Can web ui be accessable from other nodes?

[yeasy]

Seems I can only access the web ui on the node with the web ui.
When access from other nodes, the connection is refused.

[mdaffin]

By default consul is unauthenticated and so only binds to localhost. If you
want to access the web ui from another host you have to tell it to bind to
another address (see [1] and [2]). Bear in mind that this exposes the whole
api to that interface so you may want to enable the acls as well.
Alternatively you can proxy the api/webui through a web server such as
nginx or apache.

[1] https://www.consul.io/docs/agent/options.html#addresses
[2] https://www.consul.io/docs/agent/options.html#_client

On Mon, 3 Aug 2015 at 09:21 yeasy [email protected] wrote:

Seems I can only access the web ui on the node with the web ui.
When access from other nodes, the connection is refused.

—
Reply to this email directly or view it on GitHub
#1148.

[ryanbreen]

Great answer, James. Thanks!

[yeasy]

How can we let consul bind to validated local ip address automatically without telling the exact value.

0.0.0.0 seems not work.

[mdaffin]

I am using the following without issue:
{
"addresses": {
"http": "0.0.0.0"
}
}

After you start consul what is the output of lsof -nPi :8500 (assuming
you are on linux)?

On Tue, 4 Aug 2015 at 09:11 yeasy [email protected] wrote:

How can we let consul bind to validated local ip address automatically
without telling the exact value.

0.0.0.0 seems not work.

—
Reply to this email directly or view it on GitHub
#1148 (comment).

[yeasy]

Great, how can i add this parameter as cli options?
consul agent -address 0.0.0.0?

[mdaffin]

For the cli I think you want the -http-addr or -client options, though I have not tried them.

[yeasy]

Ok, i will try. I want the consul-ui be accessed from outside, by automatically detecting the public IP on the host.
thanks!

[mdaffin]

I would be careful with doing it on a public ip, if you do not have acls enabled then you are exposing the whole api to the public unauthenticated. I would either enable acls on the cluster, or setup a proxy to do the authentication and only expose the proxy to the public.

[yeasy]

Yes, i am using a proxy.
Thanks for the reminder.