Can I use TLS/SSL with own CA for PGSQL connection?

[ei8ht187]

Hi folks,

Does Minicore support SSL secured connections to the PGSQL Database? if so, how can I configure this with a custom CA Cert?

Kind regards

André

[oliverw]

It currently does not. But that will change for the next release.

[ei8ht187]

Thank you again for the fast reply and adding support for this :)

[oliverw]

Does Minicore support SSL secured connections to the PGSQL Database? if so, how can I configure this with a custom CA Cert?

For client authentication?

[ei8ht187]

Exactly. The client (say Miningcore) has to use a SSL secured connection to the database cluster.
According to the dashboard of my DB cloud provider, I have to create a connection with the following cli command (I know it's not the same as miningcore, just to give you an idea)
postgres://[username]:[password]@[servicename].[cloudprovider-url]:[port]/[dbname]?sslmode=require

And trust their proviced CA certificate for the SSL connection.

regards

ei8ht

[oliverw]

Fixed by db6a208

[ei8ht187]

Thanks a lot. Will try it tomorrow.

[ei8ht187]

Probably my fault, but can't bring Miningcore up. I only have certificate.pem...
This is the errormessage right after I started Miningcore:
[2022-01-11 23:05:05.5463] [W] [Core] Running as root is discouraged!

System.NullReferenceException: Object reference not set to an instance of an object.
   at Miningcore.Program.ConfigurePostgres(PostgresConfig pgConfig, ContainerBuilder builder) in /app/src/Miningcore/Program.cs:line 831
   at Miningcore.Program.ConfigurePersistence(ContainerBuilder builder) in /app/src/Miningcore/Program.cs:line 801
   at Miningcore.Program.ConfigureAutofac(ContainerBuilder builder) in /app/src/Miningcore/Program.cs:line 340
   at Microsoft.Extensions.Hosting.HostingHostBuilderExtensions.<>c__DisplayClass10_0`1.<ConfigureContainer>b__0(HostBuilderContext context, TContainerBuilder builder)
   at Microsoft.Extensions.Hosting.Internal.ConfigureContainerAdapter`1.ConfigureContainer(HostBuilderContext hostContext, Object containerBuilder)
   at Microsoft.Extensions.Hosting.HostBuilder.CreateServiceProvider()
   at Microsoft.Extensions.Hosting.HostBuilder.Build()
   at Miningcore.Program.Main(String[] args) in /app/src/Miningcore/Program.cs:line 232
Cluster cannot start. Good Bye!

And this is the redacted config.json used for this:

{
    "$schema": "https://raw.githubusercontent.com/oliverw/miningcore/master/src/Miningcore/config.schema.json",
    "logging": {
        "level": "info",
        "enableConsoleLog": true,
        "enableConsoleColors": true,
        "logFile": "",
        "apiLogFile": "",
        "logBaseDirectory": "",
        "perPoolLogFile": true
    },
    "banning": {
        "manager": "Integrated",
        "banOnJunkReceive": false,
        "banOnInvalidShares": false
    },
    "notifications": {
        "enabled": false,
        "email": {
            "host": "smtp.example.com",
            "port": 587,
            "user": "user",
            "password": "password",
            "fromAddress": "[email protected]",
            "fromName": "pool support"
        },
        "admin": {
            "enabled": false,
            "emailAddress": "[email protected]",
            "notifyBlockFound": true
        }
    },
    "persistence": {
        "postgres": {
            "host": "[HOSTURL]",
	        "tls": true,
	        "tlsCert": "/app/certificate.pem", (in the same directory is the config.json, mounted via docker volume)
            "port": 5432,
            "user": "[DBUSER]",
            "password": "[DBPASSWORD]",
            "database": "[DATABASE]"
        }
    },
    "paymentProcessing": {
        "enabled": true,
        "interval": 100,
        "shareRecoveryFile": "recovered-shares.txt"
    },
    "api": {
        "enabled": false,
        "listenAddress": "127.0.0.1",
        "port": 4000,
        "metricsIpWhitelist": [],
        "rateLimiting": {
            "disabled": true,
            "rules": [
                {
                    "Endpoint": "127.0.0.1",
                    "Period": "1s",
                    "Limit": 5
                }
            ],
            "ipWhitelist": [
                ""
            ]
        }
    },
    "clusterName": "eu1",
    "pools": [
      {
        "id": "eth1",
        "enabled": true,
        "coin": "ethereum",
        "address": "[SNIP]",
        "rewardRecipients": [
          {
            "type": "op",
            "address": "[SNIP]",
            "percentage": 1.0
          }
        ],
        "blockRefreshInterval": 0,
        "clientConnectionTimeout": 600,
        "banning": {
          "enabled": true,
          "time": 600,
          "invalidPercent": 50,
          "checkThreshold": 50
        },
        "ports": {
          "8888": {
            "name": "GPU-SMALL",
            "listenAddress": "*",
            "difficulty": 1,
            "tcpProxyProtocol": {
              "enable": true,
              "mandatory": false,
              "proxyAddresses": []
             },
	    "varDiff": {
              "minDiff": 1,
              "maxDiff": null,
              "targetTime": 15,
              "retargetTime": 90,
              "variancePercent": 30
            }
          }
        },
        "chainTypeOverride": "Ethereum",
        "daemons": [
          {
            "host": "10.200.10.200",
	        "port": 8545,
	        "portWs": 8546,
            "user": "",
            "password": ""
          }
        ],
        "paymentProcessing": {
            "enabled": true,
            "minimumPayment": 1,
            "payoutScheme": "PPLNS",
            "payoutSchemeConfig": {
                "factor": 0.5
            },
            "gas": 21000,
            "maxFeePerGas": 50000000000,
            "keepUncles": false,
            "keepTransactionFees": false
        }
      }
    ]
}

Where is my misstake? Any Idea?

Thanks again for your help in advance.

Kind regards

André

[oliverw]

Please try again with latest oliverw commit.

[ei8ht187]

Now we have a stack overflow:
[2022-01-12 18:17:45.2656] [I] [Core] Version 67.1.0.0-oliverw [9c5b9af]
[2022-01-12 18:17:45.2892] [I] [Core] Runtime .NET 6.0.1 on Linux 5.4.0-92-generic #103-Ubuntu SMP Fri Nov 26 16:13:00 UTC 2021 [X64]
[2022-01-12 18:17:45.2892] [W] [Core] Running as root is discouraged!
Stack overflow.
at System.RuntimeTypeHandle.GetInstantiationPublic()
at System.RuntimeType.GetGenericArguments()
at System.Type.get_GenericTypeArguments()
at AutoMapper.Internal.ReflectionHelper.GetEnumerableElementType(System.Type)
at AutoMapper.Internal.Mappers.CollectionMapper.g__GetDestinationType|2_2(<>c__DisplayClass2_1 ByRef)
at AutoMapper.Internal.Mappers.CollectionMapper.g__MapCollectionCore|2_1(System.Linq.Expressions.Expression, <>c__DisplayClass2_0 ByRef)
at AutoMapper.Internal.Mappers.CollectionMapper.MapExpression(AutoMapper.Internal.IGlobalConfiguration, AutoMapper.ProfileMap, AutoMapper.MemberMap, System.Linq.Expressions.Expression, System.Linq.Expressions.Expression)
at AutoMapper.Execution.ExpressionBuilder.MapExpression(A

Take your time, I've found a workaround for the moment to access the database, even without the certificate.

[oliverw]

Now we have a stack overflow: [2022-01-12 18:17:45.2656] [I] [Core] Version 67.1.0.0-oliverw [9c5b9af] [2022-01-12 18:17:45.2892] [I] [Core] Runtime .NET 6.0.1 on Linux 5.4.0-92-generic #103-Ubuntu SMP Fri Nov 26 16:13:00 UTC 2021 [X64] [2022-01-12 18:17:45.2892] [W] [Core] Running as root is discouraged! Stack overflow. at System.RuntimeTypeHandle.GetInstantiationPublic() at System.RuntimeType.GetGenericArguments() at System.Type.get_GenericTypeArguments() at AutoMapper.Internal.ReflectionHelper.GetEnumerableElementType(System.Type) at AutoMapper.Internal.Mappers.CollectionMapper.g__GetDestinationType|2_2(<>c__DisplayClass2_1 ByRef) at AutoMapper.Internal.Mappers.CollectionMapper.g__MapCollectionCore|2_1(System.Linq.Expressions.Expression, <>c__DisplayClass2_0 ByRef) at AutoMapper.Internal.Mappers.CollectionMapper.MapExpression(AutoMapper.Internal.IGlobalConfiguration, AutoMapper.ProfileMap, AutoMapper.MemberMap, System.Linq.Expressions.Expression, System.Linq.Expressions.Expression) at AutoMapper.Execution.ExpressionBuilder.MapExpression(A

Take your time, I've found a workaround for the moment to access the database, even without the certificate.

Checking. By the way email to you are bouncing that's why you apparently didn't receive my reply from last saturday.

[ei8ht187]

Thanks for the info, checked it and found a mixup in the DNS after the migration of the DNS zone. Still looking for your mail from saturday in the orinal mailbox, got it on the backup :).

[oliverw]

Should work now with the latest commit. (oliverw branch)

[ei8ht187]

Confirmed :D
Thank you very much for your help