agent cannot connect says authenticating

[cyberb]

I am new to MeshCentral, trying to package mesh central for Syncloud self-hosting project (https://github.com/syncloud/meshcentral/tree/wip). I am running under systemd, nginx and had to modify the code to allow custom path to node for child process to use.
Web is running and OIDC is working but I cannot connect agents (android or linux) both stuck on authenticating phase then disconnect after a minute or two.

server logs (I have added a few console.logs to server):

Dec 07 17:25:33 syncloud meshcentral.backend[7956]: Check if this is a un-authenticated JSON
Dec 07 17:25:33 syncloud meshcentral.backend[7956]: Agent certificate
Dec 07 17:25:33 syncloud meshcentral.backend[7956]: AGENT: processAgentSignature
Dec 07 17:25:33 syncloud meshcentral.backend[7956]: AGENT: Verified agent connection to hMAWN7HjP8VwYQf$Kgo45xl2Ntrpq1TrUayGy68zQpr9rVAgU2hfim2Sp2Y4wBmm (192.168.1.188:38320).
Dec 07 17:25:33 syncloud meshcentral.backend[7956]: AGENT: completeAgentConnection: undefined, undefined
Dec 07 17:28:00 syncloud meshcentral.backend[7956]: message: {"action":"battery","state":"dc","level":87}
Dec 07 17:28:00 syncloud meshcentral.backend[7956]: Check if this is a un-authenticated JSON
Dec 07 17:30:06 syncloud meshcentral.backend[7956]: DISPATCH: DispatchEvent [ '*' ]

nginx config

    server {
        
        listen unix:{{ .CommonDir }}/web.socket;
        set_real_ip_from unix:;
        server_name _;

        proxy_send_timeout 330s;
        proxy_read_timeout 330s;

        location = /ping {
            access_log off;
            add_header Content-Type text/plain;
            return 200 'pong';
        }

        location / {
#             proxy_pass http://backend;
            proxy_pass http://127.0.0.1:4430/;
            proxy_http_version 1.1;

            # Allows websockets over HTTPS.
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;

            # Inform MeshCentral about the real host, port and protocol
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            # Since TLS is terminated before this Nginx (via a front proxy/socket),
            # always tell upstream the original scheme and port were HTTPS/443 to avoid redirect loops.
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Port 443;
        }
    }

from the code I see that mesh id is not set and that is why it is not continuing

    function completeAgentConnection() {
        parent.parent.debug('agent', 'completeAgentConnection: ' + obj.meshid + ', ' + obj.agentInfo);
        if ((obj.authenticated != 1) || (obj.meshid == null) || obj.pendingCompleteAgentConnection || (obj.agentInfo == null)) { return; }

but do not see that this message type sets any mesh id

else if (cmd == 2) {
                console.log('Agent certificate');

should another message arrive from the agent before or after that?
did I break or missing something, can someone help please?

[si458]

Well first things first what does your config.json look like?
Also are u using a dns value to access the web ui?
U must use a dns for meshcentral
Using ip addresses don't really work

[cyberb]

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "settings": {
    "debug": "*",
    "cert": "app.domain.com",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_unixSocket": "{{ .DataDir }}/meshcentral.sock",
    "_unixSocketMode": "660",
    "Port": 4430,
    "AliasPort": 443,
    "RedirPort": 800,
    "AgentPong": 300,
    "_TlsOffload": "127.0.0.1",
    "autoBackup": {
      "backupPath": "{{ .StorageDir }}/backup"
    },
    "tlsOffload": true
  },
  "domains": {
    "": {
      "showPasswordLogin": false,
      "rootDirect": "/auth-oidc",
      "title": "Syncloud",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true,
      "CertUrl": "https://app.domain.com/ping",
      "authStrategies": {
        "oidc": {
          "issuer": {
            "issuer": "https://auth.domain.com",
            "end_session_endpoint": "https://auth.domain.com/logout"
          },
          "client": {
            "client_id": "{{ .OIDCClientId }}",
            "client_secret": "{{ .OIDCClientSecret }}"
          },
          "groups": {
            "required": [
              "users",
              "syncloud"
            ],
            "siteadmin": [
              "syncloud"
            ],
            "sync": {
              "enable": true,
              "filter": [
                "users",
                "syncloud"
              ]
            }
          },
          "newAccounts": true,
          "_newAccountsRights": [
            "nonewgroups",
            "notools"
          ],
          "_newAccountsUserGroups": [
            "ugrp//xxxxxxxxxxxxxxxxx"
          ]
        }
      }
    }
  }
}

[cyberb]

Also are u using a dns value to access the web ui?

yes, https://app.domain.com

[si458]

certUrl is wrong, it should only be the url u use to access meshcentral, the should be no /ping
U might need to restart meshcentral after change, then uninstall meshagent from remote machines then redownload and reinstall

Also disable your AV first then try again
Some AVs like norton/avg/kaspersky block meshcentral web traffic even if u allow them

[cyberb]

Removed /ping, reinstalled, did not help.
Let me try the install without my changes.

[cyberb]

Adding ignoreAgentHashCheck: true does not help either.
Interesting that during this agent authentication request I see that node is using around 50% of a single core even after agent disconnects, but I cannot understand what it does or where to add logs.
Can it be that it is trying to start child procs but my override path to node process (which is not simply current process name which is ld.so in my case) is not working in all cases?