Letsencrypt not accessible - EACCES (Bug report)

[Pupo1]

Trilium Version

0.57.5

What operating system are you using?

Other Linux

What is your setup?

Server access only

Operating System Version

Debian 11

Description

I tried the TLS configuration described here to work together with my letsencrypt certificates.

But I receive the error:
error: EACCES: permission denied, open '/ets/letsencrypt/live/(my domain)/privkey.pem

Which is understandable, because the privkey.pem is only readable by root, while I start the service as a normal user.

Error logs

13:54:25.819 Table counts: notes: 173, note_revisions: 0, branches: 191, attributes: 247, etapi_tokens: 0
13:54:25.830 All consistency checks passed with no errors detected (took 12ms)
13:57:24.922 DB size: 1634 KB
13:57:26.122 Trusted reverse proxy: false
13:57:26.153 Becca (note cache) load took 11ms
13:57:26.161 Error: EACCES: permission denied, open '/etc/letsencrypt/live/( my domain)/privkey.pem'

[zadam]

Well, then you can either make the private key accessible to the trilium process (run trilium as root or chmod cert to user) or e.g. run a TLS terminating proxy like nginx in front of the trilium process (that's what I do).

[Pupo1]

Okay, so I made a reverse proxy for the trilium process, and it works, thank you. I wonder if it shouldn't be mentioned in the installation docs.

[zadam]

I mentioned the option of reverse proxy into the https://github.com/zadam/trilium/wiki/TLS-configuration

[Pupo1]

Okay, but in the section "Modifying config.ini" on the same page, you did not mention that the certificates' rights must be changed or trilium won't be able to access them.

…

On Sat, Dec 17, 2022 at 12:00:00AM -0800, zadam wrote: I mentioned the option of reverse proxy into the [1]https://github.com/zadam/trilium/wiki/TLS-configuration — Reply to this email directly, [2]view it on GitHub, or [3]unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***> References Visible links 1. https://github.com/zadam/trilium/wiki/TLS-configuration 2. #3419 (reply in thread) 3. https://github.com/notifications/unsubscribe-auth/ABP4G667PAUFQHH4NEMZJYLWNVXIBANCNFSM6AAAAAAS6Q3ZUQ