Certbot run dry run failes

Help
21

Is there any device doing NAT or port forwarding?

22

meybe the firewall
I used iptables before and now i use ufw

23

Is it a separate firewall device?

24

no, just this server

25

OK then recheck both "firewalls" (iptables and ufw).
Something is preventing the inbound port 80 connections from reaching certbot.
If all other services are running OK, you might want to remove nginx.

26

But i had to add a rule directly using iptables to get cockpit to work.
i ran:
sudo iptables -I INPUT 5 -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo iptables -I INPUT 5 -i eth0 -p tcp --dport 9090 -m state --state NEW,ESTABLISHED -j ACCEPT
sudo netfilter-persistent save
sudo netfilter-persistent reload

27

i think i only wanted to use nginx to forward ports to unifi.
Ref: NGINX does the proxying from HTTPS to Unifi (running on 8443), and does all of the SSL handshaking.
ref: https://blog.ljdelight.com/nginx-proxy-to-ubiquiti-unifi-controller/

28

That is not what nginx is doing.
Try:
sudo nginx -T | grep -i proxy

29

unifiadmin@unifi:/etc/nginx/sites-available$ sudo nginx -T | grep -i proxy
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

proxy on;

proxy on;

unifiadmin@unifi:/etc/nginx/sites-available$

30

Is this "work in progress" ?
I don't see any proxy_pass statement.
The whole thing looks default.

31

Yes i belive setting up nginx was not completed.

32

Perhaps is should just Uninstall nginx?

33

You have a problem:
While nginx if off, certbot is unable to to be reached from the Internet on port 80.

While nginx is on, you are still using certbot with --standalone and that conflicts with nginx (for port 80).

If the end-game is to provide your service via proxy, then you need to leave nginx installed (and running - systemctl start nginx).
And we need to get certbot to authenticate via nginx.

one
step
at
a
time

34

I found this: Can this be the solution?:

35

That looks like a good config for what you need to do - I'm no expert on that.

So have you restarted nginx ?

36

I want to remove nginx for now and possibly add the proxy later.
Right now it os most important to get the certs ok.
The nginx config i found also had some reports that vital functionality in unifi did not work as expected so thats why i just want this to be removed for now.

sudo apt-get remove nginx ?

37

OK, but wait.
We can use it to troubleshoot the inbound port 80 access.
Start nginx and let's get to finding out why port 80 can't be reached?
[then when we're done you can remove it]

38

unifiadmin@unifi:/etc/nginx/sites-available$ sudo systemctl start nginx
[sudo] password for unifiadmin:
unifiadmin@unifi:/etc/nginx/sites-available$

39

Try:
curl -Ik 127.0.0.1

40

unifiadmin@unifi:/etc/nginx/sites-available$ curl -Ik 127.0.0.1
HTTP/1.1 301 Moved Permanently
Server: nginx/1.10.3
Date: Tue, 03 Nov 2020 13:15:49 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: https://127.0.0.1/

unifiadmin@unifi:/etc/nginx/sites-available$