Reach the management screen by name
So far you have been opening the management screen by address and port, and clicking past a warning every time. This puts it behind a proper name. It is optional, and it is a good exercise because it uses most of what you have learned.
Why bother
Two reasons, and the second is the real one.
- An address and a port is hard to remember and easy to type wrong.
- A team that clicks past a certificate warning every day stops reading warnings. That habit does not stay in one browser tab. It is worth twenty minutes to remove it.
How it works
You are going to point a site at the management screen, the same way you would point one at any other application. The management screen just happens to be running on the same machine.
Step 1: a pool for it
- Backend Pools, New pool. Name it
mgmt-gui. - One member: address
127.0.0.1, port7443. That address means this machine. - Turn on TLS for the pool, because the management screen speaks https.
- Turn off certificate verification. The screen uses the self signed certificate it made at installation and there is nothing to check it against. The traffic never leaves the machine, so there is nobody to be in the middle.
This is the one case where turning verification off is right
Loopback, to a service on the same box, with a certificate it made for itself. Anywhere else, fix it properly with an authority file instead.
Step 2: tell the screen it lives under a path
The management screen needs to know it is being served under /lb, so that every link
it writes includes that prefix. Add a line to the settings file on each node and restart it.
echo 'NFM_ROOT_PATH=/lb' | sudo tee -a /data/docker/failoverlb/.env
sudo docker compose --project-directory /data/docker/failoverlb up -dStep 3: a site in front of it
- Sites, New site. Server name
lb-01.example.com. - Add a path of
/lb, set to send requests to themgmt-guipool. - Leave Take this path off before sending it on turned off. The screen now knows
it lives under
/lband expects to be given the whole path. - Add a path of
/as well if you want the rest of that hostname to do something, otherwise it returns 404, which is a perfectly reasonable answer for a management hostname. - Apply.
Step 4: a real certificate
- Certificates, get one from Let's Encrypt for
lb-01.example.com. - Open the site, choose that certificate, turn on Listen on https and Redirect http to https.
- Apply.
Open https://lb-01.example.com/lb. You should get the sign in page with a padlock and
no warning.
If the page appears but looks plain and unstyled
The page was found and its stylesheet was not. Either the setting in step 2 has not taken effect, or the path setting in step 3 is stripping the prefix. Both produce the same symptom, and it looks like a problem with the appearance when it is really the path.
The part to think about
A public name is not the same as a public screen
Putting the management screen on a public name makes it easier for your staff to reach and easier for everybody else to find. Keep NFM_ADMIN_ALLOWLIST set to your office networks. It is checked before the login page even renders, so somebody from the wrong network gets nothing at all, whatever they know.
Two more things worth doing while you are here:
- Tick Management network only on the site, which writes an allow line for every cluster node plus your management networks, then deny all.
- Do the same for the second node with its own name, so both are reachable by name rather than only the one you happened to set up.