Exposing docker.sock for monitor_docker

did you add certs into /config?

yes, i believe so. if i ssh into my HA machine, and type cd config, cd .certs and ls i see the following:

Screen Shot 2021-07-19 at 10.27.37

So, i assume that’s correct.

One thing i noticed that if i remove the line certpath: '/config/.certs form config.yaml and restart HA, the containers show up as entities, but i am unable to turn them on/off via HA

any error logs? need to get more info?

BTW did you run Supervised version?

heeem… when I said config its suppose to be HA home directory?

and config directory need to be allow

if by config you mean the same directory that contains, for example, the www directory and configuration.yaml, then yes :slight_smile:

How do i go about checking that it is set to allow?

on configuration.yaml

homeassistant:
  allowlist_external_dirs:
    - /config

here’s what the logs show after a reboot:

2021-07-19 10:43:31 ERROR (Thread-3) [custom_components.monitor_docker] DockerError(900, "Cannot connect to Docker Engine via tcp://192.168.1.180:2376 [Cannot connect to host 192.168.1.180:2376 ssl:default [Connect call failed ('192.168.1.180', 2376)]]")

2021-07-19 10:43:31 ERROR (Thread-3) [custom_components.monitor_docker] Retry in 60 seconds

sorry for security purposes… I think you can add a specific folder

1 Like

also i tried to change the port to 2375 (just to check) and got a slightly different error in the log after rebooting HA:

2021-07-19 10:48:04 ERROR (Thread-3) [custom_components.monitor_docker] DockerError(900, 'Cannot connect to Docker Engine via tcp://192.168.1.180:2375 [Cannot connect to host 192.168.1.180:2375 ssl:default [[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)]]')

2021-07-19 10:48:04 ERROR (Thread-3) [custom_components.monitor_docker] Retry in 60 seconds

if you install proxy server on 2376 then it should be that port. BTW did you also install proxy on your HA docker?

In my case just to be sure… usually I try using portainer first…if it successfull then you have the right certs

i thought that i had but perhaps i did it incorrectly?

Am i correct in understanding that i need a second instance of HA running in docker, on top of my regular HA which is just installed on a RPi 4b?

I believe you get it wrong

First, docker-socket-proxy need to be installed on your remote docker machine. This way you can remotely get control over it. No, you don’t need HA on this machine

If you need to get information on your HA docker then you will need to add docker-socket-proxy on it, if you are running supervised. Why? because supervised did not expose your /var/run/docker.socket

I believe this information is stated on the monitor docker addon. And if you install docker-socket-proxy on your HA then you will need to use it IP:port in order to get information.

Ah ok, i get you. however, i am not running HA in a container. I just have it installed standalone on a raspberry pi

When you explain stand alone meaning you are install HA RPI? Supervised?

yes, that’s the one!

Which one? the first RPI there are 3 methods… are you running HA OS? Core Container? or HA CORE?

Hi,
sorry I just can’t get on, I have to start really stupid now.
I have HA Supervised running in Docker, currently have an unsuported installation because of the proxy.

Now do I understand this correctly, to get this running as support I need e.g. a second Pi on which I install the proxy (here also the tls certs are created).

I then add these to HA under /config/.certs.
afterwards I execute this e.g. in the homeassistant cli:

docker run --name docker-socket-proxy --restart always -d -p 2376:2376 -v /var/run/docker.sock:/var/run/docker.sock -v /usr/share/hassio/docker/certs:/run/secrets ranrinc/docker-socket-proxy

or am I completely wrong and this is all entered via one Pi. Once via ssh and once via the cli?

sorry if there are extremely stupid questions, but I’m really not quite fit in this topic.

My goal is to have a supported installation including monitor running :frowning:
Last question about the cert creation, it is enough if I here

with the item Create a CA, server and client keys with OpenSSL or?

Thank you!

Hello KingRichard,
I know this is an old post, but how do you identify which of the three RPi methods was used for the install?
Thanks much in advance.