I’m trying to setup a passive roaming with TTN and have gone through the steps on their site and emails with johan for signing and the certs for them.
I have generated the certs as per the instructions given but on pulling up the containers chirpstack dies with an error, yet the certs are there and populated… is it a permissions or owner thing?
2023-10-27T08:20:10.258204Z INFO chirpstack::api::backend: Setting up backend interfaces API bind=0.0.0.0:8181
thread 'tokio-runtime-worker' panicked at 'error binding to 0.0.0.0:8181: key contains no private key', /cargo/registry/src/index.crates.io-6f17d22bba15001f/warp-0.3.5/src/server.rs:534:27
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: task 23 panicked
Interestingly if i replace the server.key with one thats generated for the mqtt server i do not get this error, is the key type generated for pb not compatible with the rust library used on v4?
I do use a domain level reverse proxy (Nginx Proxy Manager) with letsencrypt certs.
I created all the files on this page:
as i reverse proxy so I dont know what certificates it really wants here if i didnt generate the ones it says not too as it seems to want self signed you need to make during the process it says to skip if you use letsencrypt.
Hum just thinking out aloud backend interface on 8181 it servers TLS based on certs for Roaming JS etc. So it doesn’t need a reverse proxy. So given error is it worth converting just the .key to xxx-key.pem & try that.
i adjusted the above to generate 5 year certs - but they’re not signed by the ttn ca.
with them if a ttn packet arrives i get a 401 unauthorised so im stuck atm knowing how to generate compatible certs with the existing ttn ca using the cfssl tool.
If anyone is familiar with how to do this please let me know
2023-10-27T22:46:23.229011Z INFO chirpstack::api::backend: Setting up backend interfaces API bind=0.0.0.0:8181
thread 'tokio-runtime-worker' panicked at 'error binding to 0.0.0.0:8181: key contains no private key', /cargo/registry/src/index.crates.io-6f17d22bba15001f/warp-0.3.5/src/server.rs:534:27
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: task 22 panicked
Unfortunately this didn’t seem to work for me.
anything generated with EC even after conversion just fails or chirp says it doesn’t exist or no private key like the error above even though the file is there and mapped.
Will have to revisit later as i’m really at a loss here as to why this is the case.
I just generated them all in rsa 4096 and they seem to work without crashing.
I can try grab the ones in my reverse proxy container but figured this would be easier.
I have the exact same setup now and it still errors. i dont know what to do from here.
do you have a netid assigned to your instance? I have a helium netid i wonder if this is causing problems somehow but its only supposed to be a forwarder etc for ttn on 000000 to 000013.
using certs generated as RSA was key though as warp.rs just shits itself if they’re not coded that way.
how does it setup the passive roaming interface?
Is there anywhere to setup a join server and prefix?
from what i can tell it seems to join here
cory@dred:~/chirpstack-docker$ docker logs -f chirpstack-docker-chirpstack-1 | grep https://apac.packetbroker.io:5138
2023-10-31T10:14:00.708591Z INFO setup{net_id=000013}: chirpstack::backend::roaming: Configuring roaming client passive_roaming_lifetime=0ns server=https://apac.packetbroker.io:5138 async_timeout=30s
--
2023-10-31T10:27:00.463034Z INFO up{deduplication_id=aebde3a3-363d-46b5-a4a9-f526165a4210}:join_request: chirpstack::uplink::join: Unknown device, trying passive-roaming activation dev_eui=70b3d5499e39ba23 join_eui=70b3d57ef0005f34
2023-10-31T10:27:00.463137Z ERROR up{deduplication_id=aebde3a3-363d-46b5-a4a9-f526165a4210}: chirpstack::uplink::join: Handle join-request error error=Join Server client for join_eui 70b3d57ef0005f34 does not exist
but then any devices trying to join ttn just error still
cory@dred:~/chirpstack-docker$ docker logs -f chirpstack-docker-chirpstack-1 | grep ERROR
2023-10-31T10:14:18.449555Z ERROR up{deduplication_id=718a27ba-ae31-4e1f-ac0a-b4013f60a000}: chirpstack::uplink::join: Handle join-request error error=Join Server client for join_eui 70b3d57ef0005f34 does not exist
2023-10-31T10:14:33.445876Z ERROR up{deduplication_id=af8d7df7-33a3-4502-ba43-cc0be6e08740}: chirpstack::uplink::join: Handle join-request error error=Join Server client for join_eui 70b3d57ef0005f34 does not exist
2023-10-31T10:14:48.447630Z ERROR up{deduplication_id=4232cea1-0aef-4bf8-8b7d-bc743decde2e}: chirpstack::uplink::join: Handle join-request error error=Join Server client for join_eui 70b3d57ef0005f34 does not exist
2023-10-31T10:15:03.442469Z ERROR up{deduplication_id=92556a3c-8979-493c-b9fe-e755ead7114c}: chirpstack::uplink::join: Handle join-request error error=Join Server client for join_eui 70b3d57ef0005f34 does not exist
As far as I know, join-requests are currently not roamed, this is a limitation. Only data frames with a foreign netid (netid from devid != own netid) will be roamed.
We added a gw to ttn so it would join the device, once joined now its throwing a 403 on the passive roaming url. Is the forward slash being added in the backend causing this issue perhaps?
2023-10-31T11:52:03.410177Z INFO up{deduplication_id=6a71dda4-db98-4f9f-b71e-3b64a104fe5e}:data_up:data_pr: chirpstack::uplink::data_fns: Starting passive-roaming session net_id=000013 dev_addr=260dd21c
2023-10-31T11:52:04.073046Z ERROR up{deduplication_id=6a71dda4-db98-4f9f-b71e-3b64a104fe5e}:data_up:data_pr: chirpstack::uplink::data_fns: Start passive-roaming error net_id=000013 error=HTTP status client error (403 Forbidden) for url (https://apac.packetbroker.io:5138/)
2023-10-31T11:55:43.175186Z INFO up{deduplication_id=3919869e-e565-445b-9c50-db7dcd99d5e6}:data_up:data_pr: chirpstack::uplink::data_fns: Starting passive-roaming session net_id=000013 dev_addr=260dd21c
2023-10-31T11:55:43.926031Z ERROR up{deduplication_id=3919869e-e565-445b-9c50-db7dcd99d5e6}:data_up:data_pr: chirpstack::uplink::data_fns: Start passive-roaming error net_id=000013 error=HTTP status client error (403 Forbidden) for url (https://apac.packetbroker.io:5138/)
2023-10-31T11:59:23.452357Z INFO up{deduplication_id=2911c98f-0ef1-4d41-9b14-f6af95397ecc}:data_up:data_pr: chirpstack::uplink::data_fns: Starting passive-roaming session net_id=000013 dev_addr=260dd21c
2023-10-31T11:59:23.840098Z ERROR up{deduplication_id=2911c98f-0ef1-4d41-9b14-f6af95397ecc}:data_up:data_pr: chirpstack::uplink::data_fns: Start passive-roaming error net_id=000013 error=HTTP status client error (403 Forbidden) for url (https://apac.packetbroker.io:5138/)
Just been going back and forth with johan, the other issue is that i have a netid set on the instance that they dont want to route (00003c) so that maybe the 403 error perhaps as there may have been a misunderstanding on my part on how it works on their end - was assuming it would send all ttn stuff to them if it seen it.
another handy feature would be the ability to set netid per tenant. the multi region saved us for a bit but it seems we’re needing to run multiple instances to get around the netid’s now
