Cannot start docker install in small environment with no openvpn?

[surfrock66]

I'm setting up a pilot install in an environment with 3 AP's to potentially roll this out later. The management network will be a dedicated VLAN, so I don't need openVPN, these are not cloud-facing right now, it would be on-prem but potentially eventually distributed among several physical sites. I am open to the possibility I'm fundamentally misunderstanding the whole setup here.

For testing, I made a VM and am doing the docker auto-install. Additionally, I want to put this behind a reverse proxy (as all of our sites go behind a reverse proxy with a wildcard ssl cert) and I set up the following proxied sites:

openwisp.domain.tld (Proxying 443 to 443, 1812 to 1812, and 1813 to 1813)
openwispapi.domain.tld (Proxying /api/ on 443 on the openwisp VM to /api/ on 443 on the proxy vm, and proxying wss://openwispapi.domain.tld/ws/ to /ws/ on the openwisp VM)

Of the questions, I had the following answers:

• Version: Blank for latest
• .env file: Blank for ad-hoc
• Dashboard Domain: openwisp.domain.tld
• API Domain: openwispapi.domain.tld
• OpenVPN: N to disable
• Email: My address
• Letsencrypt email: Blank for self-signed

Once this is done, I get the following output:

Downloading docker-openwisp...                                         done
Configuring docker-openwisp...                                         done
Starting images docker-openwisp (this will take a while)...            error
Starting openwisp failed.
Check logs at /opt/openwisp/autoinstall.log

Autoinstall is showing that the openvpn container isn't starting, hence the failure:

Starting Services...
 Container docker-openwisp-redis-1  Running
 Container docker-openwisp-postgres-1  Recreate
 Container docker-openwisp-influxdb-1  Recreate
 Container docker-openwisp-postfix-1  Recreate
 Container docker-openwisp-influxdb-1  Recreated
 Container docker-openwisp-postgres-1  Recreated
 Container docker-openwisp-openvpn-1  Recreate
 Container docker-openwisp-postfix-1  Recreated
 Container docker-openwisp-dashboard-1  Recreate
 Container docker-openwisp-openvpn-1  Recreated
 Container docker-openwisp-dashboard-1  Recreated
 Container docker-openwisp-api-1  Recreate
 Container docker-openwisp-celerybeat-1  Recreate
 Container docker-openwisp-websocket-1  Recreate
 Container docker-openwisp-celery-1  Recreate
 Container docker-openwisp-celery_monitoring-1  Recreate
 Container docker-openwisp-celery-1  Recreated
 Container docker-openwisp-celery_monitoring-1  Recreated
 Container docker-openwisp-websocket-1  Recreated
 Container docker-openwisp-celerybeat-1  Recreated
 Container docker-openwisp-api-1  Recreated
 Container docker-openwisp-nginx-1  Recreate
 Container docker-openwisp-freeradius-1  Recreate
 Container docker-openwisp-freeradius-1  Recreated
 Container docker-openwisp-nginx-1  Recreated
 Container docker-openwisp-postgres-1  Starting
 Container docker-openwisp-influxdb-1  Starting
 Container docker-openwisp-postfix-1  Starting
 Container docker-openwisp-influxdb-1  Started
 Container docker-openwisp-postgres-1  Started
 Container docker-openwisp-openvpn-1  Starting
 Container docker-openwisp-postfix-1  Started
 Container docker-openwisp-dashboard-1  Starting
 Container docker-openwisp-openvpn-1  Started
 Container docker-openwisp-dashboard-1  Started
 Container docker-openwisp-openvpn-1  Waiting
 Container docker-openwisp-websocket-1  Starting
 Container docker-openwisp-openvpn-1  Waiting
 Container docker-openwisp-celerybeat-1  Starting
 Container docker-openwisp-api-1  Starting
 Container docker-openwisp-celerybeat-1  Started
 Container docker-openwisp-websocket-1  Started
 Container docker-openwisp-api-1  Started
 Container docker-openwisp-freeradius-1  Starting
 Container docker-openwisp-nginx-1  Starting
 Container docker-openwisp-freeradius-1  Started
 Container docker-openwisp-nginx-1  Started
 Container docker-openwisp-openvpn-1  Error
 Container docker-openwisp-openvpn-1  Error
dependency failed to start: container docker-openwisp-openvpn-1 is unhealthy
make: *** [Makefile:86: start] Error 1
make: Leaving directory '/opt/openwisp/docker-openwisp'

I thought I had disabled that component? I can't get it to start at all now. Am I doing something wrong here?

[nemesifier]

It's probably a bug: openwisp/docker-openwisp#490.

[surfrock66]

Understood; that being said, are there any concerns with my proposed rollout? This will never be a large rollout, it's going to be 3-4 locations with 3-4 AP's each.

[nemesifier]

Understood; that being said, are there any concerns with my proposed rollout? This will never be a large rollout, it's going to be 3-4 locations with 3-4 AP's each.

I don't see anything concerning in what you wrote. You'll only have to decide how to solve the SSL cert issue, I think you mainly have 3 options:

• Don't verify ssl cert (not great)
• Use self-signed cert with a self created CA, which you can trust on openwrt and in the browser
• Use an SSL cert from a trusted CA but instead of using it on a online domain you resolve the domain locally

Make sure to have read and understood "Setting up the management network" as it explains the different scenarios. If you use the VLAN as management network for example, you could set management_interface in /etc/config/openwrt to the VLAN interface and it should work fine.

If you find other issues please open new threads unless it's related to openvpn (which we can follow up here or in openwisp/docker-openwisp#490).