NeXuS Session Compass — 2026-06-30¶
Living document — updated as we go. Read this when returning to pick up where we left off.
Session Focus¶
Services, security stack, and LAN infrastructure — Jitsi, Jellyfin, fwsnort boot fix.
Work Done This Session¶
1. Jitsi Meet — LAN HTTPS / WebRTC fix¶
Problem: WebRTC not available in any browser — modern browsers require HTTPS secure context for camera/mic. Jitsi was running plain HTTP on port 8080.
Root cause chain:
1. Jitsi web container (nginx) only serves HTTP by default — no SSL without Let's Encrypt
2. Browser connecting to http://192.168.1.15:8080 → WebRTC blocked by browser security policy
3. Attempted SSL env vars (SSL_CERT_PATH, SSL_KEY_PATH) in jitsi/web container — not supported by that image
Fix applied: Added Caddy as a reverse proxy container in the compose stack.
- Caddy handles TLS termination on port 8443 using our self-signed cert
- Jitsi web stays plain HTTP internally (port 80, internal only — no longer exposed on host)
- PUBLIC_URL changed to https://192.168.1.15:8443
Self-signed cert location: ~/.jitsi-meet-cfg/web/certs/server.crt / server.key
- Generated with: openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout server.key -out server.crt -subj "/CN=192.168.1.15" -addext "subjectAltName=IP:192.168.1.15"
Files modified:
- /home/user/Projects/jitsi/compose.yaml — added Caddy service, removed host port 8080 from web service
- /home/user/Projects/jitsi/.env — PUBLIC_URL=https://192.168.1.15:8443
- /home/user/.jitsi-meet-cfg/caddy/Caddyfile — created
Caddyfile at /home/user/.jitsi-meet-cfg/caddy/Caddyfile:
{
https_port 8443
auto_https off
admin off
}
:8443 {
tls /certs/server.crt /certs/server.key
reverse_proxy web:80 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto https
}
}
Access URL: https://192.168.1.15:8443 — accept cert warning, then WebRTC works.
Restart command:
Status: 🔵 DESIGNED — Caddy config written, stack restarted. WebRTC not yet confirmed working by user.
2. Jellyfin — Missing web client¶
Problem: Jellyfin server started but no web UI — error:
[ERR] The server is expected to host the web client, but the provided content directory
is either invalid or empty: /usr/lib/jellyfin/jellyfin-web
Fix:
Note: jellyfin-web is a separate Alpine package from jellyfin. Both are in the community repo at version 10.11.11.
Status: 🔵 DESIGNED — command given, user had boot failure (fwsnort) before confirming.
3. fwsnort — Boot networking failure¶
Problem: System fails to start networking at boot due to fwsnort errors in /etc/network/if-pre-up.d/fwsnort.
Two distinct errors found:
Error A — Invalid !port syntax in multiport rules¶
- Root cause: fwsnort generates rules like -m multiport ! --dports 25,!445,!1500
- The !port syntax inside a multiport port list is invalid under iptables-nft (nf_tables backend)
- Specific rule: sid:2026525 — ET TROJAN Win32/BlackCarat XORed CnC Checkin
Bad line found at line 20817 in /var/lib/fwsnort/fwsnort.save:
Strip command (to run after archiving):
doas cp /var/lib/fwsnort/fwsnort.save /var/lib/fwsnort/archive/fwsnort.save.$(date +%Y%m%d)
doas sed -i '/,![0-9]/d' /var/lib/fwsnort/fwsnort.save
Error B — Kernel OOM / iptables table full¶
- Root cause: fwsnort has 31,063 rules — too many for kernel iptables memory table on a desktop - This is a fundamental capacity problem, not a syntax problemFix applied — Step 1 (non-fatal hook)¶
Made fwsnort failure non-blocking for networking:
doas sh -c 'cat > /etc/network/if-pre-up.d/fwsnort << '"'"'EOF'"'"'
#!/bin/sh
# Run fwsnort rules — failure is logged but does NOT block networking
/var/lib/fwsnort/fwsnort.sh 2>/var/log/fwsnort/preup-errors.log || \
echo "fwsnort: rules failed, see /var/log/fwsnort/preup-errors.log" >&2
EOF'
Fix applied — Step 2 (remove from boot entirely)¶
31,063 rules exceeds what the kernel can load — fwsnort must NOT run at boot on this system.
Decision: fwsnort is an IDS logging tool, not a packet filter — it should run on-demand only, not at boot. Networking is more important than IDS coverage during boot.
To run fwsnort manually when needed:
Status: ✅ TESTED (step 2 — removal) — user confirmed done. Networking should now start cleanly.
4. darkice / icecast dependency warning¶
Problem: Service 'darkice' needs non existent service 'icecast' on boot.
Not an error — this is expected behavior. darkice depends on icecast for audio streaming. If icecast isn't set up as an OpenRC service, darkice just won't auto-start. Not breaking anything.
Fix (if needed later):
Status: 🔴 PLANNED — not addressed, cosmetic only.
Open Items¶
| Item | Status | Notes |
|---|---|---|
| Jellyfin web client install | 🔵 DESIGNED | doas apk add jellyfin-web && doas rc-service jellyfin restart |
| Jitsi WebRTC — confirm working | 🔵 DESIGNED | Browse to https://192.168.1.15:8443, accept cert warning |
| fwsnort bad rules strip | 🔵 DESIGNED | doas sed -i '/,![0-9]/d' /var/lib/fwsnort/fwsnort.save (archive first) |
| fwsnort persistence strategy | 🔴 PLANNED | 31K rules = too heavy for boot; decide if fwsnort is needed at all or trim ruleset |
| icecast / darkice | 🔴 PLANNED | Set up icecast service if streaming needed |
Key File Locations¶
| File | Purpose |
|---|---|
/home/user/Projects/jitsi/compose.yaml |
Jitsi Podman compose — includes Caddy proxy |
/home/user/Projects/jitsi/.env |
Jitsi config — PUBLIC_URL, passwords |
/home/user/.jitsi-meet-cfg/caddy/Caddyfile |
Caddy TLS proxy config |
/home/user/.jitsi-meet-cfg/web/certs/ |
Self-signed cert for Jitsi HTTPS |
/var/lib/fwsnort/fwsnort.save |
fwsnort iptables rules (31K lines) |
/var/lib/fwsnort/archive/ |
fwsnort backups |
/etc/network/if-pre-up.d/ |
Network pre-up hooks — fwsnort removed from here |