Securing MunkiReport with Let’s Encrypt on Synology DSM

Update, 2020-06-11: I’m now using Synology’s built-in NGINX-based reverse proxy instead. The instructions below may not work.


Continuing my series on using Docker with a Synology NAS, I now have MunkiReport v3 working – and you can, too!

Some background: MunkiReport is a companion project to Munki (which we set up with Squirrel last week). MunkiReport v3 was released recently, and has a huge list of improvements, thanks to a dedicated group of contributors – especially @bochoven and @mosen, who have overhauled large portions of the project. MunkiReport v3 has some new requirements that weren’t present with v2 – this is the perfect use case for Docker! Docker will handle all of this for us.

Briefly, here’s what we’re going to do: we’re going to set up MySQL, Adminer, and MunkiReport using Docker Compose. Then, we’re going to use DSM 6.x’s certificate and reverse proxy support to secure MunkiReport. Let’s go!

  1. Enable SSH to your Synology server. Open the Terminal and connect to your server (I’m using root, but your admin account should also do fine). Leave that open for later.
  2. Install Docker through Package Center, if you don’t already have it.
  3. Add a certificate to DSM. I like Let’s Encrypt – DSM can walk you through the certificate creation process, and will renew it automatically. You’ll need a domain name for this. You might be able to use Synology’s QuickConnect service for this. (I ended up setting up a CNAME for my QuickConnect address with a subdomain that I already own, then used the CNAME for the certificate)
  4. Create a shared folder for your Docker data. I named mine ‘docker’. Create two directories inside of it: ‘MunkiReport’ and ‘MySQL’.
  5. Create a file called ‘docker-compose.yml’ in your ‘docker’ shared folder. Populate it with this data, to start:
version: '3.2'
networks:
default:
driver: bridge
services:
Adminer:
container_name: Adminer
image: adminer
# https://hub.docker.com/_/adminer/
ports:
– "3307:8080"
networks:
– default
restart: on-failure
MunkiReport:
container_name: MunkiReport
image: munkireport/munkireport-php:release-latest
# https://hub.docker.com/r/munkireport/munkireport-php/
volumes:
– /volume1/docker/MunkiReport/config.php:/var/munkireport/config.php:ro
ports:
– "4443:80"
networks:
– default
restart: on-failure
depends_on:
– MySQL
MySQL:
container_name: MySQL
image: mysql:5.7
# https://hub.docker.com/_/mysql/
volumes:
– /volume1/docker/MySQL:/var/lib/mysql:rw
ports:
– "3306:3306"
environment:
– MYSQL_ROOT_PASSWORD=secretpassword
networks:
– default
restart: on-failure
  1. Change line 41, your MySQL root password, to something random. You can also change the port numbers if you’d like, but I’m going to finish this tutorial with the assumption that you haven’t touched those (it can get confusing very quickly).
  2. Switch over to your Terminal window and run these two commands. The first will download the Docker images for Adminer, MunkiReport, and MySQL. The second command will create Docker containers, which contain your custom settings. If you change any of the settings in your docker-compose.yml file, re-running these commands will destroy the Docker containers and recreate them with your new specifications. Pretty cool. You can monitor all of this with the Docker application in DSM.
    /usr/local/bin/docker-compose  -f /volume1/docker/docker-compose.yml pull
    /usr/local/bin/docker-compose -f /volume1/docker/docker-compose.yml up -d
  3. Now, let’s create the MySQL database for MunkiReport. Go to your Synology server’s IP address, but add :3307 to the end. You’ll reach a login page. Here are the relevant details:
    1. Server is your NAS’s IP address, but with :3306 at the end.
    2. Username is root.
    3. Password is whatever you set in Step 6.
    4. Database can be left blank.
  4. After you login, click ‘Create database’. Name the database whatever you’d like – I went with ‘mreport’. For ‘Collation’, pick ‘utf8_general_ci’. Close the Adminer tab.
  5. Open a new tab, with your server’s IP address followed by :4443 at the end.  You should be greeted with an empty MunkiReport installation. Nice!
  6. In your ‘docker’ shared folder, you had created a ‘MunkiReport’ folder in Step 4. Inside of that, create a file named ‘config.php’. This is how we’ll configure MunkiReport – by overriding values specified in config_default.php (click to see MunkiReport’s default values). I’ll skip this part of the tutorial, as it’s documented much better on MunkiReport’s wiki. At a minimum, I’d strongly suggest setting up authentication, MySQL connection settings, and the modules you’d like to enable.
  7. Before you can expose your MunkiReport container to the outside world, you’ll want to secure it. You’ll do this with a reverse proxy – basically, another web server put in front of your MunkiReport container (which itself contains a web server). The reverse proxy will add encryption, but otherwise leave your MunkiReport installation alone. DSM 6.0 includes a reverse proxy, so let’s use that.
  8. Check out the bottom of this Synology knowledge base article. Unfortunately, the documentation leaves a lot to be desired, so I’ll suggest some settings:
    1. Description: MunkiReport
    2. Source Protocol: HTTPS
    3. Source Hostname: *
    4. Source Port: 4444
    5. (leave both the HSTS and HTTP/2 boxes unchecked)
    6. Destination Protocol: HTTP
    7. Destination Hostname: 127.0.0.1
    8. Destination Port: 4443
  9. Click OK to save.
  10. In your router, forward port 4444 (TCP) to your Synology server. If you haven’t given your Synology server a static IP address, that’d be a good idea.
  11. Visit your secure MunkiReport installation in a web browser:
    https://yourdomain.com:4444

From there, you can create a MunkiReport installation package (I like using the AutoPkg recipe for this). Push it to your clients, then watch as they check in with sweet, sweet data.

Previous

Securing Squirrel with Let’s Encrypt on Synology DSM

Next

Binding Macs to AD using Munki’s Configuration Profile support

5 Comments

  1. Rhiannon

    Thanks for this. I’m struggling with getting through step 8 though. My NAS is not responding on port 3307, although Adminer appears to be running correctly. Any ideas on how to go about solving this?

    Also, in step 7, /usr/local/bin/docker-compose -f /volume1/docker/docker-compose.yml up -d generates the complaint that MunkiReport/config.php doesn’t exist, because that’s not set up until step 11. Should step 11 come before step 7?

  2. Having said that, I found that although I could then access the Adminer login page, it couldn’t log me in to MySQL: it gave the error ‘SQLSTATE[HY000] [2002] Operation timed out’.

    I thought it might be to do with MySQL not allowing remote root logins, so I added a database, username and password in docker-compose.yml, re-ran /usr/local/bin/docker-compose -f /volume1/docker/docker-compose.yml up -d, and tried logging in on the Adminer login page using those credentials. This time it returned the error ‘SQLSTATE[HY000] [2002] No such file or directory’.

    What else can I try?

    • Sorry for the delay in replying – I’ve been out of town for the past few days. I’m glad this has been helpful! Sorry for the gaps in documentation!

      Hmm, I’m not sure what could be causing that. Is it possible DSM’s firewall is getting in the way? Are the Docker containers part of the same network? (in the Docker Compose file above, they’d be on ‘default’, which is also ‘bridge’). I think I created that with the GUI, before I used Docker Compose – I’m not sure what DSM’s Docker networks look like by default, so you might need to tweak that.

      Luckily, I only used Adminer to create the MunkiReport database, so if you can get MunkiReport communicating with MySQL (and the database created some other way), you probably don’t need it. 🙂

Leave a Reply

Powered by WordPress & Theme by Anders Norén