@joearkay (Joe ) posted a new topic, subject "balena-node-red - access to editor on balena tunnel only". It read:

   Hi all,
    
    I'm basing a project off of balena-node-red and I'd like to disable the editor from being visible on the network, so that nosy users can't open the web editor and take a peek. I would of course still like to access the editor via `balena tunnel <uuid> -p [port]:[port]`.
    
    I've confirmed that I can currently use `balena tunnel` as described. I tried to turn off editor access by editing the `settings.js` file for Node-RED to set `uiHost` to localhost (`(242)340-5218`) but this seems to block any connections at all, which isn't expected.
    
    Is it the case that the tunnel is considered outside of localhost, therefore the UI is not visible?
    
    Can somebody advise?

To which @mpous (Marc) replied

    Hello @joearkay that's a really interesting question, but let me take 1 step back.
    
    Did you try to use the credentials to access to the UI? balena-node-red/settings.js at 4a75e4845f8a0c6edf5b430fa2c7709596c121e2 · balenablocks/balena-node-red · GitHub
    
    With that you would avoid to people to access to the UI, right? is that what you want?

Then @joearkay (Joe ) said

    Thanks for the comment. Yes, I'm using credentials so that nobody can edit the Node-REDs flow via the editor, however without logging into Node-RED it's still possible to have a look into the flows, credentials and generally ‘poke' into a UI that I'd prefer to not be accessible on the local network.
    
    For example, see the screenshot below of what is visible without logging into the editor:  
    
    
    image1768×781 80.6 KB
    
    I'd like to limit access to the web editor to either ssh tunnel locally, or balena tunnel remotely. Do you think this may be possible?
    
    Thanks

So @mpous (Marc) replied

    Yes! you are right @joearkay i was confused with another app that introduces the credentials before getting into NodeRED!
    
    Let me research a bit more on this!
    
    Thanks

@joearkay (Joe ) replied

    Fantastic - thanks. I think the `uiHost` idea doesn't work because this limits access to the localhost only. `balena tunnel` allows access to ports available externally to the device, for which the Node-RED editor port 80 wouldn't be in this case. So perhaps `uiHost` is not the answer here.

So @mpous (Marc) replied

    Could you please confirm the `network_mode` of your nodeRED service on your docker compose?

So @joearkay (Joe ) replied

    `network_mode: host`, so should not be isolated to the container only.

Then @mpous (Marc) said

    That should work @joearkay … not sure about the `uiHost` feature of NodeRED. I'm going to research more today as i'm preparing a project with NodeRED!

To which @pdcastro (Paulo Castro) replied

    > `balena tunnel` allows access to ports available externally to the device
    
    @joearkay, I tested it and indeed observed `balena tunnel` to print “500 Internal Server Error” when a socket/port is bound to `(242)340-5218` instead of being bound to `8b7c:f320:99b9:690f:4595:cd17:293a:c069` or `(242)340-5218`:   
    tunnel: "500 Internal Server Error" when connecting to remote port bound to (242)340-5218 · Issue #2366 · balena-io/balena-cli · GitHub
    
    I have found a workaround that combines `ssh -L` with `balena tunnel` to allow remote access to a remote port bound to `(242)340-5218`. It is described as comment in the same GitHub issue. With that workaround, I believe you could continue to set `uiHost` to `(242)340-5218`, and access the UI remotely through the tunnel to your workstation. Let us know if works for you.

So @mpous (Marc) replied

    Thank you @pdcastro on showing a workaround to help @joearkay to access via localhost.
    
    Joe i found another way to introduce the login and password before accessing the Node Red UI using a “public” local IP address. Not sure what NodeRED are you using, but if you go to the `setttings.js` file and delete on the `adminAuth` the `defaults` lines, then nodeRED will force you to access using username and password.
    
    Check here on our repo balena-node-red/settings.js at 4a75e4845f8a0c6edf5b430fa2c7709596c121e2 · balenablocks/balena-node-red · GitHub
    
    BTW to create the password follow this tutorial Securing Node-RED : Node-RED at balena we are trying to improve this very soon! I will keep you updated!
    
    Let me know if that works as well

So @joearkay (Joe ) replied

    Interesting, thanks both @mpous and @pdcastro \- I'm going to give both suggestions a try and feedback!

@mpous (Marc) replied

    BTW @joearkay check here the latest iteration of the `balena-node-red` block we published today!
    
    GitHub
    
    ### GitHub - balenablocks/balena-node-red: a node-red application with...
    
    a node-red application with balena-supervisor support, can be managed remotely via balena publicURL - GitHub - balenablocks/balena-node-red: a node-red application with balena-supervisor support, c...
    
    the `username` and `password` credentials are managed through `Device Variables`.

So @joearkay (Joe ) replied

    Thanks - checking out now! I just so happened to watch your section on the Node-RED con 2021 - looks like I asked the right question at the right time

So @mpous (Marc) replied

    indeed! The right question at the right time 
    
    Let me know if that works for you @joearkay


{'source': 'discourse', 'url': 'https://forums.balena.io/t/balena-node-red-access-to-editor-on-balena-tunnel-only/349713', 'title': 'balena-node-red - access to editor on balena tunnel only', 'views': 293, 'has_accepted_answer': False, 'word_count': 985, 'like_count': 2, 'reply_count': 12, 'participant_count': 3, 'posts': 14, 'tags': '', 'author': '@joearkay (Joe )', 'participants': '@joearkay (Joe ), @mpous (Marc), @pdcastro (Paulo Castro)', 'image_url': [None], 'created_at': '2021-10-16T13:18:12.113Z', 'last_posted_at': '2021-10-26T08:04:20.615Z'}