Installing MeshCentral on NAS & Accessing Via TailScale

[otherfutures]

Hello! I'm trying to install MC on my Synology NAS via a docker-compose on Container Manager, but am stuck at trying to access the container.

I believe this is because the http port redirects to an https port & I don't have a certificate (but I could be wrong--it's my best guess based on the redirection I see in the browser's URL bar & viewing the container logs).

I don't have a domain hostname, as I have no interest in connecting to WAN & would like to use TailScale to stay in my LAN, so this is where the guides I could find online diverge from me as they all relied on a hostname env in the docker-compose.yml (which I don't have, I think). I did test install on my local machine & was able to access the GUI page (& other abilities) on another machine via TailScale without problem after setting up the agent on the local machine so I feel it's very possible.

This is my docker-compose below based off one I found online (it installs without problem, but I'm unsure how to get access to the GUI via http://<NAS-IP>:8181 is all--also please note I've gone into MC's config.json file & edited "port" & "redirPort" to 2087 & 8181 respectively as I was running into trouble trying to use the default 443 & 80 ports; going to http://<NAS-IP>:8181 redirects me to https://<NAS-IP>:2087, which I believe is correct but the latter page is unable to connect--I'm also unsure whether my edit to HOSTNAME & trying to set to localhost instead of a proper DNS is correct or very wrong):

version: '3'
services:
  meshcentral:
    restart: always
    container_name: meshcentral
    image: ghcr.io/ylianst/meshcentral:latest
    ports:
      - 8181:8181 # MeshCentral doesn't like using port 80, but you can by changing the config.json
    environment:
      - HOSTNAME=localhost
      - REVERSE_PROXY=false # set to your reverse proxy IP if you want MC behind a reverse proxy
      # - REVERSE_PROXY_TLS_PORT=
      - IFRAME=true
      - ALLOW_NEW_ACCOUNTS=false # disable self-service creation of new accounts besides admin
      - WEBRTC=false # not officially released, but can work with it. Use with caution
    volumes:
      #config.json and other important files live here. A must for data persistence
      - /volume1/docker/meshcentral/data:/opt/meshcentral/meshcentral-data
      #where file uploads for users live
      - /volume1/docker/meshcentral/user_files:/opt/meshcentral/meshcentral-files

[si458]

You need to open both ports in the docker-compose file
So 80/443 but in ur case 8181/2087
The port setting is the main base port which should ALWAYS be open
The redirPort is just simply used to divert web requests from http to https like a normal Web browser would access http first then be redirected to https

Edit. So u can block the http port, but can only access directly by typing https://nasip:2087

[si458]

Yes u have cert set to localhost, so that needs to be set to an ip address OR the best thing is a resolvable dns name!!!

[otherfutures]

That makes sense! I was able to log in (thank you)! At the moment I've no interest in a setting up & using a DNS, but as I'm sure you've noticed by now I'm not exactly an expert (to say the least).

Are there security &/or performance related issues that should make me reconsider this? It'd only ever be used in LAN due to accessing via TailScale (at least as far as my understanding of networking goes anyways).

[si458]

In theory no ur good to go i think? (Im no security expert haha)
but I'm not sure if lan mode will work over tailscale, so best leave it in wan/hybrid mode

[si458]

Sessionkey is also good to uncomment and set it to a random value, this helps with when u restart meshcentral, ur login sessions for users are remembered and they wont have to relogin every time u restart meshcentral

[otherfutures]

I see! Well, very good then. Thank you again for your help! It's truly very much appreciated

[aandersen2323]

Hello! I'm trying to install MC on my Synology NAS via a docker-compose on Container Manager, but am stuck at trying to access the container.

I believe this is because the http port redirects to an https port & I don't have a certificate (but I could be wrong--it's my best guess based on the redirection I see in the browser's URL bar & viewing the container logs).

I don't have a domain hostname, as I have no interest in connecting to WAN & would like to use TailScale to stay in my LAN, so this is where the guides I could find online diverge from me as they all relied on a hostname env in the docker-compose.yml (which I don't have, I think). I did test install on my local machine & was able to access the GUI page (& other abilities) on another machine via TailScale without problem after setting up the agent on the local machine so I feel it's very possible.

This is my docker-compose below based off one I found online (it installs without problem, but I'm unsure how to get access to the GUI via http://<NAS-IP>:8181 is all--also please note I've gone into MC's config.json file & edited "port" & "redirPort" to 2087 & 8181 respectively as I was running into trouble trying to use the default 443 & 80 ports; going to http://<NAS-IP>:8181 redirects me to https://<NAS-IP>:2087, which I believe is correct but the latter page is unable to connect--I'm also unsure whether my edit to HOSTNAME & trying to set to localhost instead of a proper DNS is correct or very wrong):

version: '3'
services:
  meshcentral:
    restart: always
    container_name: meshcentral
    image: ghcr.io/ylianst/meshcentral:latest
    ports:
      - 8181:8181 # MeshCentral doesn't like using port 80, but you can by changing the config.json
    environment:
      - HOSTNAME=localhost
      - REVERSE_PROXY=false # set to your reverse proxy IP if you want MC behind a reverse proxy
      # - REVERSE_PROXY_TLS_PORT=
      - IFRAME=true
      - ALLOW_NEW_ACCOUNTS=false # disable self-service creation of new accounts besides admin
      - WEBRTC=false # not officially released, but can work with it. Use with caution
    volumes:
      #config.json and other important files live here. A must for data persistence
      - /volume1/docker/meshcentral/data:/opt/meshcentral/meshcentral-data
      #where file uploads for users live
      - /volume1/docker/meshcentral/user_files:/opt/meshcentral/meshcentral-files

Do you think you could post your updated yaml, json and synology port settings? Im a noob and cant get meshserver working.

[Ghostraven192]

If anyone is also trying to run it with tailscale I went the npm route and ran it with node node_modules/meshcentral --wanonly --cert your.tailscaleaddressformeshcentral.server. Add now the agents download and install over tailscale. Just make sure all your workstations are on your tail net.