/usr/local/etc/rc.d/minio needs to set MINIO_SERVER_URL before launching minio service
Description
Problem/Justification
Impact
Activity
Michelle Johnson April 5, 2022 at 12:58 PM
https://github.com/truenas/middleware/pull/8031 PR addresses Minio web console and TLS cert. Might need to document or include in the MinIO article.
Wolf Noble December 26, 2021 at 8:46 PM
it looks like another viable option is to expand the variable list, and ui elements enough to be able to declare the admin portal, and the (externally facing API) endpoint independently, thus facilitating having the admin interface on one address/port using one cert, and the endpoint using another ip/port/cert tuple...
That feels a little cleaner to me in that it's not adding unnecessary tech into the stack, and is really just passing options through to the underlying minio binary... but shrug
Wolf Noble December 19, 2021 at 6:15 PM
I really don't think the best thing to do is to claim 0.0.0.0:9000 silently.
There's a lot of opportunity for fail here and not enough upside to warrant the pain.
(remember that in some cases you're likely to be sharing a host IP stack with a near full kubestack operating, and so 0.0.0.0:9000 becomes a much larger target)
Samuel Tai December 18, 2021 at 10:00 PM(edited)
To get this working, I had to add:
to /usr/local/etc/rc.d/minio, starting at line 54.
I also had to comment out the /etc/hosts entries corresponding to my TrueNAS server name; otherwise, I'd get the error "Post "https://raven.local:9000/": dial tcp 127.0.0.1:9000: connect: connection refused" on login. (This is because I'd restricted the bind IP in the GUI. Defaulting the bind IP to 0.0.0.0 allows for the /etc/hosts entries to work.)
This allows for login using the access key and secret key. However, once in the MinIO browser, clicking the Logs entry on the left reveals the error message:
WARNING: MINIO_ACCESS_KEY and MINIO_SECRET_KEY are deprecated. Please use MINIO_ROOT_USER and MINIO_ROOT_PASSWORD
To get around this, I added:
According to https://docs.min.io/docs/minio-quickstart-guide.html, the MinIO web console now expects the server certificate to include IP SANs, and will fail logins if these are absent. The recommended work-around is to set the environment variable MINIO_SERVER_URL to match the certificate's CN, i.e., "https://" + `midclt call certificate.query | jq | grep common | cut -d'"' -f4` + "${minio_address}".
As things stand, the MinIO web console is completely inaccessible, using the self-generated cert.