Philip Rego's questions

I'm following this tutorial to host a React app on CentOS using Nginx. The website works (200 response) when I run curl localhost:3000, but when I try to his anthurie.com I get 500 error and this error in /var/log/nginx/error.log

2021/10/17 17:56:16 [error] 5379#0: *5 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.1.1, server: anthurie.com, request: "GET / HTTP/1.1", upstream: "https://[::1]:3000/", host: "anthurie.com"
2021/10/17 17:56:16 [error] 5379#0: *5 SSL_do_handshake() failed (SSL: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol) while SSL handshaking to upstream, client: 192.168.1.1, server: anthurie.com, request: "GET / HTTP/1.1", upstream: "https://127.0.0.1:3000/", host: "anthurie.com"
2021/10/17 17:56:17 [error] 5379#0: *5 no live upstreams while connecting to upstream, client: 192.168.1.1, server: anthurie.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://localhost/favicon.ico", host: "anthurie.com", referrer: "https://anthurie.com/"
2021/10/17 18:01:01 [error] 5379#0: *9 no live upstreams while connecting to upstream, client: 192.168.1.1, server: anthurie.com, request: "GET / HTTP/1.1", upstream: "https://localhost/", host: "anthurie.com"
2021/10/17 18:01:02 [error] 5379#0: *9 no live upstreams while connecting to upstream, client: 192.168.1.1, server: anthurie.com, request: "GET /favicon.ico HTTP/1.1", upstream: "https://localhost/favicon.ico", host: "anthurie.com", referrer: "https://anthurie.com/"

Idk why it has upstream: "https://localhost/" most of the time the app is at localhost:3000

/etc/systemd/system/anthurie.service

[Unit]
Description=Service run for reactjs application anthurie.com
After=network.target

[Service]
Type=simple
User=prego
Group=nginx
StandardOutput=syslog
StandardError=syslog
WorkingDirectory=/var/metaplex/js
Environment=NODE_ENV=’production’
ExecStart=/usr/bin/yarn start
Restart=always

[Install]
WantedBy=multi-user.target

nginx.conf

    server {
        proxy_read_timeout 10m;
        server_name anthurie.com;

        #a special location in case don't cache this file can be deleted
        location updater/serversettings.xml {
          expires -1;
          add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
        }

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        #The root/rest will be redirected
        location / {
            proxy_cache             hd_cache;
            proxy_set_header        X-Cache-Status $upstream_cache_status;
            proxy_cache_valid       200 1w;
            proxy_pass              https://localhost:3000;
            proxy_set_header        Host $http_host;
            proxy_buffers           16 8m;
            proxy_buffer_size       2m;
            gzip                    on;
            gzip_vary               on;
            gzip_comp_level         9;
            gzip_proxied            any;
        }
        error_page 404 /404.html;
            location = /40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }


        listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/anthurie.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anthurie.com/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
                                                                                                                                                                                    

I'm running a Java website with a similiar nginx config on this server. Not sure why I'm getting 500 when app appears to be running fine.

$ sudo systemctl status anthurie
● anthurie.service - Service run for reactjs application anthurie.com
   Loaded: loaded (/etc/systemd/system/anthurie.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2021-10-17 17:26:48 EDT; 49min ago
 Main PID: 4908 (node)
   CGroup: /system.slice/anthurie.service
           ├─4908 node /usr/share/yarn/bin/yarn.js start
           ├─4929 /usr/bin/node /var/metaplex/js/node_modules/.bin/cross-env CI=true lerna run start --scope @oyster/common --stream --parallel --scope web
           ├─4936 /usr/bin/node /var/metaplex/js/node_modules/.bin/lerna run start --scope @oyster/common --stream --parallel --scope web
           ├─4950 node /usr/share/yarn/bin/yarn.js run start
           ├─4961 node /usr/share/yarn/bin/yarn.js run start
           ├─4992 /usr/bin/node /var/metaplex/js/node_modules/.bin/npm-run-all --parallel watch watch-css watch-css-src
           ├─5010 /usr/bin/node /var/metaplex/js/packages/web/node_modules/.bin/next dev
           ├─5016 /usr/bin/node /usr/share/yarn/bin/yarn.js run watch
           ├─5017 /usr/bin/node /usr/share/yarn/bin/yarn.js run watch-css
           ├─5023 /usr/bin/node /usr/share/yarn/bin/yarn.js run watch-css-src
           ├─5061 /usr/bin/node /var/metaplex/js/node_modules/.bin/tsc --watch
           ├─5071 /usr/bin/node /home/prego/.yarn/bin/less-watch-compiler src/ src/
           ├─5079 /usr/bin/node /home/prego/.yarn/bin/less-watch-compiler src/ dist/lib/
           └─5255 /usr/bin/node /var/metaplex/js/node_modules/next/node_modules/jest-worker/build/workers/processChild.js

Oct 17 17:27:12 localhost.localdomain yarn[4908]: @oyster/common:         Property 'Bitpie' is missing in type 'import("/var/metaplex/js/node_modules/@solana/wallet-adapter-react/node_mo....WalletName'.
Oct 17 17:27:12 localhost.localdomain yarn[4908]: @oyster/common: src/contexts/wallet.tsx(230,3): error TS2344: Type '"publicKey" | "signTransaction" | "signAllTransactions"' does not sa...vents, any>'.
Oct 17 17:27:12 localhost.localdomain yarn[4908]: @oyster/common:   Type '"signTransaction"' is not assignable to type 'keyof WalletAdapterProps | keyof EventEmitter<WalletAdapterEvents, any>'.
Oct 17 17:27:12 localhost.localdomain yarn[4908]: @oyster/common: src/contracts/token.ts(106,23): error TS2571: Object is of type 'unknown'.
Oct 17 17:27:12 localhost.localdomain yarn[4908]: @oyster/common: 5:27:12 PM - Found 7 errors. Watching for file changes.
Oct 17 17:27:56 localhost.localdomain yarn[4908]: web: event - build page: /
Oct 17 17:27:56 localhost.localdomain yarn[4908]: web: wait  - compiling...
Oct 17 17:28:02 localhost.localdomain yarn[4908]: web: event - compiled successfully
Oct 17 17:29:04 localhost.localdomain yarn[4908]: web: wait  - compiling...
Oct 17 17:29:04 localhost.localdomain yarn[4908]: web: event - compiled successfully

I tried this, but it's only a partial answer or not right for CentOS7. https://serverfault.com/a/320624/439512

I did exactly what it says but it's not right.

$ sudo iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
$ sudo iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

$ curl localhost
  curl: (7) Failed connect to localhost:80; Connection refused
$ curl localhost:8080
  <html>...</html>
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:webcache

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

These two commands will work termporarily but not after restart:

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8080

If you try to save it like this guy says it'll completly break and it won't even work temperarily:

$ sudo systemctl enable iptables
$ sudo service iptables save
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
$ sudo iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 80 -j REDIRECT --to-ports 8080
$ sudo service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

Does anyone have a working example on how to do this?

I was getting this error when running systemctl restart tomcat in my $CATALINA_HOME/logs/catalina.out log file: https://pastebin.com/Cpfs9xCk

So I followed this post online: https://confluence.atlassian.com/confkb/permission-denied-error-when-binding-a-port-290750651.html

5. If using Linux 2.6.24 or later, you can set up a file capability on the java executable, to give elevated privileges to allow opening privileged ports only, and no other superuser privileges:

setcap cap_net_bind_service+ep /path/to/bin/java After setting this you may notice errors when starting Java like this, for example:

$ java -version /path/to/bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory This means that the library is being imported from a dynamic path, and not in the trusted ld.so path. See http://bugs.sun.com/view_bug.do?bug_id=7157699 for details. To fix this, you need to locate the library, and add its path to the ld.so configuration. Note that the below is an example, and this may differ depending on Linux distribution. Replace JAVA_HOME with the correct location:

$ find JAVA_HOME -name 'libjli.so' JAVA_HOME/lib/amd64/jli/libjli.so
echo "JAVA_HOME/lib/amd64/jli" > /etc/ld.so.conf.d/java-libjli.conf ldconfig -v After setting this all up, you need to make sure that Confluence only starts java with the direct binary path, and not via a symbolic link, otherwise the capability will not be picked up.

So I ran this command: setcap cap_net_bind_service+ep /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64

And I'm getting what it says I might get:

 $CATALINA_HOME/logs/catalina.out 
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory

I did what they said to fix it but it's still not working and I'm still getting the above error:

$ find $JAVA_HOME -name 'libjli.so'
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/jre/lib/amd64/jli/libjli.so
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/lib/amd64/jli/libjli.so

I have two of these for some reason. I created this file with the paths, but I'm still getting the error and my tomcat isnt starting.

$ cat /etc/ld.so.conf.d/java-libjli.conf
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/jre/lib/amd64/jli
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/lib/amd64/jli

How can I get systemctl status tomcat to return 'success' instead of 'failed'?

This is my etc/systemd/system/tomcat.service file:

    [Unit]
Description=Apache Tomcat Web Application Container
After=syslog.target network.target

[Service]
Type=forking

Environment=JRE_HOME=JAVA_HOME='/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.161-0.b14.el7_4.x86_64/'
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_BASE=/opt/tomcat
#Environment='CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC'
Environment='JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom'

ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/bin/kill -15 $MAINPID

User=tomcat
Group=tomcat

[Install]
WantedBy=multi-user.target

now when i check the status of my tomcat it says

# systemctl status tomcat
● tomcat.service - Apache Tomcat Web Application Container
   Loaded: loaded (/etc/systemd/system/tomcat.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2019-08-10 14:03:10 EDT; 55min ago
 Main PID: 22165 (code=exited, status=127)

Aug 10 14:03:10 localhost.localdomain kill[22167]: -q, --queue <sig>      use sigqueue(2) rather than kill(2)
Aug 10 14:03:10 localhost.localdomain kill[22167]: -p, --pid              print pids without signaling them
Aug 10 14:03:10 localhost.localdomain kill[22167]: -l, --list [=<signal>] list signal names, or convert one to a name
Aug 10 14:03:10 localhost.localdomain kill[22167]: -L, --table            list signal names and numbers
Aug 10 14:03:10 localhost.localdomain kill[22167]: -h, --help     display this help and exit
Aug 10 14:03:10 localhost.localdomain kill[22167]: -V, --version  output version information and exit
Aug 10 14:03:10 localhost.localdomain kill[22167]: For more details see kill(1).
Aug 10 14:03:10 localhost.localdomain systemd[1]: tomcat.service: control process exited, code=exited status=1
Aug 10 14:03:10 localhost.localdomain systemd[1]: Unit tomcat.service entered failed state.
Aug 10 14:03:10 localhost.localdomain systemd[1]: tomcat.service failed.



Caused by: java.net.ConnectException: Connection refused (Connection refused)

I got this error trying to run sudo certbot --apache

Error while running apachectl graceful.

Job for httpd.service invalid.

Unable to restart apache using ['apachectl', 'graceful']
Error while running apachectl restart.

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

Encountered exception during recovery: 
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/certbot/error_handler.py", line 124, in _call_registered
    self.funcs[-1]()
  File "/usr/lib/python2.7/site-packages/certbot/auth_handler.py", line 220, in _cleanup_challenges
    self.auth.cleanup(achalls)
  File "/usr/lib/python2.7/site-packages/certbot_apache/configurator.py", line 2332, in cleanup
    self.restart()
  File "/usr/lib/python2.7/site-packages/certbot_apache/configurator.py", line 2202, in restart
    self._reload()
  File "/usr/lib/python2.7/site-packages/certbot_apache/configurator.py", line 2229, in _reload
    raise errors.MisconfigurationError(error)
MisconfigurationError: Error while running apachectl restart.

Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

This is my journalctl -xe: https://pastebin.com/JvJ8Uej0 This is my journalctl -b -u tomcat: https://pastebin.com/zPqEBGXH

Tried killing proccess but dont work none:

# kill 23656
bash: kill: (23656) - No such process

What may be the cause this? How do I fix these error? The website is working fine but I'm getting these errors.