Difficulty in getting docker-openwisp working. Deployed multiple times, can never connect.

[surfrock66]

I've submitted some bugs about getting openwisp working (both docker and ansible) and I've yet to be able to get it working. Docker-openwisp would be my preferred architecture, but I cannot for the life of me get it to deploy successfully. I've gone as far as rebuilding my VM from scratch and redeploying, but at this point, I believe the postgres provisioning is failing, and I'm feeling like I'm not using the issue tracker appropriately (I was having issues disabling openvpn, which I think got resolved).

My provisioning was successful:

Welcome to OpenWISP auto-installation script.
Please ensure following requirements:
  - Fresh instance
  - 2GB RAM (Minimum)
  - Root privileges
  - Supported systems
    - Debian: 11, 12 & 13
    - Ubuntu 22.04 & 24.04

You can use -u\--upgrade if you are upgrading from an older version.

Checking your system capabilities...                                   done
Setting up dependencies...                                             done
Setting up docker...                                                   done

OpenWISP Configuration:
OpenWISP Version (leave blank for latest): 
Do you have .env file? Enter filepath (leave blank for ad-hoc configuration): 
(1/5) Enter dashboard domain: openwisp.s--------.com
(2/5) Enter API domain (blank for api.surfrock66.com): openwispapi.s--------.com
(3/5) Enter OpenVPN domain (blank for openvpn.surfrock66.com, N to disable module): N
(4/5) Site manager email: s---------@s---------.com
(5/5) Enter letsencrypt email (leave blank for self-signed certificate): s---------@s---------.com

Downloading docker-openwisp...                                         done
Configuring docker-openwisp...                                         done
Starting images docker-openwisp (this will take a while)...            done

Your setup is ready, your dashboard should be available on https://openwisp.s--------.com in 2 minutes.

You can login on the dashboard with
    username: admin
    password: admin
Please remember to change these credentials.

Random database user and password generate by the script:
    username: YN---------------------------------------------------------------------------iu
    password: wA--------------------------------------------------------------------------1Q
Please note them, might be helpful for accessing postgresql data in future.

root@sr66-wisp-01:/opt# 

When I try to load the web console, I get a self-signed cert error in firefox (so, letsencrypt failed?) but when I get through that, I get a 502 error.

Looking in the logs, this is what I see. The credentials generated for postgres appear to not work:

postgres-1           | 2026-02-04 00:20:55.313 IST [881] FATAL:  password authentication failed for user "YN----------------------------------------------iu"
postgres-1           | 2026-02-04 00:20:55.313 IST [881] DETAIL:  Role "YN----------------------------------------------iu" does not exist.
postgres-1           |  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
postgres-1           | 2026-02-04 00:20:55.900 IST [882] FATAL:  password authentication failed for user "YN----------------------------------------------iu"
postgres-1           | 2026-02-04 00:20:55.900 IST [882] DETAIL:  Role "YN----------------------------------------------iu" does not exist.
postgres-1           |  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
postgres-1           | 2026-02-04 00:20:55.914 IST [883] FATAL:  password authentication failed for user "YN----------------------------------------------iu"
postgres-1           | 2026-02-04 00:20:55.914 IST [883] DETAIL:  Role "YN----------------------------------------------iu" does not exist.
postgres-1           |  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
postgres-1           | 2026-02-04 00:20:56.724 IST [884] FATAL:  password authentication failed for user "YN----------------------------------------------iu"
postgres-1           | 2026-02-04 00:20:56.724 IST [884] DETAIL:  Role "YN----------------------------------------------iu" does not exist.
postgres-1           |  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
postgres-1           | 2026-02-04 00:20:56.725 IST [885] FATAL:  password authentication failed for user "YN----------------------------------------------iu"
postgres-1           | 2026-02-04 00:20:56.725 IST [885] DETAIL:  Role "YN----------------------------------------------iu" does not exist.
postgres-1           |  Connection matched pg_hba.conf line 100: "host all all all scram-sha-256"
nginx-1              | 2026/02/03 18:50:57 [error] 33#33: *763 connect() failed (111: Connection refused) while connecting to upstream, client: 172.18.0.11, server: dashboard.internal, request: "GET /admin/login/ HTTP/1.1", upstream: "uwsgi://172.18.0.7:8000", host: "dashboard.internal"
nginx-1              | [668bf802401e] - - [03/Feb/2026:18:50:57 +0000] "GET /admin/login/ HTTP/1.1" status: 502 150 "-" "Wget" http_x_forwarded_for: - - remote_addr: 172.18.0.11 - realip_remote_addr: 172.18.0.11 - real_ip: 172.18.0.11

I'm not a postgres expert, but I figured I should make sure the DB user/password are working, so I connected to the postgres container and tried to connect to psql:

root@sr66-wisp-01:/opt/openwisp/docker-openwisp# docker exec -it docker-openwisp-postgres-1 /bin/bash
8dd43f699f53:/# psql -U YN---------------------------------------------------------------------------iu
psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: FATAL:  role "YN---------------------------------------------------------------------------iu" does not exist
8dd43f699f53:/# 

I am kind of worried about spamming the issue tracker, but I am wondering, is there an issue with the installer, or am I doing something wrong? One thing I saw in autoinstall.log, the influx repo isn't installing right:

Checking your system capabilities...

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 https://repos.influxdata.com/ubuntu stable InRelease [6,913 B]
Hit:2 https://download.docker.com/linux/ubuntu noble InRelease
Hit:3 https://repo.zabbix.com/zabbix/7.4/release/ubuntu noble InRelease
Hit:4 https://repo.zabbix.com/zabbix-tools/debian-ubuntu noble InRelease
Hit:5 https://repo.zabbix.com/zabbix/7.4/stable/ubuntu noble InRelease
Err:1 https://repos.influxdata.com/ubuntu stable InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
Get:6 https://apt.syncthing.net syncthing InRelease [24.2 kB]
Get:7 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
Get:8 http://packages.networkradius.com/freeradius-3.2/ubuntu/noble noble InRelease [4,293 B]
Hit:9 http://us.archive.ubuntu.com/ubuntu noble InRelease
Get:10 http://us.archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Hit:11 http://us.archive.ubuntu.com/ubuntu noble-backports InRelease
Get:12 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages [1,411 kB]
Get:13 http://us.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1,722 kB]
Get:14 http://us.archive.ubuntu.com/ubuntu noble-updates/universe amd64 Packages [1,528 kB]
Get:15 http://security.ubuntu.com/ubuntu noble-security/main Translation-en [230 kB]
Fetched 5,178 kB in 3s (1,595 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
31 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://repos.influxdata.com/ubuntu stable InRelease: The following signatures couldn't be v
erified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: Failed to fetch https://repos.influxdata.com/ubuntu/dists/stable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA61C26A0585BD3B
W: Some index files failed to download. They have been ignored, or old ones used instead.

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

lsb-release is already the newest version (12.0-2).
0 upgraded, 0 newly installed, 0 to remove and 31 not upgraded.
Setting up dependencies...

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

[nemesifier]

@surfrock66 the install script is working fine in our CI builds see github actions workflow. It also worked fine during the latest tests we did (we have an instance right now running the latest edge on test.openwisp.io.

Nonetheless, I can't be 100% sure of why this is happening to you without further debugging.

Questions:

• On what OS is this happening to you and does it make any difference if you try a different OS?
• How does your .env file look like (can you share it, removing sensitive info)?
• Are you able to replicate this with a script that we can run using the same .env and OS to see if we can replicate the same problem?

[surfrock66]

Ubuntu server 24.04. My env file is below. Ultimately, it seems like the postgres credentials aren't being made correctly; I don't know the procedure but if there's a way to get into the postgres container in something like single user mode and re-set the credential, maybe I could get it back working?:

# Essential
DASHBOARD_DOMAIN=openwisp.s---------.com
API_DOMAIN=openwispapi.s---------.com
# SSH Credentials Configurations
SSH_PRIVATE_KEY_PATH=/home/openwisp/.ssh/id_ed25519
SSH_PUBLIC_KEY_PATH=/home/openwisp/.ssh/id_ed25519.pub
VPN_DOMAIN=
EMAIL_DJANGO_DEFAULT=s---------@s---------.com
DB_USER=YN-------------------------------------------------------iu
DB_PASS=wA-----------------------------------------1Q
INFLUXDB_USER=YN------------------------------------------------------iu
INFLUXDB_PASS=wA-------------------------------------1Q
# Security
DJANGO_SECRET_KEY=T_-----------------------------------------------------d6
# Enable Modules
USE_OPENWISP_RADIUS=Yes
USE_OPENWISP_TOPOLOGY=True
USE_OPENWISP_FIRMWARE=True
USE_OPENWISP_MONITORING=True
# uWSGI
UWSGI_PROCESSES=2
UWSGI_THREADS=2
UWSGI_LISTEN=100
# Additional
SSL_CERT_MODE=Yes
TZ=UTC
CERT_ADMIN_EMAIL=s---------@s---------.com
DJANGO_LANGUAGE_CODE=en-gb
DB_NAME=openwisp
INFLUXDB_NAME=openwisp
OPENWISP_GEOCODING_CHECK=True
# X509 default CA & Certs Information
X509_NAME_CA=default
X509_NAME_CERT=default
X509_COUNTRY_CODE=CH
X509_STATE=Geneva
X509_CITY=Geneva
X509_ORGANIZATION_NAME=OpenWISP
X509_ORGANIZATION_UNIT_NAME=OpenWISP
X509_EMAIL=certificate@example.com
X509_COMMON_NAME=OpenWISP
# VPN
VPN_NAME=default
VPN_CLIENT_NAME=default-management-vpn
# Developer
DEBUG_MODE=False
DJANGO_LOG_LEVEL=INFO
# Celery workers
USE_OPENWISP_CELERY_TASK_ROUTES_DEFAULTS=True
OPENWISP_CELERY_COMMAND_FLAGS=--concurrency=1
USE_OPENWISP_CELERY_NETWORK=True
OPENWISP_CELERY_NETWORK_COMMAND_FLAGS=--concurrency=1
USE_OPENWISP_CELERY_MONITORING=True
OPENWISP_CELERY_MONITORING_COMMAND_FLAGS=--concurrency=1
OPENWISP_CELERY_MONITORING_CHECKS_COMMAND_FLAGS=--concurrency=1
USE_OPENWISP_CELERY_FIRMWARE=True
OPENWISP_CELERY_FIRMWARE_COMMAND_FLAGS=--concurrency=1
CELERY_SERVICE_NETWORK_MODE=
# Metric collection
METRIC_COLLECTION=True
# collectstatic
COLLECTSTATIC_WHEN_DEPS_CHANGE=true
POSTFIX_ALLOWED_SENDER_DOMAINS=s---------.com
POSTFIX_MYHOSTNAME=s---------.com

[pandafy]

This looks like a situation where the auto-install generated new DB credentials while the Postgres data volume from the previous install remained on disk (because docker compose down was run without --volumes). The new .env contains a new DB_USER/DB_PASS but Postgres is still using the old role/password stored in the volume, so the app can't authenticate.

@surfrock66 did you reinstall docker-openwisp after deleting /opt/docker-openwisp/.env using the auto-install script? If yes, then the above situation is exactly what happened.

If you don't have any data in OpenWISP, then I will suggest doing a fresh install of docker-openwisp using the auto-install script.

⚠️ Executing the following instructions will delete all docker volumes and hence the data stored in any docker-openwisp container. Take backup and proceed on your risk.

# Remove all containers of docker-openwisp along with all volumes, hence deleting everything
docker compose -f /opt/openwisp/docker-openwisp/docker-compose.yml down --volumes

Then, install docker-openwisp using the auto-install script.

If the data is important and cannot be lost, I suggest searching for well-documented instructions on resetting the PostgreSQL username and password in a PostgreSQL container.

[surfrock66]

That's got to be it; I had a bunch of installs/reinstalls troubleshooting a previous issue with disabling the openVPN dependency, and I thought I purged the containers but you're right, likely that directory wasn't purged. I'll do it and report back.

[nemesifier]

if you confirm this resolves your issue, I'll create an issue to deal with this specific corner case, thanks

[surfrock66]

This resolved my issue. If there's a way to catch that issue for re-installs, it'd be much easier.

[nemesifier]

Opened openwisp/docker-openwisp#562, thanks for confirming 🙏