Ubuntu 22.04 LTS에 신규 설치 후 http/https 연결이 허용되지 않습니다

제품 지원 자체 호스팅
1

첫 번째 디스코urs 설치 경험은 아니지만, Digital Ocean 드롭렛(1GB NVMe SSD Premium AMD)에 Ubuntu 22.04 LTS를 사용하여 표준 설치를 세 번 시도한 끝에 막혀버렸습니다. 가이드를 따라 진행했으며, 과거에 여러 번 해왔듯이 Let’s Encrypt용 이메일을 제공했습니다. 디스코urs 설치가 브라우저에 표시되지 않자(드롭렛의 A 레코드나 직접 IP를 통해 모두 시도해봄), http와 https 포트 모두에서 연결이 거부됨을 확인한 후부터 계속 머리를 싸매고 있습니다.

설치 중 이상하다고 느낀 유일한 점은 Digital Ocean 드롭렛에 기본적으로 Docker가 설치되어 있지 않아, Discourse 컨테이너의 git clone 과정에서 Docker가 필요하다고 감지하자 설치를 제안받았다는 것입니다. 그 외에는 정상적으로 진행했으며 Docker와 Discourse 설치를 모두 테스트했습니다.

좋은 소식 - Discourse가 이메일 전달성 테스트를 성공적으로 실행하여, 설치가 존재하고 실행 중임을 의미합니다. 또한 Docker도 정상적으로 작동하는 것 같습니다(“docker run -it --rm hello-world” 실행 후 확인). github.com에 ping을 보냈고 응답을 받았으므로, 방화벽이나 연결성 문제는 아닌 것으로 보입니다.

문제: 연결 거부
그러나 "curl -v localhost:8080"을 실행하면 다음이 반환됩니다:

*   Trying 127.0.0.1:8080...
* connect to 127.0.0.1 port 8080 failed: Connection refused
*   Trying ::1:8080...
* connect to ::1 port 8080 failed: Connection refused
* Failed to connect to localhost port 8080 after 1 ms: Connection refused
* Closing connection 0

curl -v localhost는 다음을 반환합니다:

*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80 (#0)
> GET / HTTP/1.1
> Host: localhost
> User-Agent: curl/7.81.0
> Accept: */*
>
* Empty reply from server
* Closing connection 0
curl: (52) Empty reply from server

다음은 제 app.yml 파일과 discourse-doctor 실행 결과입니다:

app.yml 
 ## How many concurrent web requests are supported? Depends on memory and CPU cores.
  ## will be set automatically by bootstrap based on detected CPUs, or you can override
  UNICORN_WORKERS: 2

  ## TODO: The domain name this Discourse instance will respond to
  ## Required. Discourse will not work with a bare IP number.
  DISCOURSE_HOSTNAME: community.example.io

  ## Uncomment if you want the container to be started with the same
  ## hostname (-h option) as specified above (default "$hostname-$config")
  #DOCKER_USE_HOSTNAME: true

  ## TODO: List of comma delimited emails that will be made admin and developer
  ## on initial signup example 'user1@example.com,user2@example.com'
  DISCOURSE_DEVELOPER_EMAILS: 'example@example.com'

  ## TODO: The SMTP mail server used to validate new accounts and send notifications
  # SMTP ADDRESS, username, and password are required
  # WARNING the char '#' in SMTP password can cause problems!
  DISCOURSE_SMTP_ADDRESS: smtp.mailgun.org
  DISCOURSE_SMTP_PORT: 587
  DISCOURSE_SMTP_USER_NAME: no-reply@example.io
  DISCOURSE_SMTP_PASSWORD: "XXXXXX"
  #DISCOURSE_SMTP_ENABLE_START_TLS: true           # (optional, default true)
  DISCOURSE_SMTP_DOMAIN: community.example.io
  DISCOURSE_NOTIFICATION_EMAIL: noreply@community.example.io

  ## If you added the Lets Encrypt template, uncomment below to get a free SSL certificate
  LETSENCRYPT_ACCOUNT_EMAIL: example@example.com

  ## The http or https CDN address for this Discourse instance (configured to pull)
  ## see https://meta.discourse.org/t/14857 for details
  #DISCOURSE_CDN_URL: https://discourse-cdn.example.com

  ## The maxmind geolocation IP address key for IP address lookup
  ## see https://meta.discourse.org/t/-/137387/23 for details
  DISCOURSE_MAXMIND_LICENSE_KEY: XXXXX

## The Docker container is stateless; all data is stored in /shared
volumes:
  - volume:
      host: /var/discourse/shared/standalone
      guest: /shared
  - volume:

  ## TODO: The domain name this Discourse instance will respond to
  ## Required. Discourse will not work with a bare IP number.
  DISCOURSE_HOSTNAME: community.example.io

  ## Uncomment if you want the container to be started with the same
  ## hostname (-h option) as specified above (default "$hostname-$config")
  #DOCKER_USE_HOSTNAME: true

  ## TODO: List of comma delimited emails that will be made admin and developer
  ## on initial signup example 'user1@example.com,user2@example.com'
  DISCOURSE_DEVELOPER_EMAILS: 'example@example.com'

  ## TODO: The SMTP mail server used to validate new accounts and send notifications
  # SMTP ADDRESS, username, and password are required
  # WARNING the char '#' in SMTP password can cause problems!
  DISCOURSE_SMTP_ADDRESS: smtp.mailgun.org
  DISCOURSE_SMTP_PORT: 587
  DISCOURSE_SMTP_USER_NAME: no-reply@example.io
  DISCOURSE_SMTP_PASSWORD: "XXXXXXXX"
  #DISCOURSE_SMTP_ENABLE_START_TLS: true           # (optional, default true)
  DISCOURSE_SMTP_DOMAIN: community.example.io
  DISCOURSE_NOTIFICATION_EMAIL: noreply@community.example.io

  ## If you added the Lets Encrypt template, uncomment below to get a free SSL certificate
  LETSENCRYPT_ACCOUNT_EMAIL: example@example.com

  ## The http or https CDN address for this Discourse instance (configured to pull)
  ## see https://meta.discourse.org/t/14857 for details
  #DISCOURSE_CDN_URL: https://discourse-cdn.example.com

  ## The maxmind geolocation IP address key for IP address lookup
  ## see https://meta.discourse.org/t/-/137387/23 for details
  DISCOURSE_MAXMIND_LICENSE_KEY: XXXXXX

## The Docker container is stateless; all data is stored in /shared
volumes:
  - volume:
      host: /var/discourse/shared/standalone
      guest: /shared
  - volume:
      host: /var/discourse/shared/standalone/log/var-log
      guest: /var/log
discourse-doctor results 
Found containers/app.yml

==================== YML SETTINGS ====================
DISCOURSE_HOSTNAME=community.example.io
SMTP_ADDRESS=smtp.mailgun.org
DEVELOPER_EMAILS=example@example.com
SMTP_PASSWORD=XXXXXXXX
SMTP_PORT=587
SMTP_USER_NAME=no-reply@example.io
LETSENCRYPT_ACCOUNT_EMAIL=example@example.com

==================== DOCKER INFO ====================
DOCKER VERSION: Docker version 20.10.21, build baeda1f

DOCKER PROCESSES (docker ps -a)

CONTAINER ID   IMAGE                 COMMAND        CREATED          STATUS          PORTS                                                                      NAMES
e1d88ff15b5b   local_discourse/app   "/sbin/boot"   18 minutes ago   Up 18 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp   app

e1d88ff15b5b   local_discourse/app   "/sbin/boot"   18 minutes ago   Up 18 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp   app

Discourse container app is running


==================== PLUGINS ====================
          - git clone https://github.com/discourse/docker_manager.git

No non-official plugins detected.

See https://github.com/discourse/discourse/blob/main/lib/plugin/metadata.rb for the official list.

========================================
Discourse version at community.example.io: NOT FOUND
Discourse version at localhost: NOT FOUND


==================== MEMORY INFORMATION ====================
RAM (MB): 1016

               total        used        free      shared  buff/cache   available
Mem:             969         687          61          21         220         110
Swap:           2047         241        1806

==================== DISK SPACE CHECK ====================
---------- OS Disk Space ----------
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        25G  8.2G   16G  34% /

==================== DISK INFORMATION ====================
Disk /dev/loop0: 63.22 MiB, 66293760 bytes, 129480 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop1: 102.98 MiB, 107986944 bytes, 210912 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/loop2: 47.98 MiB, 50315264 bytes, 98272 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/vda: 25 GiB, 26843545600 bytes, 52428800 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 728BDF97-580D-4B6F-9462-7E2540D5378B

Device      Start      End  Sectors  Size Type
/dev/vda1  227328 52428766 52201439 24.9G Linux filesystem
/dev/vda14   2048    10239     8192    4M BIOS boot
/dev/vda15  10240   227327   217088  106M EFI System

Partition table entries are not in disk order.


Disk /dev/vdb: 466 KiB, 477184 bytes, 932 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

==================== END DISK INFORMATION ====================

==================== MAIL TEST ====================
For a robust test, get an address from http://www.mail-tester.com/
Or just send a test message to yourself.
Email address for mail test? ('n' to skip) [example@example.com  ]:
Sending mail to example@example.com  . . .
Testing sending to example@example.com  using smtp.mailgun.org:587, username:no-reply@example.io with plain auth.
SMTP server connection successful.
Sending to example@example.com. . .
Mail accepted by SMTP server.
Message-ID: e3455d15-eb48-48bf-9859-a30f1acc765c@community.example.io

If you do not receive the message, check your SPAM folder
or test again using a service like http://www.mail-tester.com/.

If the message is not delivered it is not a problem with Discourse.
Check the SMTP server logs for the above Message ID to see why it
failed to deliver the message.
Replacing: SMTP_PASSWORD
Replacing: LETSENCRYPT_ACCOUNT_EMAIL
Replacing: DEVELOPER_EMAILS
Replacing: DISCOURSE_DB_PASSWORD
Replacing: Sending mail to

==================== DONE! ====================

디스코urs 디렉터리에서 ./launcher enter app를 실행하고 top 명령어를 사용하여 nginx, redis, postmaster, ruby가 모두 실행 중인지 확인했습니다. nginx가 목록에 보이지 않습니다…

launcher enter app --> top results 
Tasks:  31 total,   1 running,  30 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.3 us,  2.3 sy,  0.0 ni, 96.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.3 st
MiB Mem :    969.4 total,     72.4 free,    659.0 used,    238.0 buff/cache
MiB Swap:   2048.0 total,   1667.2 free,    380.8 used.    141.1 avail Mem

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
   4528 discour+  25   5  951480 289404   3096 S   0.3  29.2   4:21.14 ruby
      1 root      20   0    6772      0      0 S   0.0   0.0   0:00.02 boot
   4428 root      20   0    2340     24      0 S   0.0   0.0   0:01.14 runsvdir
   4429 root      20   0    2188      0      0 S   0.0   0.0   0:00.00 runsv
   4430 root      20   0    2188      0      0 S   0.0   0.0   0:00.00 runsv
   4431 root      20   0    2188      0      0 S   0.0   0.0   0:00.00 runsv
   4432 root      20   0    2188      0      0 S   0.0   0.0   0:00.00 runsv
   4433 root      20   0    2188    280    256 S   0.0   0.0   1:28.21 runsv
   4434 root      20   0    2188      0      0 S   0.0   0.0   0:00.00 runsv
   4435 root      20   0    2336      0      0 S   0.0   0.0   0:00.05 svlogd
   4436 redis     20   0   58072   2900   1624 S   0.0   0.3   3:17.52 redis-server
   4438 root      20   0    2336      0      0 S   0.0   0.0   0:00.00 svlogd
   4439 discour+  20   0   15256   1128    912 S   0.0   0.1   0:25.85 unicorn_launche
   4441 root      20   0    6620    488    384 S   0.0   0.0   0:00.21 cron
   4442 postgres  20   0  213172   5220   4776 S   0.0   0.5   0:02.75 postmaster
   4445 root      20   0  151068    132      0 S   0.0   0.0   0:00.06 rsyslogd
   4458 postgres  20   0  213392  10404   9896 S   0.0   1.0   0:00.78 postmaster
   4459 postgres  20   0  213172   5004   4604 S   0.0   0.5   0:01.50 postmaster
   4460 postgres  20   0  213172   4956   4588 S   0.0   0.5   0:27.50 postmaster
   4461 postgres  20   0  213840   2264   1652 S   0.0   0.2   0:01.98 postmaster
   4462 postgres  20   0   68200    788      0 S   0.0   0.1   0:05.01 postmaster
   4463 postgres  20   0  213724   1164    700 S   0.0   0.1   0:00.05 postmaster
   4464 discour+  20   0  457692 171868   1364 S   0.0  17.3   0:22.71 ruby
   4503 postgres  20   0  220116  11116  10812 S   0.0   1.1   0:01.51 postmaster
   4538 discour+  20   0  768724 169816   1032 S   0.0  17.1   0:08.27 ruby
   4549 discour+  20   0  768724 169948   1220 S   0.0  17.1   0:08.55 ruby
   4580 postgres  20   0  219408  10580  10460 S   0.0   1.1   0:00.13 postmaster
 134464 postgres  20   0  217332  21388  17444 S   0.0   2.2   0:00.24 postmaster
 137350 root      20   0    7036   3468   2972 S   0.0   0.3   0:00.02 bash
 137382 root      20   0   10108   3756   3080 R   0.0   0.4   0:00.08 top
 137609 discour+  20   0   13760   2004   1732 S   0.0   0.2   0:00.00 sleep

var/discourse/shared/standalone/log/var-log/nginx 안의 error.log를 확인해 보았습니다:

2022/12/12 07:55:26 [emerg] 5040#5040: cannot load certificate "/shared/ssl/community.example.io.cer": PEM_read_bio_X509_AUX(>
2022/12/12 07:55:27 [emerg] 5042#5042: cannot load certificate "/shared/ssl/community.example.io.cer": PEM_read_bio_X509_AUX(>
2022/12/12 07:55:28 [emerg] 5044#5044: cannot load certificate "/shared/ssl/community.example.io.cer": PEM_read_bio_X509_AUX(>
2022/12/12 07:55:29 [emerg] 5046#5046: cannot load certificate "/shared/ssl/community.example.io.cer": PEM_read_bio_X509_AUX(>
....
2

자, var/discourse/shared/standalone/log/var-log/nginx 안에 있는 error.log 파일을 바탕으로 app.yml에서 ssl 템플릿을 주석 처리하기로 결정했습니다:

## Uncomment these two lines if you wish to add Lets Encrypt (https)
##  - "templates/web.ssl.template.yml"
## - "templates/web.letsencrypt.ssl.template.yml"

그 다음 ./launcher stop app과 ./launcher rebuild app을 실행했고, 이제 discourse 빌드가 http를 통해 성공적으로 실행되며 브라우저에 “congratulations, you installed discourse!” 메시지가 표시됩니다.

한 발짝 전진했지만, ssl을 작동시키는 방법을 찾지 못하고 있습니다. LE 인증서는 아직 만료되지 않았고, DNS도 정상이며, 이는 매우 표준적인 서버 사양으로 이루어진 신규 설치 환경입니다.

Let’sEncrypt를 통해 ssl을 활성화하지 못하게 하는 설치 문제의 원인에 대해 어떤 아이디어가 있을까요?

3

제 생각에는 DNS가 잘못 설정되어 있거나, 이전에 잘못 설정되어 있었다가 여러 번 시도한 끝에 속도 제한(rate limit)에 걸린 것 같습니다. 쉬운 해결 방법은 일주일 정도 기다리거나 다른 서브도메인 이름을 선택하는 것입니다.

호스트명을 공유하지 않으셨기 때문에 DNS가 정상적으로 작동하는지 확인해 드릴 수 없습니다.

4

답변해 주셔서 감사합니다 @pfaffman. http://는 정상적으로 작동하지만, Let’s Encrypt를 활성화하면 SSL이 작동하지 않습니다. Let’s Encrypt를 새로 설치하여 설정했고, Let’s Encrypt 설정 튜토리얼도 읽어 보았지만 DNS 수정에 대한 언급은 찾을 수 없었습니다.

LE/SSL이 작동하도록 DNS 측면에서 구체적으로 무엇을 해야 하나요?

제 DNS 설정 스크린샷은 다음과 같습니다:

Advanced-DNS
Advanced-DNS1701×682 69.9 KB

(참고로, DKIM/SPF는 검증이 완료되었고 Discourse 메일도 정상적으로 작동하고 있습니다)

5

다시 말하지만, 내 추측에 따르면 당신은 Let’s Encrypt에서 주소를 요청하려고 여러 번 시도했지만 어떤 이유로 인해 실패했고, 이제 일주일 동안 다시 시도할 수 없는 상태인 것 같습니다. 내 추측이 맞다면 일주일 정도 기다리거나 다른 이름을 사용하세요.

그들에게서 오류를 가져오는 방법이 있지만, 휴대폰에서 어떻게 찾는지 기억이 나지 않습니다.

6

알겠습니다. 다음 주 초 7일 이후에 app.yml에서 ssl을 다시 활성화하고 재빌드한 후 결과를 보고하겠습니다.