FWIW guest posts usually require approval, so that was at least part of the issue.

Now your account has been approved, hopefully it will be a bit smoother.

Re Wireguard, if you're using the Proxmox, you may already be aware that you need to manually install the 'wireguard-tools' package to make it all work. By a gross oversight by us, it gets removed during the template build process and we didn't realise until we had already started work on the next major release. FWIW the ISO should "just work" and the new (upcoming) v18.0 build should also "just work" OOTB.

Please don't hesitate to start a new thread if you have any further concerns, issues and/or feedback for us. Good luck and perhaps see you about on the forums.

Welcome to TurnKey.

Although I should note that our current GitLab appliance has a nasty bug (workaround is noted there too). We hope to have a new release (without that bug) in coming months, but It's a beast of a thing and has proven to be a very hard appliance to maintain, so it's not one we're prioritizing (not that we're avoiding it either, just focusing more on other appliances with higher leverage).

Also, it's perhaps worth sharing that if you don't need/want all the bells and whistles that GitLab offers and are just looking for a web UI for collaboration on git versioned projects, then I'd recommend Gitea (it's what I use personally). Not that GitLab is bad, but it's incredibly complex, with lots of moving parts and is VERY heavy on resources. Even with significant resources allocated, I've found it to be quite load and unresponsive. Gitea is much lighter weight than GitLab (requires less resources, by a significant factor) and is much more responsive. Not to mention, easier on the eye (in my opinion at least). It can be integrated with CI/CD if you want/need that. Although unfortunately, the only standalone one we have is Jenkins - Jenkins does have a Gitea plugin - but Jenkins is a bit of a learning curve if you're not already familiar with it).

Thanks for reporting, but I can't reproduce it? I've just downloaded it locally and the one I downloaded appears to be ok. I'll post my results below, but my guess is that the image you've downloaded is corrupt. From your report, it seems that you retired with the same result. Out of interest, were the bad checksums consistent? Or did you get a different one on your second attempt?

As for the GPG (RSA) key, your report has highlighted a bug that I'd previously missed (and no one else has previously reported), so thanks again for reporting! I'll cover that more further down, but first the checksums.

The one I just downloaded has correct SHA256 checksum:

$ sha256sum -c debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz.hash
debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz: OK
sha256sum: WARNING: 53 lines are improperly formatted

Or manually:

$ sha256sum debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz
0ffd312be1ee1685538cdd17d314e7e9c8b26c53787926b7f9cf8cd89e6f6ea6  debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz

Which matches the checksum in the hash file.

For good measure, I also checked the SHA512 checksum too:

$ sha512sum -c debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz.hash
debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz: OK
sha512sum: WARNING: 53 lines are improperly formatted

Re the file However as I hinted above, it appears that there is a bug in the text and the signing key download url is not noted as it should be. The output you've noted is expected if you do not have the public key locally. The first line in the step 1 code is the line that should import the public key, but it's missing the URL. I'm pretty sure that's why that bit failed (it works fine for me, but I already have the public key - so again that's expected).

The good news is that it appears that the hash file you have is the one we provide (and not something malicious). The key that we signed v17.x release hash files with is indeed "DD83FEBBE256B92A29FC1B821E487A4631D6FEB6". Hence why I jumped to the corruption conclusion.

So you do have an invalid template, but the hash file appears to be ok (except for the above mentioned bug). Exactly where the corruption exists/occurs, I can't be 100% sure. If you'd got the same (wrong) checksum from 2 separate downloads of the same template, then that suggests that probably the image on the mirror you connected to is corrupt (and that unluckily you connected to the same mirror when you tried again - or it's corrupt on multiple mirrors - which seems highly unlikely, albeit not impossible). If the checksum was different for each image, then the corruption is likely local; either in transit (perhaps a badly behaving internet proxy?) or perhaps on disk?

Regarding checking the signature, The first line of code in the hash file (with the missing text) should be:

$ curl https://raw.githubusercontent.com/turnkeylinux/common/18.x/keys/tkl-bullseye-images.asc | gpg --import

Note the missing URL between "curl" and the pipe ("|"). If you run that first, then this is what you should get when checking the sig:

$ gpg --verify debian-11-turnkey-wordpress_17.1-1_amd64.tar.gz.hash
gpg: Signature made Mon 14 Nov 2022 19:24:20 AEDT
gpg:                using RSA key DD83FEBBE256B92A29FC1B821E487A4631D6FEB6
gpg: Good signature from "TurnKey GNU/Linux Bullseye Images (GPG signing key for TurnKey Linux Bullseye Images) " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E10F 6567 0C8E BE42 ED0C  3A49 CCA5 1174 468F 9073
     Subkey fingerprint: DD83 FEBB E256 B92A 29FC  1B82 1E48 7A46 31D6 FEB6

I suggest that you try downloading the template again and see how you go. Good luck. If you continue to have issues, please let me know (although feel free to share success too).

Hi Andale, welcome to TurnKey

Please feel free to open a new thread in our forums if you have any problems, questions or feedback.

Good luck

Hmm, it looks like I already enabled your account? But I must have neglected to let you know!? Sorry about that. Good luck with it all.

TBH I had some reservations about enabling your account. Your approach is/was somewhat consistent with spammers and SEO farmers that I've had some experience with. I've given you the benefit of the doubt this time, but please don't prove my concerns right.

Any illegitimate spam will be removed, your account blocked and there will be further follow up (with any companies noted in any spam) if it comes to my attention that you have abused the privileged of having a TurnKey website user account.

Hi Norbert, your TurnKey account is approved. Welcome aboard.

Please feel free to start a new forum thread if you have any issues, questions and/or feedback for us.

Hi Ozzie, I've already replied directly to your Hub support post. But for the benefit of others that may find themselves in the same situation, I'll repost what I replied directly to you a little earlier:

I'm not sure why you got a random email out of the blue? However, I can confirm that you are not in our billing system and so are not being charged.

My guess is that you had a really old TurnKey Hub account. When the Hub first launched (about 14 years ago) billing was done via AWS "DevPay". When AWS shut that down, we devised a migration process and all users who wished to keep their servers and/or backups were required to migrate to the new billing system. Eventually AWS shut down DevPay and all DevPay backed servers and backups were destroyed. As a last ditch effort to limit risk of data loss (e.g. if users missed all the emails both us and AWS sent out) we stored all remaining backups (at our expense). We kept them for over a year, but unclaimed data was eventually deleted.

So bottom line, considering you got this email, your Hub account must still exist, however I assume that it's still backed by DevPay, thus while the Hub probably still thinks the server(s) exist (hence the email) they don't. Feel free to have a look by logging into your Hub account[1]. Please note that if my understanding is correct, then you will likely be greeted by a page telling you to "migrate" (which won't work).

If that seems reasonable and likely to you, then probably the best course of action is for us to just nuke your existing Hub account. Even if you want a new Hub account, starting from scratch is probably better/easier.

If you are happy for that to occur, please confirm and I will get my colleague Alon to nuke your account.

Hi AJ, I've enabled your TurnKey website account. So please feel free to open a new thread if you have any issues, questions and/or feedback for us.

Also, just to be clear. You don't need an account here or a Hub account (our SaaS platform to manage cloud servers and remote encrypted backups) to use TurnKey. If you are happy self-hosting, don't plan to run any cloud servers and either the data is unimportant (e.g. just testing or a hobby project) or you have an alternate remote backup regime, then you can simply skip the "Hub API key" step on firstboot.

Having said that, the remote encrypted backups (aka TKLBAM - our built-in custom "smart" data backup and migration tool) may still be of value. Your server doesn't even need to be publicly available (although it must have clear outgoing internet for access to the Hub and uploading your encrypted data to AWS S3 storage).

Anyway I hope things go well for you with TurnKey. If not (or even if so) please do start a new thread.

Hi kyevey, welcome to TurnKey.

Please do not hesitate to start a new thread if you have any support needs, questions, suggestions and/or feedback.

Welcome aboard! :)

Please feel free to open a new thread if you have any questions, issues, feedback and/or suggestions.

Hi Markus, your account has been approved.

Please feel free to start a new thread if you have any issues, questions or feedback for us.

Also FYI there should be some newer, updated (v18.0) templates coming through soon. Soon after that happens, it will be announced on our blog (although sometimes there is a lag of a day or 2 - just depends how busy I am).

Welcome to TurnKey Camilo! :)

I'm guessing that you already found it, but you can download the latest ISO from here. As you may have also noticed, the newer (v17.x) release does not provide a pre-built VMDK or OVA, only an ISO. The ISO should install fine, but will require you to create the VM first (then install the ISO to it). We do hope to return to providing VMDKs and OVAs, but I'm not sure when that will be. As a VMware user, perhaps you may be able to assist with testing when we get there? Out of interest, what specific VMware software do you use (please provide name and version if you don't mind)?

As for the API key, that requires a separate user account on our SaaS platform: TurnKey Hub. As "self hoster", you probably won't want/need the Cloud Servers component, but the Backup service (which leverages our built in backup tool; TKLBAM) TurnKey may still be of value?

Although please be aware that whilst we think the Hub adds value (and is our primary source of revenue which keeps the lights on); the Hub is an optional "value add" service. If your data is not important (e.g. just testing) or you have an alternate remote encrypted backup regime, then you can skip the API key step on first boot.

I don't speak Spanish, hopefully the Google translation is good?!

¡Bienvenido a TurnKey Camilo! :)

Supongo que ya lo encontraste, pero puedes descargar la última ISO desde aquí. Como también habrás notado, la versión más reciente (v17.x) no proporciona un VMDK u OVA prediseñado, solo un ISO. La ISO debería instalarse bien, pero será necesario que primero cree la VM (luego instale la ISO). Esperamos volver a ofrecer VMDK y OVA, pero no estoy seguro de cuándo será. Como usuario de VMware, ¿tal vez pueda ayudarnos con las pruebas cuando lleguemos allí? Por curiosidad, ¿qué software VMware específico utiliza (proporcione el nombre y la versión si no le importa)?

En cuanto a la clave API, requiere una cuenta de usuario separada en nuestra plataforma SaaS: TurnKey Hub. Como "autohospedador", probablemente no querrá ni necesitará el componente Servidores en la nube, pero el servicio de copia de seguridad (que aprovecha nuestra herramienta de copia de seguridad integrada; TKLBAM) TurnKey aún puede ser valioso.

Aunque tenga en cuenta que, si bien creemos que el Hub agrega valor (y es nuestra principal fuente de ingresos que mantiene las luces encendidas); el Hub es un servicio opcional de "valor agregado". Si sus datos no son importantes (por ejemplo, solo pruebas) o tiene un régimen de copia de seguridad cifrado remoto alternativo, puede omitir el paso de la clave API en el primer arranque.

No hablo español, ¿ojalá la traducción de Google sea buena?

Hi Thodo. Welcome to TurnKey. Please feel free to open a new thread if you have any problems, questions, feedback or suggestion for us.

Hi John, that sounds awesome!

Please do not hesitate to start a new thread if you have any problems, questions, suggestion or other feedback for us.

Good luck with it all and look forward to hopefully seeing you about on the forums.

Hi David. Apologies on my slow response (I published your post and enabled your account last week, but I was snowed under so didn't circle back to respond until now...). Regardless, welcome to the Turnkey forums.

Thanks for introducing yourself. What you're up to all sounds very cool!

It's perhaps worth being aware that TurnKey also has a SaaS service, called the TurnKey Hub which allows you to easily run TurnKey servers on AWS and/or store encrypted backups on AWS S3 storage. Whilst that is run by us, the Hub user database is separate to the website user DB. So if your existing server (and/or backups) are via the Hub, that's the one you'll need access too. Obviously feel free to use your account here if you need a hand with anything (start a new thread in the support subforum) and/or want to share anymore updates (in the general subforum). But if your team are using the TurnKey, it's best to just change the email address of the existing account and/or add a new GoogleID (or other OpenID type authentication).

I hope that all makes sense. Take care and hopefully see you about on the forums.

Hi there and welcome to TurnKey. Apologies on the delays. I was a bit snowed under last week and whilst I published your post and approved your account late last week, I'm only just circling back around now to say hi! :)

Please don't hesitate to start a new thread if you need a hand, have any questions or feature request, or would like to share some feedback.

Apologies on the delayed response but your account has been approved.

Please don't hesitate to start a new thread if you have any questions, issues or feedback for us.

You are referring to the Hub API key. You can read more on the TurnKey Hub itself.

We like to think that the Hub adds value to TurnKey users; plus it's our main source of revenue and keeps the lights on round here. As such we encourage it's use. Regardless, it is an optional "value add" service.

The Hub includes facility to host "cloud servers" (on AWS) but also has value for self hosters - via it's Backups service, which integrates with our built-in TKLBAM tool - to provide encrypted remote backups.

If your data is not important (e.g. just testing) or you already have some remote backup regime, then simply skip the API key step. If/when you change your mind, sign up to the Hub and initialise TKLBAM, either via Webmin (should be obvious) or via CLI like this:

tklbam-init

And follow the on screen instructions instructions.

Take care and good luck.

Welcome to TurnKey and great to hear that things are (mostly) working well for you.

To get an API key, you'll need to sign up to the TurnKey Hub. (The website and teh Hub have separate user databases). Then you can initialise TKLBAM with your API key, either via Webmin (should be obvious) or via CLI like this:

tklbam-init

And follow the on screen instructions instructions.

If you have any questions or concerns while signing up to the Hub, please feel free to use the Hub's "in app" support (blue chat icon in the bottom left) and I'll respond ASAP (expected response time is within one work day, usually much quicker). Feel free to post on the forums instead, but response time will almost certainly be better via Hub support.

Also, if/when you have any more general TurnKey related questions, problems and/or suggestions/feedback, please feel free to open a new thread in the forums.

Hi there and welcome to TurnKey.

It sounds like you may be looking for an API key? If so please read this post (above).

Regardless, please feel free to start a new thread on the forums if you need a hand with anything and/or have feedback for us.

Take care and hopefully see you about on the forums.

Nice work. That sounds like a very cool project/social enterprise/charity! I like the sounds of it.

Your plan sounds good! I've never heard of RustDesk before, but it looks cool. It looks like an ideal candidate for a TurnKey appliance actually!

Please feel free to open a new thread if you need a hand with anything and/or have any feedback for us.

Thanks so much for reporting. I've lodged a bug on our issue tracker.

I think your googling headed you in exactly the right direction. It appears that there was an oversight on our behalf when migrating between versions of MariaDB...

I'll look into developing a fix (which I'll be looking for "real world" testers for once it's ready). In the meantime, the suggestion noted at the top of that thread would be worth a try. I.e. before running the restore, run these commands:

mysql -e "DROP TABLE IF EXISTS 'mysql'.'global_priv';"
mysql -e "DROP VIEW IF EXISTS 'mysql'.'user';"

Then run your restore. Fingers crossed, it should work.

Note that backups from v17.x should restore fine on v17.x. It's just migrating from an older version is problematic.

Also, in case it's not obvious, those commands will drop existing DB components. If you're trying to migrate your data to a new install, then you should be fine, but if restoring to an instance that has any data you want to keep, be sure to run a backup on that first.

Hi again Chris, did the previous post help? I have tested locally and it seems to work, but is a bit clunky.

I have created a TKLBAM hook script that should (hopefully) workaround the issue. You can find that (and instructions to "install" it) here: https://github.com/JedMeister/tklbam-restore-mariadb-bugfix (sorry I didn't post that previously - I forget where I had put it).

I have tested it on a users backup (migrating Joomla from v16.x to v17.x) and it worked for me, but they reported that it didn't work for them. Unfortunately I still haven't got specific details of what/how it fails and I can't reproduce it locally. If you could test that with your old backup would be awesome if it's not too much pain? (I.e. try restoring your old backup on a fresh VM with this hook).

Please open a new thread on the forums if you have any questions, problems and/or feedback for us.

Hopefully see you about soon.

Hi Thomas, welcome to TurnKey.

Glad to have you here. Please do not hesitate to start a new thread if you have any questions, issues and/or feedback/suggestions for us.

Hi there. Welcome to TurnKey. Your account is approved. :)

Please feel free to open a new thread if/when you have any questions, problems and/or feedback/suggestions for us.

Until then, good luck and thanks for checking out TurnKey! :)

You can find ISOs via the front page (scroll down and use the search feature. Alternatively you can browse through them all.

You can download Proxmox LXC builds directly through the Proxmox UI, via the "Templates" list.

Feel free to start a new thread if you have any questions.

Hi Egito, welcome to TurnKey.

Please feel free to open a new thread if you have questions or concerns and I'll respond ASAP (response times vary, but I aim to reply at least once per week, usually once per work day). If you are using TurnKey in production and need quicker support response times, please send me an email via support AT turnkeylinux.org and we can discuss options.

Also please note that I don't speak Portuguese so have translated your post and my response to English. In future, please feel free to post in Portuguese, but it would be great if you could also include a translation (e.g. using Google Translate) - as I'm doing here. :)

Olá Egito, bem-vindo ao TurnKey.

Sinta-se à vontade para abrir um novo tópico se tiver dúvidas ou preocupações e responderei o mais rápido possível (os tempos de resposta variam, mas pretendo responder pelo menos uma vez por semana, geralmente uma vez por dia útil). Se você estiver usando o TurnKey em produção e precisar de tempos de resposta de suporte mais rápidos, envie-me um e-mail através do suporte AT turnkeylinux.org e poderemos discutir opções.

Observe também que eu não falo português, por isso traduzi sua postagem e minha resposta para o inglês. No futuro, sinta-se à vontade para postar em português, mas seria ótimo se você também pudesse incluir uma tradução (por exemplo, usando o Google Translate) - como estou fazendo aqui. :)

Full points for honesty...!

Account approved on condition that you don't post any spam or links to "bad" sites (e.g. p0rn, gambling, drugs, etc).

Hi Markus, your account is approved. Welcome to TurnKey.

You can download TurnKey LXC templates via the Proxmox web UI (or pveam CLI tool). Or you can find ISOs (which can be used to install to a "proper" VM) via our website front page - scroll down a little to see the search bar. Or alternatively, browse through them all.

Any questions or problems, please open a new thread in the forums.

Hi Daniel. I'm not 100% sure? Webmin login should use the same credentials as you use when logging in via SSH (assuming that you log in via SSH using password). If you log into SSH using keys and aren't sure of your root password (or you may have forgotten it), you can set one (or reset it if it doesn't seem to be working) like this:

passwd root

If you continue to have issues, please start a new forum thread and note exactly what you've done, what you've tried and what the result is (e.g. specific error messages, etc).

Hi Rick, welcome to TurnKey.

Whilst we used to provide a Tendenci appliance, it hasn't been produced for some time now. Looking at the build code it appears that it hasn't had any updates for ~7 years... So is quite out of date. We should look at getting that back into the library at some point, but until then you'll need to manually install it yourself.

Regardless, TurnKey is based on Debian (which Ubuntu is also based on). According to their System requirements they state that it should be installable on any Linux, Mac OSX or Windows. So TurnKey should be near enough to Ubuntu that it should install and function fine.

If you hit any issues installing it on TurnKey and/or have any other TurnKey related questions, please open a new thread in our forums.

Hi fejao. Welcome to TurnKey.

If you'd like to try out the TurnKey Hub, then please sign up over there (the website and the Hub have separate user databases). That will get you an API key.

If you have any Hub specific questions or issues (during setup, while on the free trial or as a paying user), please contact me directly via Hub support (email support AT turnkeylinux.org or use the Hub's "in app chat" button - chat icon towards the bottom right of every page). Normal response time there is within one work day (often quicker).

If you have more general TurnKey questions, issues, etc then please feel free to open a new thread on our forums anytime. I respond to forum posts when I can. Ideally that's at least once per day, but sometimes if I'm busy it can slip a bit, but should usually be at least once per week.

Hi Kyle, welcome to TurnKey.

You are absolutely correct. It's a known bug - with a super easy fix:

apt update
apt install -y wireguard-tools

I had hoped to address that long before now, but we're a small team with lots on. Prior to discovering the bug, I had already started on our next major version (v18.x). Whilst it is broken OOTB, considering that it doesn't work at all (as opposed to appearing to work, but having some nasty security bug or similar) and it's an easy fix on your end (as opposed to a complex set of steps) I haven't given it a high priority.

Also FWIW the bug only affects our Proxmox/LXC build. The ISO (downloadable from the Wireguard appliance page) should be fine.

I hope to produce an updated Wireguard ASAP, but no ETA on that. FYI we announce updated appliances via our blog. For info about the latest builds, please check out the release tag.

Please do not hesitate to open a new thread in our forums if you have any questions, concerns, issues or feedback for us. Good luck with it all and hopefully chat another day. :)

Hi Jaime, welcome to TurnKey.

Sorry to hear of your troubles with SSL on one of our appliances.

Please open a new support thread (you'll need to log in, I've approved your account) and post details regarding the errors you are hitting. FWIW, SSL should "just work" OOTB. Although the default certs are self signed, so will give web browser errors (noting that a self signed cert is "insecure" - they're not necessarily, but that's for discussion another day...).

Please share the specific appliance you are using (name and version, i.e. post the output of 'turnkey-version'). Also post the exact error message(s) you are seeing and note where you are seeing them (apache log, journal, somewhere else).

Please also share what you have tried and if possible a "step by step" how to recreate the issue(s) you are hitting. If I can recreate the issue on my end, I can almost certainly help you find a fix.

Hi Joseph, welcome to TurnKey. Apologies on my slow response...

TBH, I'm not sure what you mean when you refer to filecloud? A quick google suggests that it's proprietary "cloud fileserver" software?! From a quick read of their website, I assume that it's possible to install on TurnKey, but it's nothing to do with us and we don't (and won't - because it's not open source) provide an appliance with it pre-installed.

Regardless, please start a new thread if you have any questions, concerns or feedback.

Hi Yona, welcome aboard.

I've enabled your account so you should be good to login now. On face value I read your email as wanting to share your success with updating Odoo, but if English is not your first language, then it's quite possible that I've completely misunderstood and instead you're seeking help.

Either way, please start a new thread and we'll go from there.

Hi Rahul, your account has been approved. Please feel free to open a new thread if you have any issues, questions or feedback.

Hi Santo. First thing, welcome to TurnKey. I've enabled your account and you now should be able to log in. Simple replies are ok here, but if you want to dig into this issue a little more, or want to write up a post to help others, please post a new thread in the forums. Info shared here will likely get lost...

To your issue, in v17.x (and earlier, at least as far back as v15, perhaps earlier) Webmin is bound to localhost and served (using it's built in miniserver) via vanilla http on port 10000. The external access and TLS/SSL termination (i.e. https) is provided by Stunnel (listening on port 12321). That is why it's not working as you expect.

So default setup looks something like this:

internet/network <-https-> yourserver:12321 <-https-> stunnel <-http-> Webmin on localhost:1000

And it sounds like yours has fallen back to:

internet <-http-> Webmin on yourserver:1000

I am unfamiliar with Webmin 2FA, but I suspect that enabling that, reconfigures Webmin to be externally accessible (i.e. no longer bound to localhost) - or perhaps that's just an unintended side effect (of this or something else)? It's also possible, that it's not aware that it's behind a reverse proxy.

Note that stunnel isn't a "proper" reverse proxy (i.e. a "normal" webserver configured as a reverse proxy, or purpose built reverse proxy tools). It's just a tiny TLS/SSL termination server/client. It works well in specific use cases, but it's not particularly flexible.

FWIW there isn't actually a good technical reason why Webmin is still behind stunnel. It's more just legacy config that made things easier for us and so we've continued to use it. In the new v18.x release (which I note doesn't yet include an updated Fileserver appliance), we've updated things and Webmin now serves itself directly/publicly (via it's built in miniserver), so is no longer behind stunnel. So I think you'd find that in v18.x it works as you expect.

So I see 2 options for you:

1. Remove stunnel and serve Webmin directly.

If you want to go this path and continue to use https on port 12321, but without stunnel (like we do in v18.x), you'll need to reconfigure the miniserver (i.e. via /etc/webmin/miniserv.conf) to enable/force https and use port 12321. I don't have the specific Webmin conf handy. but hopefully that's not too hard to work out?! If you have issues, please ask (open a new thread though please). The only other thing you'll need to do is stop stunnel. Assuming v17.x, do that like this:

systemctl disable --now stunnel@webmin.service

Then restart Webmin and it should be all good.

systemctl restart webmin

2. Adjust Webmin config so that it knows it's behind a proxy (stunnel).

I suspect that this should also be a legitimate option, although as I've never used 2FA with Webmin and Stunnel, I can't be 100% sure. It may also be that whilst Webmin is capable, Stunnel is not (i.e. not configurable enough). Regardless, it'd be worth trying if this is what you are after. A quick glance of the Webmin docs suggests that setting 'redirect_port=12321' in /etc/webmin/miniserv.conf and restarting Webmin as per above) might be enough do the trick?

Hi Robert, welcome to TurnKey.

Your TurnKey website user account has now been enabled. If you have any concerns or questions, or need a hand with something, please start a new thread in the forums.

Hi Rob. Welcome to TurnKey. I have now approved your TurnKey website user account. So please feel free to start a new thread if you have any questions, concerns or feature requests (or anything else even vaguely TurnKey related)

Although you mention that you want an API key. To get an API key, you're not quite in the right place. You'll need to sign up to the TurnKey Hub (sorry, more hoop jumping - I promise it's not on purpose). The TurnKey Hub is our SaaS platform - it's by us and uses the same (turnkeylinux.org) domain; hosts TurnKey apps and/or backups - just different subdomain (hub instead of www) and it has a separate user database to the website.

I hope that all makes sense?! If you have any Hub specific questions, please feel free to ask them via the Hub's "in app" support (blue chat icon towards the bottom right of any Hub page) or via email: support AT turnkeylinux.org. You can ask in the forums instead if you want, but you'll almost certainly get a quicker answer via Hub support.

Hi there. Welcome to TurnKey. You're in, so if you have any questions or concerns, or want to share any TurnKey related tweaks and tips, please start a new thread on the forums.

Hi Martin. Welcome to TurnKey. I have approved your TurnKey website user account. So please feel free to start a new thread if you have any questions, concerns or feature requests etc.

To get an API key, you're not quite in the right place. You'll need to sign up to the TurnKey Hub for one of those. The TurnKey Hub is our SaaS platform - it's by us and uses the same (turnkeylinux.org) domain; hosts TurnKey apps and/or backups - just different subdomain (hub instead of www) and it has a separate user database to the website.

I hope that all makes sense?! If you have any Hub specific questions, please feel free to ask them via the Hub's "in app" support (blue chat icon towards the bottom right of any Hub page) or via email: support AT turnkeylinux.org. You can ask in the forums instead if you want, but you'll almost certainly get a quicker answer via Hub support.

Hi Wolf, thanks for your kind words and show of solidarity.

We do have a raft of anti-spam features integrated into the Hub, but they work with varying degrees of success and are particularly poor at detecting human (or more modern, AI powered) spammers.

Part of the issue is that the software that we use for the site is quite dated (albeit still supported). We had a major issue with the website server a while ago and after a bit of troubleshooting, I decided that the best path forward was to just migrate the site to a new server (the old server had been around for a very long time and had accumulated a fair bit of cruft).

Initially when I migrated the site to a fresh (TurnKey) server, it worked really well. However, it wasn't long before the main anti-spam module that we used to use started playing up (and with the benefit of hindsight, perhaps that was part of the original server issue?).

I got an expert to have a look and after a bit of hunting about and code review, he suggested that we would be better off without that particular module (he said it was poorly coded and hard to debug the issues). With that module disabled, the site worked consistently fine again. As I noted, we have a range of anti-spam measures, and they were mostly sufficient for a while. But we eventually got targeted by a particularly aggressive "smart" bot and/or team of humans. At the point where I gave up and closed the auto account approval, there were 500-1000 spam posts per day!

So whilst this new workflow sucks in many ways, until we redo our website (which has been on the cards for a while and will need to be done soon regardless) it's the best we've got.

Anyway, welcome to TurnKey. Please do not hesitate to start a new thread if you have any questions or problems. We also welcome feedback, such as things that could be improved and ideas for new appliances. Although on the latter, chances are pretty high that unless you actually develop the appliance yourself, it may be a while before we get to it...

Hi Stratus, your account has been approved. Welcome to TurnKey.

I'm always interested to hear feedback from new users, especially those with a bit of experience with Linux. We try to keep the base OS as close to Debian as possible, but with a few extras to make the entry a bit easier for newbs. The theory is that then an experienced Debian user won't find any nasty surprises, but it's also a good entry level OS for those with much less experience. We don't necessarily suggest that TurnKey is the best option in every circumstance, but it should be useful OOTB for someone with minimal requirements, but more of a better starting point for those with more knowledge and a clear idea of their desired outcome. I'm not sure how close to the mark we are, but hopefully we provide a good balance.

Happy Holidays, Happy Hanukkah, Merry Christmas, and all that back at you!

Also, no need to apologize for your rambling. I'm the master rambler! :)

Now your account has been enabled, please don't hesitate to start a new thread if you have any problems, questions and/or feedback for us (e.g. feature requests, appliance requests, bug reports, etc). Although if you're sure you've hit a bug, please note that we have a consolidated bug tracker on GitHub - so please feel free to lodge bug reports directly there (requires a free GitHub user account).

Take care and hopefully see you about on the forums.

Hi there. Firstly apologies on my slow response. I actually enabled your account yesterday, but am only just following up now.

Re your Samba issues, my guess is that it is something new as I tested Win11 when I released it and at that point it was working ok (with a backported version of Samba installed from Debian "bullseye-backports"). We do hope to have a refreshed appliance release sometime soon, but in the meantime, it looks like the version of Samba in Debian 12/Bookworm v4.17.12 (FYI Bookworm is the basis of TKL v18.x) has been backported to 11/Bullseye (the basis of v17.x). As backports are already enabled and the relevant packages should be pinned, doing an 'apt upgrade' (or even just an 'apt install samba') should pull in the newer version.

Hopefully that should fix the issue. If not, please open a new thread (you'll need to be logged in) and we can discuss further.

Hi Nate, welcome to TurnKey

I have approved your TurnKey website account. However, you mention getting an API key. To get one of those you'll need to sign up to the TurnKey Hub. That's our SaaS service which provides 2 main services, both backed by AWS; "Cloud Servers" (TurnKey servers running on AWS EC2) and "Backups" (encrypted remote backups, uploaded to AWS S3 storage). The 2 services can be used together, or separately (e.g. in your case you probably don't want cloud servers, but backups might be useful?). Please note that the free trial is "opt out" so please keep that in mind. Any issues, please hit me up via Hub Support (either via the "in app" support (blue icon towards the bottom right of each Hub page) or via email (support AT turnkeylinux.org).

Your website account is already approved, so please feel free to open a new forum thread if you have any questions, support needs and/or feedback for us.

Hi, your account is approved. Please feel free to start a new thread if you have any questions, support needs and/or feedback for us.

Hi Keith, welcome to TurnKey! :)

Firstly, your account has been approved. So please feel free to open new thread if you have any questions, support needs and/or feedback for us.

Thanks too for the new appliance request. I've opened an issue for that on our issue tracker, although as I noted over there, I'm not 100% sure when we might get to it...

We're already so far behind on the v18.0 release that it's just not funny. Also we're in the process of trying to automate some of our build process (which really should have been done years ago) so that is chewing up every spare bit of energy we have currently.

I've approved your account (actually did that yesterday) so please feel free to open a new thread in the forums if you have any questions, need support and/or have feedback or ideas for us.

Re your question/problem of setting a domain, there are a few workarounds. I'll note them here and then expand below:

• use IP address (instead of domain)
• local hosts file entry
• install a DNS server locally
• use a tklapp.com (or other dynamic DNS service) domain
• your own domain

IP Address

This is the quickest and dirtiest approach. Simply set a static IP for the server at initial launch time (i.e. in Proxmox - you're likely already doing that). Then on firstboot, when asked for a domain, give the IP. Note that you will forever need to click through the https security warning in your browser, as you can't get a TLS cert for an IP address.

Note that if you only have Nextcloud available locally, or hosted publicly, that will work fine. But you won't be able to access it via both a local (LAN) IP and a public IP, so you'll need to choose.

hosts entry

You could use domain (real or just a made up dummy domain) and then just add an entry to the hosts file(s) of any PCs you intend to connect to Nextcloud with (i.e. the client PCs). In Linux the hosts file is /etc/hosts and I think that's also where it is on Mac too (although not sure). Windows has a hosts file too, but IIRC it's buried in system32, deep in the Windows dir. You'll need to google for details.

The format of entries is:

# IP_Address    FQDN/hostname
#
# E.g.:
192.168.1.111	nextcloud.test

The above example shows me setting a (dummy) domain of nextcloud.test that points to the IP of 192.168.1.111. Note that if you use an actual domain that you own, you can even get a proper CA signed TLS cert (but I won't go into that right now).

FYI additional domains/hostnames for the same IP can be included afterwards (space separated, on the same line).

install a DNS server locally

dnsmasq is really nice low resource easy to use DHCP and DNS server. It should be installable on any Linux (inc TurnKey). For TurnKey (and other Debian like distros) use apt.

As noted it can do DHCP too, but you likely already have one of those on your network (and more than one will cause you issues), so either don't enable DHCP in dnsmasq (it should only provide DNS by default), or disable the one on your network first (it's likely running on your router). Static DNS entries are added to dnsmasq via hosts file entries as noted above (except the entries go on teh host running dnsmasqq, rather than your local computer).

tklapp.com - or other dynamic DNS service domain

The above options are all serviceable if you only intend to access your Nextcloud server on your LAN. But if you want to access it externally, then you are definitely best off using a proper domain. Then you can easily get a CA signed cert (so no clicking through the security warnings in your browser).

use your own domain

This is probably what you want eventually, your very own domain, for all your hosting needs. If you set it up via a supported provider, you don't even need a static public IP to make it work. That is because many DNS registrars now support updates via API, so you can use a generic dynamic DNS client to update the IP as/when it changes.

Hopefully that's enough to get you started. If you want to discuss more, please start a new thread and I'll respond ASAP.

Your user account has been approved. Good luck with it all and if you hit any problems or have any questions, feedback or feature requests, please feel free to open a new thread.

Welcome to TurnKey Alex. Please feel free to open a new forum thread if/when you have concerns, questions or feedback.

Please feel free to start a new thread if/when you have issues, questions or feedback for us. Good luck with it all! :)

Hi Andrew. Welcome to TurnKey. Please feel free to open a new thread if you have any questions, concerns or feedback for us.

Hi Artyom, welcome to TurnKey.

I only speak English so please use that. If you're English isn't great, then please use a translation service, such as Google Translate.

To get a Hub API key, please sign up to the TurnKey Hub.

Once signed up, you can access Hub support via the "in app" support (blue icon towards bottom right of every page) or via email to support AT turnkeylinux.org.

Please also feel free to open a new thread in our forums if you have any further concerns, questions or feedback for us.

To get a Hub API key, please sign up to the TurnKey Hub. Although I note that it is a "value add" service and can be skipped if your data is not important (e.g. testing) or you have an alternate remote backup regime.

Once signed up, you can access Hub support via the "in app" support (blue icon towards bottom right of every page) or via email to support AT turnkeylinux.org.

Please also feel free to open a new thread in our forums if you have any further concerns, questions or feedback for us.

Hi Zach, welcome to TurnKey.

Please don't hesitate to open a new thread in our forums if you have any TurnKey related concerns, questions and/or feedback for us.

Also, your plans sound cool. I'd be interested to hear how you go with them. Please keep us updated.

I'm not at all familiar with Caddy, so I can't help with specifics, but the error message suggests that Caddy is trying to connect to the NC server via plain HTTP (rather than HTTPS).

I see 2 options here. One would be to disable the http to https redirect (in our Nextcloud app) and remove the port 443 from your Caddy config. Alternatively (and the preferred method IMO) would be to configure Caddy to explicitly use HTTPS when connecting to the backend Nextcloud server.

Hopefully the first option should be fairly straight forward and should only require config on your Nextcloud server. Basically just remove the rewrite stuff from the Apache nextcloud.conf and restart Apache. If you need more specifics, please ask. Oh also, I assume you'll want to remove the ':443' from your Caddy config

The other (preferred) option will require you to change Caddy config As I'm not familiar with Caddy, I'm not sure exactly how you do that, but if I had to guess, I'd try just adding the schema to the host in your Caddy config. I.e. this:

nc.example.duckdns.org {
        encode gzip
        reverse_proxy https://192.168.0.232:443
}

No idea if that will work though. If not, perhaps ask someone from the Caddy community?

I've approved your account. Please feel free to open a new thread in the forums if you have any TurnKey related concerns, issues and/or feedback for us.

Hi Oscar, welcome to TurnKey Linux! :)

Please do not hesitate to open a new thread in our forums if you have any questions, concerns and/or feedback for us.

And welcome to TurnKey. Please feel free to open a new thread if/when you have questions, etc.

Hi Augusto, welcome to TurnKey. Your account is now enabled so you should be able to log in now.

Thanks for sharing info about how you came across us. TBH, I wasn't aware of those scripts. I should have a closer look sometime. FWIW I'm a Proxmox user too, but I just download and launch them via the web UI mostly (because I don't recall the commands OTTOMH - and wasn't previously aware of that collection of scripts).

Sounds like you have a pretty good set up, probably better than mine... :D

I'm in Tasmania, Australia, so we're miles away from each other, nearly on opposite sides of the planet! Cool that we can interact like this despite that.

Anyway, good luck with it all. If you have any questions, issues and/or feedback for us, please feel free to open a new thread.

Cheers, Jeremy

Hi Armin, welcome to TurnKey :)

Please start a new thread if you need more support/help, but I'll give you a quick bit of info here, now.

Firstly, as a general rule, assuming you are self hosting, I always recommend separate VMs. So long as you don't have limitations that make that difficult, the redundancy is a plus IMO. And you won't have future issues upsetting other software when you are updating/tweaking etc if you only have one app per server.

Beyond ISOs, we also provide LXC builds (primarily intended for ProxmoxVE specifically) so if you have LXC on a server (or better still, run Proxmox), you could use separate TurnKey LXC builds on the same host. If you're not familiar with LXC, then it's a containerization platform, sort of like Docker, but a full OS, rather than just for a specific app. LXC apps share the hosts kernel so have minimal overhead. FWIW LXC pre-dates Docker and initial Docker implementations were based on LXC. Personally, I'm not a huge fan of Docker, but I am a massive fan of LXC! :)

Having said that, hosting 2 Docuwikis on the same server is probably not so much of a big deal. So if it works for you, why not? I wouldn't be running other software (such as Bugzilla) on it too though. IMO that's the value of VMs, you can keep stuff isolated and then changes on one, don't cause issues anywhere else.

Good luck and please open a new thread if you want to discuss further and/or if you hit any issues, have further questions, etc.

Hi Björn, welcome to TurnKey Linux. I only speak English, so please post in English if you can. If you can't then post in German, but please also use a translation service (e.g. Google Translate) to translate to English.

To get an API key, please sign up to the TurnKey Hub.

If you also want a TurnKey website account (e.g. for posting on the forums, or subscribing to our (very low traffic) newsletter), please sign up (I checked but you don't have a website user account with the email you posted this from). Then either post again here, or shoot me a message via the Hub "in app" support or email to support AT turnkeylinux.org and I'll enable it.

Hallo Björn, willkommen bei TurnKey Linux. Ich spreche nur Englisch, also posten Sie bitte auf Englisch, wenn Sie können. Wenn Sie nicht auf Deutsch posten können, nutzen Sie bitte auch einen Übersetzungsdienst (z. B. Google Translate), um ins Englische zu übersetzen.

Um einen API-Schlüssel zu erhalten, melden Sie sich bitte beim TurnKey Hub an.

Wenn Sie auch ein TurnKey-Website-Konto wünschen (z. B. zum Posten in den Foren oder zum Abonnieren unseres (sehr wenig frequentierten) Newsletters), melden Sie sich bitte an ( Ich habe es überprüft, aber Sie haben kein Website-Benutzerkonto mit der E-Mail-Adresse, von der aus Sie dies gepostet haben. Dann posten Sie entweder noch einmal hier oder senden Sie mir eine Nachricht über den Hub-In-App-Support oder eine E-Mail an support AT turnkeylinux.org und ich werde es aktivieren.