Calibre-Web on Raspberry Pi Access Problems

[MontyJ]

I have had CW running for years as a http site, now need to go to https.

I use the NOIP DV cert, but so far have not been able to 'switch over' and get a good https connection on port 443.

So I have been muddling my way through the whole mess and finally locked myself out of CW. I had gone in and while still in http mode and changed the settings to point to my 'server.key' file and 'server.csr' files.

But after saving, it locked up and I was unable to get into CW locally.

It was set for server port 8083, and I had setup a port forward in the router to get 443 to 8083, but now simply cannot login from my Linux PC on the same network. And port 443 is showing open using an Internet port checker.

I can SSH into the headless RPI, so is there anyway to change the CW settings from there? Then I can possible get it back to normal port 80 http to start over.

Thanks.

Monty

[mariosipad]

@MontyJ

How did you install CW on your Pi? With Docker or ?

[MontyJ]

@Mariosipad,

Hey, great! You are still here

Normal Linux install, no docker. The installed executables are in .local/bin:
cps
flask
markdown-it
ndg_httpclient
pybabel
pygmentize
tqdm
unidecode

I am not sure where the config files are.

I have a cron job that simply starts 'cps' on boot. and ps says the task is running, but I have no network connection to it. But I can get a ping from it so the RPI is alive and networking normally.

When I try to connect via https, I get a "Unable to Connect" browser error
When I try to connect via http, I get the Apache2 Debian Default Page, saying "It works!", LoL

Not sure where to go from here...

Monty

[MontyJ]

I looked around some more and found these files in ./calibre-web:
access.log access.log.2 calibre-web.log calibre-web.log.2 master.app.db test_app.db
access.log.1 app.db calibre-web.log.1 gdrive.db Python_scripts

These have recent time stamps, so are the current install files. I know app.db is the master settings database, but I cannot view or edit it. In the distant past I had saved copies of it because it contained all the user info, and if the file gets corrupted, it is a 'start over' event, a massive job for me given all the users I have, so I had made frequent copies. But I have no backups for this particular install.

The 'master.app.db' file is one I made a few minutes ago...just because.

Anyway, if there are other config files, I don't know of them.

Any ideas?

Thanks!

Monty

[mariosipad]

@MontyJ

1 - http/https
A - external access
In your router reforward port 80 to 8083. Don't forward port 443 now.
What happens now if you connect to CW?
B - internal access
Connect directly. i your LAN with a browser to http://<LAN-IP-of-your-PI>:8083
What happens now?


2 - config file
The file app.db can be read with a program called "sqlitebrowser".

It can be installed on your pi with:
sudo apt update && sudo apt upgrade && sudo apt install sqlitebrowser

However to use it you either need X11 forwarding to work or you need to connect a monitor and keyboard/mouse to your Pi.


3 - https
Read up on "let's encrypt"

[MontyJ]

@Mariosipad,

Thanks!

I have the router now forwarding 80 to 8083 to the RPi's IP address.

I did the update/upgrade. I hadn't touched it for 8 months or so, so it took about 20 minutes to do 186 package upgrades. Anyway, all went ok.

I use NoMachine to make a connection to the RPi, so now have desktop access.

I was able to install the sqlitebrowser and open the app.db (a copy) file. I have no clue what I should see, but don't see any errors. I do see an "Edit" selection, but that doesn't seem to lead anywhere.

I have no experience with any sql stuff, so hopefully the steps to switch back to http are simple?

Oh, I still cannot connect locally on 8083...seems it is still stuck in https mode. In Chromium browser I get "The connection to 192.168.0.xxx is not secure". When I hit "Continue to site" nothing happens. No further errors or page refreshes or other msgs.

Monty

[mariosipad]

@MontyJ

Have tried (re)moving the server.key and server.csr. etc. files so CW cannot find them?

You asked how to read the app.db file. Sqlitebrowser can read and change them. However if you do not recognise anything inside this file then that does not help. (I could not find anything useful either, but my setup of CW is Docker and very basic. Only for testing purposes.

I would make a backup of the current CW installation and reinstall CW and make it work without https. (If it works with http you can make https work with apache (reverse proxy) and Let's Encrypt.

Maybe you can check where there are differences between the old and new setup that can help you fix the old setup.

[MontyJ]

@mariosipad,

The .csr and .key files were indeed still there, so I moved them to a new folder and rebooted. And now I can access CW!

I couldn't see the forest for the trees, LoL. Thanks for that great suggestion!

Now I need to figure out what is wrong with my cert files. I paid for a year of the NOIP DV cert as they no longer have free ones. So I want to try to get those working before I give up on it and look into Let's Encrypt.

Now I know I can recover my CW install as is, I can experiment more with how the certs are developed and installed.

Thank you for the help!

Monty

[mariosipad]

@MontyJ

Interesting info from the wiki:
(Optional) SSL Configuration
For configuration of Calibre-Web as SSL Server go to the Config page in the Admin section. Enter the certfile- and keyfile-location, optionally change port to 443 and press submit. Afterwards the server can only be accessed via SSL. In case of a miss configuration (wrong/invalid files) both files can be overridden via command line options -c [certfile location] -k [keyfile location] By using "" as certfile/keyfile locations the server runs as non SSL server again. The correct file path can be entered on the config page afterwards. After the next restart without command line options the changed file paths are applied.

[MontyJ]

@mariosipad,

Great find!! I guess it is possible I entered the path to the files incorrectly. The first try was to put in the full path, ie /home/pi/file.csr. It wouldn't accept that, so then I used the ./file.csr format and it accepted it.

But the best part is being able to do it from the CL

Muchas Gracias!

Monty

[mariosipad]

@MontyJ

Great if it works!

In linux (on your Pi) it's alway better to use the full paths (/home/pi/certs/file.csr).
And the files should be readable for the user/group of CW (pi or root?)