Drupal with Azure Database for MariaDB is no longer working inside private vnet

panneer.subramanian 2020-10-14 06:27:37 UTC #1

Keywords: Drupal - Microsoft Azure - Technical issue - Other
Description:
I have been using "Drupal with Azure Database for MariaDB" from Azure Marketplace to run a Drupal instance in Azure inside private vnet without public IP, which was working successfully until couple of weeks ago.

When I try to re-provision the resource in the same private vnet, now the VM is created but deployment stuck in "setupMachine" state.

I see following errors in first boot logs, which prevents drupal from starting up now. Please Assist:

2020-10-14T06:04:37.728Z - warn: Unable to run recipe download-database-ssl
Error:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
^M  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0^M  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to www.digicert.com:443

    at Object.runProgram (/opt/bitnami/nami/node_modules/provisioner/node_modules/nami-utils/lib/os/run-program.js:223:14)
    at utils.retry (evalmachine.<anonymous>:32:21)
    at Object.<anonymous> (/opt/bitnami/nami/node_modules/provisioner/lib/utils.js:39:26)
    at Generator.next (<anonymous>)
    at fulfilled (/opt/bitnami/nami/node_modules/provisioner/lib/utils.js:4:58)
    at <anonymous>

and then later,

2020-10-14T06:04:38.564Z - trace: recipeRunner: Awaiting pending async promise welcome-message-create
/opt/bitnami/nami/node_modules/provisioner/lib/download.js:68
                    throw new Error(`HTTP request returned ${this.statusCode} HTTP status code`);
                    ^

Error: HTTP request returned 470 HTTP status code
    at IncomingMessage._response.on (/opt/bitnami/nami/node_modules/provisioner/lib/download.js:68:27)
    at emitNone (events.js:111:20)
    at IncomingMessage.emit (events.js:208:7)
    at endReadableNT (_stream_readable.js:1064:12)
    at _combinedTickCallback (internal/process/next_tick.js:139:11)
    at process._tickCallback (internal/process/next_tick.js:181:9)

Did something change recently?

jota 2020-10-14 14:26:56 UTC #2

Hi @panneer.subramanian,

Thank you for using our solution and sorry for the inconvenience. Our recipe downloads the CA certificates from these URLs
- https://www.digicert.com/CACerts/BaltimoreCyberTrustRoot.crt.pem
- https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem

They both are working properly now but it seems they were not when you re-provision the resource. Did you try to redeploy the solution again? You shouldn't find that error unless the website goes down again.

panneer.subramanian 2020-10-14 20:59:53 UTC #3

Thanks @jota

We are trying to deploy this VM inside the private subnet, with no public IP as this is for an internal facing CMS.

Is there a way to configure the image to access these urls either via proxy or reference local path (where we can copy files) ?

panneer.subramanian 2020-10-15 05:44:33 UTC #4

We whitelisted the digicert in our firewall and no longer getting error when downloading receipe recipe download-database-ssl.

However, the deployment is still stuck in the last step:

2020-10-14T06:04:38.564Z - trace: recipeRunner: Awaiting pending async promise welcome-message-create
/opt/bitnami/nami/node_modules/provisioner/lib/download.js:68
throw new Error(HTTP request returned ${this.statusCode} HTTP status code);
^

Error: HTTP request returned 470 HTTP status code
at IncomingMessage.response.on (/opt/bitnami/nami/nodemodules/provisioner/lib/download.js:68:27)
at emitNone (events.js:111:20)
at IncomingMessage.emit (events.js:208:7)
at endReadableNT (streamreadable.js:1064:12)
at combinedTickCallback (internal/process/nexttick.js:139:11)
at process.tickCallback (internal/process/nexttick.js:181:9)

Our firewall logs indicates its trying to call myip.bitnami.com. Does this needs to be opened up as well?

jota 2020-10-15 10:17:13 UTC #5

Hi @panneer.subramanian

Yes, the recipe that is failing now is trying to generate the welcome message you obtain when accessing the application using SSH. That message contains the IP information and we use myip.bitnami.com to obtain the public IP of the instance. You will need to allow the connections to that domain as well (and http://myip2.bitnami.com).

The solution is not intended to be launched in a private network without a public IP (or external facing interface), that's why you are getting those errors. If you allow the connections of those domains that are required when launching the solution, it should work properly later but we've not tested that scenario.

Let us know if you have any other quesitons

panneer.subramanian 2020-10-15 21:04:23 UTC #6

Thanks for the clarification, its working now.

We would like to allow the public traffic to Drupal VM via APP Gateway, hence VM is being provisioned without Public IP here. It would be great if the multi-tier solution can accommodate this use-case in near future.

jota 2020-10-16 09:08:02 UTC #7

I'm glad to hear that.

I'll share this feedback with the Engineering team so they can properly evaluate it.

Have a good weekend!

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!