Hi @markp,
To find a solution to my Asset Server issue, I experimented with 2 approaches to rewriting the web_asset_store.xml output and both appear to work. Here are the two approaches I tested:
- Overriding the default XML file with my own xml file (with the corrected urls) when starting the asset-server container.
Example:
podman run --detach --pod sp7_pod_mycology --name sp7_asset-service_mycology -u root -v /data/home/podman/apps/specify/volumes/sp7dev2_mycology/specify-attachments:/home/specify/attachments:Z -v ./spasset.py:/home/specify/settings.py:Z -v ./web_asset_store.xml:/home/specify/web_asset_store.xml:ro,Z --env-file='./spasset.env' specifyconsortium/specify-asset-service
- Using the sub_filter directive in the Nginx configuration file to dynamically rewrite the web_asset_store.xml file.
Example:
# proxy these urls to the asset server
location ~ ^/(web_asset_store.xml) {
client_max_body_size 0;
resolver 127.0.0.11 valid=30s;
set $backend "http://0.0.0.0:5050";
proxy_pass $backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
sub_filter 'http://mycology.devsp.cfs.nrcan.gc.ca:443' 'https://mycology.devsp.cfs.nrcan.gc.ca';
sub_filter_once off;
sub_filter_types text/xml;
}
# proxy these urls to the asset server
location ~ ^/(fileget|fileupload|filedelete|getmetadata|testkey) {
client_max_body_size 0;
resolver 127.0.0.11 valid=30s;
set $backend "http://0.0.0.0:5050";
proxy_pass $backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
mycology.devsp.cfs.nrcan.gc.ca/web_asset_store.xml output:
<?xml version="1.0" encoding="UTF-8"?>
<urls>
<url type="read"><![CDATA[https://mycology.devsp.cfs.nrcan.gc.ca/fileget]]></url>
<url type="write"><![CDATA[https://mycology.devsp.cfs.nrcan.gc.ca/fileupload]]></url>
<url type="delete"><![CDATA[https://mycology.devsp.cfs.nrcan.gc.ca/filedelete]]></url>
<url type="getmetadata"><![CDATA[https://mycology.devsp.cfs.nrcan.gc.ca/getmetadata]]></url>
<url type="testkey">https://mycology.devsp.cfs.nrcan.gc.ca/testkey</url>
</urls>
After experimenting with different configurations, I think I’ve identified the main issue I’ve been having with the Asset Server: it appears to stem from using “https” in the ASSET_SERVER_URL variable. When I set ASSET_SERVER_URL with an “HTTPS” URL (e.g. https://mycology.devsp.cfs.nrcan.gc.ca/web_asset_store.xml), all Specify containers start as expected, but the SP-7 worker containers immediately stop afterwards.
Since all my HTTP traffic is redirected to HTTPS, I encounter the same problem if I use the HTTP version of my domain name (http://mycology.devsp.cfs.nrcan.gc.ca/web_asset_store.xml).
As soon as the Asset Server URLs use “HTTPS” the SP-7 worker experiences issues. So even if I rewrite the web_asset_store.xml output to use the correct https URLs, it breaks the SP-7 worker container.
Here’s the SP-7 worker log error:
File "/opt/specify7/ve/lib/python3.8/site-packages/requests/adapters.py", line 620, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='mycology.devsp.cfs.nrcan.gc.ca', port=443): Max retries exceeded with url: /testkey?random=76b5a60d-6427-4709-a81a-b97137825d87&token=ded10a9bf9842993d14dafaac4fccf01%3A1730923242 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)')))
I may be wrong, but it seems there might be an internal SSL issue with the SP-7 worker. Not sure how to move forward with this. 
P.S. Mark, I’m not a Python programmer, but if you think additional testing in Python might help, could you provide an example request I could try in Postman? Thanks
