Dear Aaron you should read my posts more carefully and not only get rid of users. or treat everyone like blondes.
You are a volunteer moderator, great. please pass it to gl-inet staff. Who can give sensible answers.
I would like to mention that in my previous posts I raised the issue of paid support.
Personally, I would gladly pay for a solution of my problem and get it rid off my head. I think many users would do it too, I think that the company should think about it.
there are many solutions.
- first tier free and access to the knowledge base (this forum) and tips on where to look for it (yours for example, thank you for your answers Arron you are very helpful.)
- 2nd tier annual subscription or micropayments (specific tips on solving problems but still on a DIY basis).
- 3rd tier contract for one-time remote access, the user provides ssh login data and after completing the task is obliged to change passwords.
I am a hobbyist and looking for solutions on my own takes me too much time. do something about it.....
In my previous posts, I described why I gave up on GL-inet firmware and migrated to Openwrt and why it is important to me.
I think that I'm not alone, currently many people want to host their resources themselves, e.g. photos 9 Best Self Hosted Photo Backup Alternatives to Google Photos [2025]
On the sidelines - I noticed that Gl-inet wrote an installation script for Home Assistant GitHub - gl-inet/home-assistant-on-openwrt , does it work ( it was last updated 6 years ago ) ? I wonder if the installation is problem-free and what the integration with the web page looks like and whether it is possible to connect home assistant as a subdomain or a new domain in the home network
I think that many customers would pay for HA setup for personalized support.
Ok, but let's get back to my problem.
I have installed Flint 2 4.7.0-op24 firmware, by default in this firmware NGNIX is compiled:
nginx version: nginx/1.26.1 (x86_64-pc-linux-gnu)
built with OpenSSL 3.0.15 3 Sep 2024
TLS SNI support enabled
configure arguments: --target=aarch64-openwrt-linux
--host=aarch64-openwrt-linux
--build=x86_64-pc-linux-gnu --disable-dependency-tracking
--program-prefix= --program-suffix= --prefix=/usr
--exec-prefix=/usr --bindir=/usr/bin
--sbindir=/usr/sbin --libexecdir=/usr/lib
--sysconfdir=/etc
--datadir=/usr/share --localstatedir=/var
--mandir=/usr/man --infodir=/usr/info --disable-nls --crossbuild=Linux::aarch64 --prefix=/usr
--conf-path=/etc/nginx/nginx.conf --modules-path=/usr/lib/nginx/modules --error-log-path=stderr
--pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock
--http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body
--http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--with-cc=aarch64-openwrt-linux-musl-gcc --with-ld-opt='-L/home/jk/workspace/router_mt6000_op/openwrt-24/staging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/usr/lib -L/home/jk/workspace/router_mt6000_op/openwrt-24/staging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/lib -fuse-ld=bfd -Wl,--gc-sections -flto=auto -fuse-linker-plugin -znow -zrelro' --without-http_upstream_zone_module --with-compat --with-http_ssl_module --without-http-cache --without-http_charset_module --without-http_gzip_module --without-http_ssi_module --without-http_userid_module --without-http_access_module --without-http_auth_basic_module --without-http_autoindex_module --without-http_geo_module --without-http_map_module --without-http_split_clients_module --without-http_referer_module --without-http_scgi_module --without-http_memcached_module --without-http_limit_conn_module --without-http_limit_req_module --without-http_empty_gif_module --without-http_browser_module --without-http_upstream_hash_module --without-http_upstream_ip_hash_module --without-http_upstream_least_conn_module --without-http_upstream_keepalive_module --with-ipv6 --with-http_gzip_static_module --add-dynamic-module=/home/jk/workspace/router_mt6000_op/openwrt-24/build_dir/target-aarch64_cortex-a53_musl/nginx-ssl/nginx-1.26.1/nginx-mod-lua
--add-dynamic-module=/home/jk/workspace/router_mt6000_op/openwrt-24/build_dir
/target-aarch64_cortex-a53_musl/nginx-ssl/nginx-1.26.1/nginx-mod-ubus
It's a very limited version of ngnix I don't understand the company's intentions here - security????? bull!!! .
If we're talking about security, then without compiling ngx_http_access_module you can't use the directive allow,deny. Mostly used for security purposes. I use those directives in all internal pages that I want to reserve for only LAN usage:
allow fc00::/7;
allow fec0::/10;
allow fe80::/10;
allow 127.0.0.0/8;
allow 172.16.0.0/12;
allow 192.168.0.0/16;
allow 169.254.0.0/16;
deny all;
Ok, I removed the deny, allow directives from all of my configuration files to check if I can use NGINX and all the goodness of GL-inet because maybe in the future I will be tempted by astro-warp and it is not worth giving up right away
Here is My Ngnix configuration which was worked :
user root;
worker_processes auto;
#include /etc/nginx/module.d/*.module;
#load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;
#load_module /usr/lib/nginx/modules/ngx_stream_module.so;
# below orig
load_module /usr/lib/nginx/modules/ngx_http_lua_module.so;
load_module /usr/lib/nginx/modules/ngx_http_ubus_module.so;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
lua_package_path "/usr/lib/lua/?.lua;;";
default_type application/octet-stream;
sendfile on;
keepalive_timeout 5;
gzip_static on;
root /www;
access_log off;
error_log /var/log/nginx/error.log error;
# added by wojt
log_format openwrt
'$request_method $scheme://$host$request_uri => $status'
' (${body_bytes_sent}B in ${request_time}s) <- $http_referer';
log_format custom '$remote_addr - $remote_user [$time_local] "$request" '
'status=$status body_bytes_sent=$body_bytes_sent '
'"$http_user_agent" "$http_authorization"';
#log_format upstream '$remote_addr - Upstream: $upstream_addr Cache: $upstream_cache_status | Bytes Sent: $upstream_bytes_sent';
server_names_hash_bucket_size 64;
gzip_vary on;
gzip_proxied any;
#gzip_buffers 16 8k;
#---------- SSL-------------
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!LOW:!DES:!MD5:!PSK:!RC4:!3DES:!EXP:!SRP:!DSS;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 20m;
ssl_session_tickets on;
ssl_buffer_size 4k;
ssl_stapling on;
ssl_stapling_verify on;
resolver 127.0.0.1 valid=300s;
resolver_timeout 5s;
ssl_prefer_server_ciphers on;
#----------------------------------------
#map $http_accept_language $lang {
# default en; # Default language
# ~*pl pl;
# }
#--------- buffers config ------------------
proxy_buffering on;
proxy_temp_path /var/cache/nginx 1 2;
proxy_temp_file_write_size 512k;
proxy_max_temp_file_size 512k;
proxy_buffer_size 128k;
proxy_buffers 128 128k;
proxy_busy_buffers_size 256k;
#client_body_buffer_size 128k;
proxy_read_timeout 300s;
proxy_send_timeout 300s;
#---------------- end of wojt add
client_body_buffer_size 64K;
client_header_buffer_size 1k;
client_max_body_size 1G;
large_client_header_buffers 2 2k;
lua_shared_dict shmem 12k;
lua_shared_dict nonces 16k;
lua_shared_dict sessions 16k;
init_by_lua_file /usr/share/gl-ngx/oui-init.lua;
include /etc/nginx/conf.d/*.conf;
}
Here is my /etc/nginx/conf.d/gl.conf which as well were worked :
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name router.wojciech.lol;
index gl_home.html;
# SSL settings
ssl_certificate /etc/ssl/acme/default.wojciech.lol/fullchain.pem;
ssl_certificate_key /etc/ssl/acme/default.wojciech.lol/privkey.pem;
access_log /var/log/nginx/router_access.log custom;
root /www;
include conf.d/error-pages.location;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:DHE+AESGCM:DHE:!RSA!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SR P:!DSS:!CAMELLIA:!SEED";
ssl_session_tickets off;
#ssl_certificate /etc/nginx/nginx.cer;
#ssl_certificate_key /etc/nginx/nginx.key;
resolver 127.0.0.1 ipv6=off;
rewrite ^/index.html / permanent;
location = /rpc {
content_by_lua_file /usr/share/gl-ngx/oui-rpc.lua;
add_header Content-Type application/json;
add_header X-Frame-Options DENY;
}
location = /ws {
add_header X-Frame-Options DENY;
content_by_lua_file /usr/share/gl-ngx/oui-ws.lua;
}
location = /upload {
add_header X-Frame-Options DENY;
content_by_lua_file /usr/share/gl-ngx/oui-upload.lua;
}
location = /download {
add_header X-Frame-Options DENY;
content_by_lua_file /usr/share/gl-ngx/oui-download.lua;
}
location /cgi-bin/ {
add_header X-Frame-Options DENY;
include fastcgi_params;
fastcgi_read_timeout 300;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
}
location ~.*\.(html|png|jpg|svg)$ {
add_header Cache-Control "private, no-store, no-cache, must-revalidate, proxy-revalidate";
add_header X-Frame-Options DENY;
}
# ----------- added-----
location ~ ^/terminal(.*)$ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
#proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900s;
proxy_pass http://127.0.0.1:7683/$1;
proxy_intercept_errors on;
}
location ~ ^/small-pit(.*)$ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
#proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900s;
proxy_pass http://192.168.1.5:7683/$1;
proxy_intercept_errors on;
}
#------------------------------
include /etc/nginx/gl-conf.d/*.conf;
}
Redirection of ttyd service (port 7683) worked and my additional domains movies and gallery as well. Also worked GL-inet android app. That's why I decided to go further because I need a full NGNIX server
to use with proxy caching and in the future rtmp and camera stream integration. this is my router - no compromises...
I decided to install ngnix-full from the same kernel version from the openwrt distribution. GL-inet feeds currently do not allow upgrade NGINX webserver
I added to /etc/opkg/customfeeds.conf the equivalent of GL-inet packages
src/gz openwrt_packages https://downloads.openwrt.org/releases/24.10.0-rc2/packages/aarch64_cortex-a53/packages/
and downloaded:
opkg download package_name
here are list of all downloaded packages :
libubus20250102_2025.01.02~afa57cce-r1_aarch64_cortex-a53.ipk
nginx-full_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-headers-more_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-lua-resty-core_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-lua-resty-lrucache_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-lua_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-njs_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-rtmp_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-stream_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-ts_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-mod-ubus_1.26.1-r1_aarch64_cortex-a53.ipk
nginx-ssl_1.26.1-r1_aarch64_cortex-a53.ipk
I made copies of all replaced binary files.Binaries extracted from the archives were copied into the appropriate source path.
I had problem with dependiences so downloaded and added manually additional global library libubus.so.20250102
I didn't installed lua-resty*, just compared . all sources are the same.
below is dump of ngnix-full config flags :
nginx version: nginx/1.26.1 (x86_64-pc-linux-gnu)
built with OpenSSL 3.0.15 3 Sep 2024
TLS SNI support enabled
configure arguments: --target=aarch64-openwrt-linux --host=aarch64-openwrt-linux
--build=x86_64-pc-linux-gnu --disable-dependency-tracking --program-prefix= --program-suffix=
--prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --sysconfdir=/etc
--datadir=/usr/share --localstatedir=/var --mandir=/usr/man --infodir=/usr/info --disable-nls
--crossbuild=Linux::aarch64 --prefix=/usr --conf-path=/etc/nginx/nginx.conf --modules-path=/usr/lib/nginx/modules --error-log-path=stderr --pid-path=/var/run/nginx.pid
--lock-path=/var/lock/nginx.lock --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body
--http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--with-cc=aarch64-openwrt-linux-musl-gcc --with-ld-opt='-L/builder/shared-workdir/build/sdk/staging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/usr/lib -L/builder/shared-workdir/build/sdk/staging_dir/toolchain-aarch64_cortex-a53_gcc-13.3.0_musl/lib -fuse-ld=bfd
-Wl,--gc-sections -flto=auto -fuse-linker-plugin -znow -zrelro'
--without-http_upstream_zone_module --with-compat
--with-http_ssl_module --with-ipv6 --with-http_gzip_static_module --with-http_stub_status_module --with-http_flv_module --with-http_dav_module
--with-http_auth_request_module --with-http_v3_module --with-http_v2_module --with-http_realip_module --with-http_secure_link_module --with-http_sub_module
--with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-naxsi/naxsi_src
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-njs/nginx
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-geoip2
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-lua
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-rtmp
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-dav-ext
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-brotli
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-headers-more
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-ts
--add-dynamic-module=/builder/shared-workdir/build/sdk/build_dir/target-aarch64_cortex-a53_musl/nginx-full/nginx-1.26.1/nginx-mod-ubus
Situation after manual NGNIX upgrade
all of my websites works including ttyd redirection but gl-inet main website not works I have http 500 error you can check it typing router.wojciech.lol
In logs I have :
2025/02/16 19:58:23 [error] 2541#0: *125 lua entry thread aborted: runtime error: /usr/lib/lua/resty/core/var.lua:71: no request found
stack traceback:
coroutine 0:
[C]: in function 'error'
/usr/lib/lua/resty/core/var.lua:71: in function '__index'
/usr/share/gl-ngx/oui-access.lua:27: in function </usr/share/gl-ngx/oui-access.lua:1>, client: fdb4:1b76:5d22:0:a0e7:44cf:bb43:c856, server: router.wojciech.lol, request: "GET /favicon.ico HTTP/1.1", host: "router.wojciech.lol", referrer: "https://router.wojciech.lol/"
this error is repeated for every page request.
How to solve it ?
I will describe my comments and thoughts on this situation in another post
.... there is no clear answer they refer to support and support will answer when there is a contract...
. However, there is no possibility of resigning from the contract router, so my contract router lies in the cabinet unpacked.