Development deployment question

[awpenn]

Hello,
I'm testing out a deployment of the Leaf application, using the linux/apache architecture approach. I've made it to section 8a seemingly without trouble.

• I have the Leaf database built and populated and the API compiled and ui-client app built.
• followed instructions to create and give permissions to api_svc_account user,
• created a service file at /var/opt/leafapi/services/leaf_api.service
• created an environment variables .conf file at /var/opt/leafapi/services/leaf_api.service.conf

When I run the systemctl start leaf_api.service command, the service fails to launch, with the log showing the following error message:

..."Level":"Fatal","MessageTemplate":"API terminated unexpectedly","Exception":"Model.Options.LeafConfigurationException: Do not run UNSECURED authentication in non-development environments!
at API.Options.StartupExtensions.ThrowInvalidUnsecuredEnvironment() in /var/opt/leafapi/leaf_download/leaf/src/server/API/Options/StartupExtensions.Options.cs:line 468...

I'm confused by this because UNSECURED is recommended for dev, but the code at src/server/API/Options/StartupExtensions.Options.cs seems to suggest that any authz/n setting besides SAML will result in a failure. Changing the mechanisms to SAML in my appsettings.json file results in the same error.

Hoping someone here can suggest some possible ways forward with our test deployment. Please let me know if I can provide any additional information regarding the steps I've taken so far.

Thanks!

[ndobb]

Hi @awpenn - thanks for your question and sorry for the confusion. When you compile the API, in this case I'd recommend using dotnet publish -c *Debug*, rather than Release (I'm assuming you used Release based on context above).

We are in the process of making the documentation much more clear here.

[ndobb]

Awesome, very happy to hear that and happy to help! Let us know if you run into any more trouble.

[ndobb]

Thanks again @awpenn and @CatLibWilk for your questions!

I just wanted to quick follow up and mention that we've updated our docs accordingly:

• https://leafdocs.rit.uw.edu/faqs_and_troubleshooting/troubleshooting/#api-error-do-not-run-unsecured-authentication-in-non-development-environments
• https://leafdocs.rit.uw.edu/faqs_and_troubleshooting/troubleshooting/#api-error-unable-to-start-kestrelexception-systemnetsocketssocketexception-13-permission-denied

If you run into any more issues please let us know.

Best,
-nic

[awpenn]

Hi @ndobb . Thank you again for your help before. I've become stuck again in the deployment process and was wondering if you could help again.
Here's where I am so far:

• leaf_api service is connected to the leaf_db and running on its own server. Can reach [service_ip]:5001/api/config in browser and see some information
• client-ui is build and deployed on it's own apache server. I've placed it in the var/www/html directory, and if I go to that server's address, I can see the landing page for the application.
  However, I get a Hmm... No Leaf server was found. Please notify your Leaf administrator message. I can see in the browser console that the app is trying to reach
  the api/config endpoint, but it's using the IP for the apache server, not the one for the app server.
• I tried to create and enable a leaf.conf configuration in /etc/apache2/conf-available, based on the httpd.conf example in the installation instructions.
  • I copied the cert/key created in step 3 over to the apache2 server, stored in /etc/ssl/certs and changed the paths in the configuration to match.
  • I changed to proxyPass variable to match the app-server IP and port where the API is reachable.

Basically, I'm a little lost when it comes to server configuration part, and don't know how much of the example server configuration I'm supposed to change,
or if I'm correct in setting up and attempting to enable my custom conf in conf-available directory. I appreciate any help/advice you can give me.

thanks!
Andy W.

[ndobb]

Hi @awpenn, thanks very much for your patience in my reply (last week was a bit crazy).

The Leaf client will always communicate the server via the browser URL + /api, so this sounds like it's just a matter of using Apache to route /api requests to your service_ip.

@mh2727 any thoughts on what @awpenn is describing?

[mh2727]

Hi @awpenn.

I agree with @ndobb that it might be worth checking if your Apache route to /api is set up correctly.

I am a little confused when you said:
"I can see in the browser console that the app is trying to reach the api/config endpoint, but it's using the IP for the apache server, not the one for the app server."

You would be the one defining the ProxyPass URL, so perhaps that needs to be changed to the app server?

Another point to keep in mind is that you should also include ProxyPassReverseURL as well.

Hope this is helpful. I can't speak more to your Apache config settings without taking a look at it.

--
Mehadi Hassan