HPB what is backend URL (sent/read as)

ℹ️ Support 💬 Talk (spreed)
,
1

New built NC server (34.0.1) and HPB, on separate VMs on a dedicated subnet behind its own firewall. Caddy is acting as a proxy for both. NC is has IP 192.168.100.10, HPB IP 192.168.100.11

On HPB in signaling/server.conf:

if allowall = true with secret = mysecret in the section [backend], with matching secret in NC “Shared secret” HPB works, all is good;

if allowall = false, with backends = backend-1, and in [backend-1] with secret = mysecret and url = mync.domain.tld HPB fails with log entry like signaling[107297]: throttle.go:315: Failed attempt on "BackendRoomAuth" from 192.168.100.10.

The URL entry is correct in that

(a) you can reach the NC install on it;

(b) it correctly resolves as the external (firewall) IP from the HPB server (and wget mync.domain.tldfrom HPB server returns the NC home page);

(c) on NC that domain is set both in trusted_domains, overwrite.cli.url and overwritehost;

(d) in the admin page for Talk the domain is correctly reported in “Nextcloud base URL” and the domain part of “Talk Backend URL”.

At this point I’m assuming that somehow NC isn’t sending the correct host but can’t see where I’d additionally set it, or I’ve fundamentally misunderstood the examples given in nextcloud-spreed-signaling/server.conf.in at master · strukturag/nextcloud-spreed-signaling · GitHub.

So what is backend url/urls in [backend-1] supposed to be set to, and how do I ensure that’s what is sent by NC on connection?

Related question: other than the possibility of someone bruteforcing a 48 character randomly generated secret, how big a security concern is using allowall = true?

2

IIRC if you open the console and try to join any conversation, you should see an error message from the HPB which also shows which URL was used to connect to it.

3

Excellent tip, thanks. Seems the misdirection comes from the example in nextcloud-spreed-signaling/server.conf.in at master · strukturag/nextcloud-spreed-signaling · GitHub . The correct address to use wasn’t the FQDN, or at least in my example, it was:

mync.domain.tld/ocs/v2.php/apps/spreed/api/v3/signaling/backend

NB for clarity both in my pre-solution config and in the update above the “url =” (or “urls =”, either seems to work for me) is prepended with the connection i.e. https:// but that seems to get autoformatted as link when posted.

4

Actually that should not be the case, the URL in the example is correct, so it should be “https://mync.domain.tld” (potentially with subdirectory)

5

using the format as suggested in the example does not work in my case. The console showed an error

Could not connect to server using backend url https://mync.domain.tld/ocs/v2.php/apps/spreed/api/v3/signaling/backend Object { id: "1", type: "error", error: {…} } signaling.js:1098:11

and changing the “urls =” from https://mync.domain.tld to https://mync.domain.tld/ocs/v2.php/apps/spreed/api/v3/signaling/backend resolved the issue. So I guess that leaves the question “what sets the backend domain as sent by NC to HPB”