Run your private The Things Stack network server on a Raspberry Pi with balena

@Lukas you are right, potentially there is a problem with the certificate.

If you check here the-things-stack-balena/entrypoint.sh at 5038bb91cd0d5eaf56cb256211a7911108ee8705 · xoseperez/the-things-stack-balena · GitHub you can see how the TC_TRUST variable is generated. Actually the ca.pem is generated here (if i’m not wrong) → the-things-stack-balena/entrypoint.sh at 5038bb91cd0d5eaf56cb256211a7911108ee8705 · xoseperez/the-things-stack-balena · GitHub

On the other hand, the basicstation TC_TRUST is generated here → basicstation/start_common.sh at 04a95fef320c46ff4cf89004edd543653d35dac6 · mpous/basicstation · GitHub

Try to make the TC_TRUST from basicstation similar than the The Things Stack using the TC_TRUST Device Variable from the balenaCloud dashboard on the basicstation fleet.

Let me know if that works!

Hi @mpous,
I am still working with the private TTS stack and the Balena environment as described in previous discussions here.

I am now about to use the TTS stack not only in the basic configuration, I would like to make it a FUOTA server as described here:
[https://www.thethingsindustries.com/news/introducing-the-firm-update-over-the-air-fuota-feature-for-lorawan-devices-using-the-things-stack/]

For this I connect to the balena cli via ssh to the stack service and after that I would like to work with the commands of ttn-lw-cli.

But somehow I’m not authorized to do this commands:

/ $ ttn-lw-cli end-devices create fota mcdev \
>   --frequency-plan-id EU_863_870 \
>   --lorawan-version 1.0.3 \
>   --lorawan-phy-version 1.0.3-a \
>   --session.dev-addr 01FFFFFF \
>   --session.keys.app-s-key.key f7d9667acd8eb1dde380751a8593eaec \
>   --session.keys.nwk-s-key.key ff701d8368a4c6586048ffa29d8ae010 \
>   --multicast \
>   --supports-class-c
Flag --session.keys.nwk-s-key.key has been deprecated, use the session.keys.f_nwk_s_int_key.key flag
error:cmd/ttn-lw-cli/commands:unauthenticated (not authenticated with either API key or OAuth access token)

Then I tried the ttn-lw-cli login command but however, the ttn-lw-cli login command does not work:

/ $ ttn-lw-cli login
  INFO Opening your browser on https://localhost/oauth/authorize?client_id=cli&redirect_uri=local-callback&response_type=code
  WARN Could not open your browser, you'll have to go there yourself error=exec: "xdg-open,x-www-browser,www-browser": executable file not found in $PATH
  INFO After logging in and authorizing the CLI, we'll get an access token for future commands.
  INFO Waiting for your authorization...

Do you have a idea how to authorize these commands from the balena enviroment?

Best regards
Corsin Obrist

1 Like

@Balena_Obrist interesting! to be honest i’ve never installed the FUOTA feature!

@xoseperez what do you recommend here to install FUOTA and get the right certificates on the TTS on the Pi?

@mpous have you ever tried to run a command in the ttn-lw-cli? Do you get the same error message?

@Balena_Obrist let me try to deploy the project again and test!

Are you running only the The Things Stack or TTS + basicstation?

Hi @mpous ,

I also have a NodeRED service running which communicates via MQTT with the application service. But this should’t effect the The Things Stack CLI.

Thanks for the clarification! it was just to understand your project :slight_smile:

Big thanks for trying it! :slight_smile:

I’m trying ttn-lw-cli login and then the error when trying to open a website

  INFO Opening your browser on https://localhost/oauth/authorize?client_id=cli&redirect_uri=local-callback&response_type=code

if i try to do it manually with the local IP address of the device i get error. What do you get @Balena_Obrist ?

Hello @mpous

I have the same log:

  INFO Opening your browser on https://localhost/oauth/authorize?client_id=cli&redirect_uri=local-callback&response_type=code
  WARN Could not open your browser, you'll have to go there yourself error=exec: "xdg-open,x-www-browser,www-browser": executable file not found in $PATH
  INFO After logging in and authorizing the CLI, we'll get an access token for future commands.
  INFO Waiting for your authorization...

Then entering in the browser this address:

https://192.168.1.111/oauth/authorize?client_id=cli&redirect_uri=local-callback&response_type=code

I got an error.

@mpous
I also tried what is mentioned here:

/ $ ttn-lw-cli login --callback=false
  INFO Opening your browser on https://localhost/oauth/authorize?client_id=cli&redirect_uri=code&response_type=code
  WARN Could not open your browser, you'll have to go there yourself error=exec: "xdg-open,x-www-browser,www-browser": executable file not found in $PATH
  INFO After logging in and authorizing the CLI, we'll get an access token for future commands.
  INFO Please paste the authorization code and press enter

Then you have to go to the browser an type in:
https://<container_ip_address>/oauth/authorize?client_id=cli&redirect_uri=code&response_type=code
for me it was:
https://192.168.1.111/oauth/authorize?client_id=cli&redirect_uri=code&response_type=code
There I could copy the code:

image

But entering this code doesn’t work:

> MF2XI.QM6NQM2FRRPX4RCZNYWLP3OFK4XOLE3EVDATIDQ.7RVJXG5DFSLZXAJFLVFTVUB4VHGLXBFMZ7JSSEKBDABVAGBIZRFQ
 ERROR Could not exchange OAuth access token    error=Post "https://localhost/oauth/token": dial tcp 127.0.0.1:443: connect: connection refused
Post "https://localhost/oauth/token": dial tcp 127.0.0.1:443: connect: connection refused
/ $
1 Like

@mpous

I was able to get a step further:

with the command :

ttn-lw-cli login --api-key=NNSXS.O5UZR........

you will be able to login.

the key can be generated with following command;

ttn-lw-stack is-db create-user-api-key

but after that a other error ouccurs:
trying to user the ttn-lw-cli comamnds, for example this one:

ttn-lw-cli user list

there is an other authentication error:

WARN [core]grpc: addrConn.createTransport failed to connect to {localhost:8884 localhost:8884 <nil> 0 <nil>}. Err: connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority". Reconnecting...
  WARN [core]grpc: addrConn.createTransport failed to connect to {localhost:8884 localhost:8884 <nil> 0 <nil>}. Err: connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority". Reconnecting...
  WARN [core]grpc: addrConn.createTransport failed to connect to {localhost:8884 localhost:8884 <nil> 0 <nil>}. Err: connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority". Reconnecting...
1 Like

yes @Balena_Obrist you are almost there :partying_face:

It’s clear that there is a problem with the certificates

@mpous haha yes but now I’m stuck…
Maybe @xoseperez knows what to do to fix this…
I really need to access the ttn-lw-cli to setup the FUOTA functionality.

1 Like

Hi @mpous @xoseperez

Excuse my intrusive inquiries…
Are there any news regarding the access of the ttn-lw-cli by the balena os?

Best regards
Corsin

Hi @Lukas @mpous
Sorry to interrupt…

I’m trying to run the Basic Station Service on a different Device than the LNS. So the same way you described it here.

My setup it that the Basicstation is on 192.168.1.111 and the LNS on 192.168.1.112.

But im not able to connect the created gateway on the TTS Console with the Balena Basic Station service on 192.168.1.111

The problem is with the trust certificate…

Did you found a soluition?

Best reagards
Corsin

Hi @Balena_Obrist and @mpous
Sorry for the late response. I spend some days away and had some time-critical projects due last week. But now back to the pleasant hobby projects :wink: Unfortunately, copying the TC_TRUST from the TTS device variable into a newly created basicstation TC_TRUST device variable didn’t solve the problem. I’m getting the same error: TLS server certificate verification failed: The certificate Common Name (CN) does not match with the expected CN.
What else could I check?
Best regards,
Lukas

1 Like

@Lukas @Balena_Obrist I can imagine this is because of formatting or some characters.

Could you please share the difference between both certificates?

Hi @mpous, The tutorial/deployment works fine (on a Pi 4) . But when I log in to the web console I get

Internal server error

Request to 2a00:23a8:400a:a600:2120:e480:e699:7396/console/oauth/callback failed

(that’s my IP address in there).
In the logs there is :

stack WARN OAuth error error=error:pkg/errors:request (request to 2a00:23a8:400a:a600:2120:e480:e699:7396/console/oauth/callback failed) error_cause=first path segment in URL cannot contain colon http.method=GET http.path=/oauth/authorize namespace=web peer.address=192.168.1.213:35626 request_id=01G18NTD2FTX2ER5PVYJP8TWJG url=2a00:23a8:400a:a600:2120:e480:e699:7396/console/oauth/callback
stack ERROR Server error duration=26.9ms http.method=GET http.path=/oauth/authorize http.status=500 namespace=web peer.address=192.168.1.213:35626 request_id=01G18NTD2FTX2ER5PVYJP8TWJG

I’m a bit stuck on this. Any suggestions.

Tom

1 Like

Hello @tom_peak welcome to the balena community!

you are using ipv6 right? could you please share a screenshot?

Did you check the troubleshooting section of the blogpost here? Run your private The Things Stack network server on a Raspberry Pi with balena