I'm not sure why it's left out in the first place or where the fault lies.
Comment 1 Erik Damrose univentionstaff 2020-05-28 18:46:34 CEST
Apps that use the vhost feature from bug 45115 are probably incompatible with the current way the letsencrypt app handles the apache2 config.

In the apache2 config univention-letsencrypt.conf should be a line
IncludeOptional /etc/apache2/ucs-sites.conf.d/*.conf

So it may be enough to link the jitsi apache2 config to that directory
ln -s /var/lib/univention-appcenter/apps/jitsi/config/vhost.conf /etc/apache2/ucs-sites.conf.d/
Comment 2 Erik Damrose univentionstaff 2020-06-04 09:35:53 CEST
In my above comment I got the appid wrong, below is the command with the fixed path.

ln -s /var/lib/univention-appcenter/apps/jitsimeet/config/vhost.conf /etc/apache2/ucs-sites.conf.d/
Comment 3 Nico Gulden univentionstaff 2020-08-04 09:22:17 CEST
I added a note to the workaround described in this bug to the README of the Jitsi Meet app. As soon as this issue is fixed and released, the Jitsi Meet README file needs to updated, as well.
Comment 4 Martin Ziegler 2021-03-19 01:03:52 CET
For me that workaround kills the display of the UCS-Portal..
If I access my server normally, I now just see jitsi.

And https://www.*********.de/univention/portal/ Doesnt load properly...

Using latest ucs version

Do you have the same problem or have any ideas how to solve it?
Comment 5 Kevin 2021-05-20 03:47:44 CEST
Tried this workaround after the latest upgrade to Jitsi Meet suggested it, and it broke access to nextcloud.

I reverted the fix and restarted apache and nextcloud is working again. I haven't had time to troubleshoot it yet as we use nextcloud for calendars I needed to get it back running quickly.
Comment 6 Kevin 2021-05-21 18:33:26 CEST
I ended up putting the contents of 

/var/lib/univention-appcenter/apps/jitsimeet/config/vhost.conf

into the jitsi vhost section of

/etc/apache2/sites-enabled/univention-letsencrypt.conf

That seems to be working fine at the moment after some basic testing.

Not sure if there is a better way to manage these configs for apps in the future. Maybe some sort of default include line that pulls in any needed config into the 
/etc/apache2/sites-enabled/univention-letsencrypt.conf file at the appropriate applications section.

Hopefully someone smarter and more well versed in apache configs can figure out a good process for this so it can be handled easily by the app maintainers and not require any intervention on the part of the admin of a particular UCS install.