#community-help

Typesense Certificate Error in Docker Compose

TLDR Suraj encountered an issue with typesense not finding SSL certificates in docker compose, even though certs were mounted successfully. After several suggestions by Jason, the issue was resolved by Suraj by mounting the correct folder in the docker compose file.

13mo

Join the chat

Aug 22, 2022 (13 months ago)

Photo of md5-a7605b093448e06efb0a1c150153cad6

Suraj

03:34 PM

Hey guys, I'm using typesense in docker compose with cerbot for ssl, the certs get mounted in a shared volume successfully but typesense throws an "error while trying to load server certificate file: path/full chain.pem" and failed to listen on 0.0.0.0:443 - No such file or directory. Any guidance?

Photo of md5-8813087cccc512313602b6d9f9ece19f

Jason

05:09 PM

Could you share the full docker command you’re using?

Suraj

05:12 PM

Thanks for the quick response!

version: "3.9"
services:
  typesense:
    image: typesense/typesense:0.23.1
    environment:
      - API_KEY=${API_KEY}
    entrypoint: sh -c "/opt/typesense-server --data-dir=/data --api-key=${API_KEY} --enable-cors --api-port=443 --ssl-certificate=/etc/letsencrypt/live/test.domain.io/fullchain.pem --ssl-certificate-key=/etc/letsencrypt/live/test.domain.io/privkey.pem"
    ports:
      - "443:443"
      - "8108:8108"
    restart: unless-stopped
    volumes:
      - typesense-data:/data
      - certbot-etc:/etc/letsencrypt/live
    depends_on:
      - certbot
  certbot:
    image: certbot/certbot
    container_name: certbot
    ports:
      - "80:80"
    volumes:
      - certbot-etc:/etc/letsencrypt/live
    command: certonly --standalone --agree-tos --redirect --email   -d 

volumes:
  certbot-etc:
  typesense-data:
    driver: local
    driver_opts:
      type: none
      device: ./typesense-data/
      o: bind

05:14

Suraj

05:14 PM

That's my docker-compose file with placeholder domain and email, when testing with real information I have the certs mounted in the correct directory but typesense server is unable to find them even though they are in the folder

Jason

05:14 PM

I wonder if there’s a delay between when the certbot container starts and the actual SSL cert is available in /etc/letsencrypt/live for then Typesense to pickup when starting?

05:15

Jason

05:15 PM

As soon as the Typesense container is up, could you exec bash into it and check if the certs are there?

Suraj

05:15 PM

I tried stopping the container and restarting it to see if it finds it but no luck

05:15

Suraj

05:15 PM

They are there when using docker exec ls

Jason

05:16 PM

It’s interesting that the error says “error while trying to load server certificate file: path/full chain.pem”

05:16

Jason

05:16 PM

Wonder where it’s getting “path/full chain.pem” from

Suraj

05:16 PM

I shortened it there as an example it actually says the path specified in the run command "/etc/letsencrypt/live/test.domain.io/fullchain.pem"

Jason

05:16 PM

Ah ok

05:18

Jason

05:18 PM

https://typesense-community.slack.com/archives/C01P749MET0/p1661188543399799?thread_ts=1661182497.082429&cid=C01P749MET0

This is from the Typesense container and not the certbot container right?

Suraj

05:19 PM

Yup

Jason

05:19 PM

Could you exec bash into the Typesense container, and then run the entrypoint typesense-server command from that prompt and see if it works?

Suraj

05:21 PM

The server is constantly resetting so can't really bash into it, could only use ls during start of container as there are multiple attempts made to start the server

05:23

Suraj

05:23 PM

and I am also able to docker cp the certs out to make sure they are there

06:08

Suraj

06:08 PM

still getting this after stopping container, overriding the entrypoint to /bin/bash and checking if the certs are there and manually starting the server but still get the same error

E20220822 18:05:29.061584    24 http_server.cpp:1057] An error occurred while trying to load server certificate file: /etc/letsencrypt/live/tests.surajpatel.org/fullchain.pem
E20220822 18:05:29.061868    24 http_server.cpp:174] Failed to listen on 0.0.0.0:443 - No such file or directory

Jason

06:09 PM

Could you try starting a Typesense server using one of the native binaries without Docker, with those certs?

Suraj

06:10 PM

Sure will let you know how it goes

06:41

Suraj

06:41 PM

works if I do it without docker

Jason

06:43 PM

Hmmm, I wonder if it is some permissions issue then may be?

Suraj

06:49 PM

Any idea what I could try?

Jason

06:50 PM

Could you try cating the contents of the SSL cert / key files from inside the Typesense container?

Suraj

06:51 PM

The SSL cert and Key are there, I can copy them out of the container too

Jason

06:52 PM

Let’s try this:

How about changing entry point to something like this:

entrypoint: sh -c "cat /etc/letsencrypt/live/test.domain.io/fullchain.pem && /opt/typesense-server --data-dir=/data --api-key=${API_KEY} --enable-cors --api-port=443 --ssl-certificate=/etc/letsencrypt/live/test.domain.io/fullchain.pem --ssl-certificate-key=/etc/letsencrypt/live/test.domain.io/privkey.pem"

06:53

Jason

06:53 PM

And then run docker logs to see if you see the output of the cat command

Suraj

06:53 PM

Thanks trying it now

Jason

06:54 PM

I’m essentially wondering if the permissions on those files somehow prevent them from being read by the Typesense process

Suraj

06:55 PM

Yeah I was about to send you them using should work

docker-compose exec typesense ls -la /etc/letsencrypt/live