While trying to fix the Portainer issues, I noticed my drive was full, so I migrated WSL to my E drive. WSL had Ubuntu and Docker Desktop, and everything seems to be fine with my immich container (internal and external network access) in after the migration, it lives in Docker Desktop to I am assuming that it good but something is goofed now, and I am struggling. My issue now is that when I went to install Sparkbox, I am not getting an egress error but I don't get why. I have DNS communication, but still getting the egress error. I was also looking for where to buy the pro version to support this, but I can't seem to find that sudo docker exec sb-dashboard node -e "require('dns').lookup('webhook.tomsparkbox.com',(e,a)=console.log(e?e.code:a))" 172.67.213.11 sudo docker exec sb-dashboard sh -c "node -e \"fetch('https://webhook.tomsparkbox.com').then(r=console.log(r.status)).catch(e=console.log(e.code||e.message))\"" 404 P.S. I am not sure if there are Install instruction for when it is being set up on Windows 11 using WSL, but the current install intruction start with SSH in, but I just launch my WSL instance of Ubuntu to access the terminal and run curl from there
13 replies
GamerX06 wrote:
curl -sSL https://get.tomsparkbox.com/install.sh | sudo bash [SparkBox] Running in VPS mode [SparkBox] Network profile: private (default-route source IP is private/CGNAT: 172.30.187.143) [SparkBox] Data directory (media/photos/books/manga): /opt/sparkbox/data [SparkBox] System clock is in sync (0s off Cloudflare's reference) [SparkBox] Detected: Ubuntu 24.04.4 LTS [SparkBox] RAM: 7912MB detected. 8GB+ recommended for media modules. [SparkBox] Installing system dependencies (detected: debian)... [SparkBox] System dependencies installed (debian). [SparkBox] Docker already installed: Docker version 29.4.3, build 055a478 [SparkBox] Docker Compose: 5.1.3 [SparkBox] Existing SparkBox install found (v1.6.88). Upgrading via atomic rename-swap — .env, state/, and module data are preserved. [SparkBox] Downloading SparkBox... [SparkBox] Verifying release integrity... [SparkBox] SHA256 digest verified [SparkBox] ed25519 signature verified [SparkBox] Stopping running containers for a safe upgrade snapshot... Container sb-wg-easy Removing Container sb-wg-easy Removed Network sparkboxsbvpn Removing Network sparkboxsbvpn Removed [OK] SparkBox stopped. [SparkBox] Upgrade applied atomically. Rollback copy preserved at /opt/sparkbox.rollback-1778477999 until health probe confirms success. [SparkBox] SparkBox downloaded to /opt/sparkbox [SparkBox] SparkBox installed to /opt/sparkbox [SparkBox] Configuring firewall (UFW)... [SparkBox] Opening module ports in UFW (parsed from modules//docker-compose.yml)... [SparkBox] Opened 11 module ports in UFW [SparkBox] Firewall configured: SSH (22), HTTP (80), HTTPS (443), Dashboard (8443), WireGuard (51820/udp, 51821/tcp), 11 module ports [SparkBox] Setting UFW forward policy to ACCEPT (container egress)... [SparkBox] UFW forward policy set to ACCEPT — containers can reach the internet [SparkBox] Verifying container egress to license server (real sbproxy network)... [SparkBox] Container egress check failed — sbproxy cannot reach webhook.tomsparkbox.com. [SparkBox] This is fine if you only need free SparkBox. Optional Pro-tier license [SparkBox] activation won't work until container egress is restored, but every [SparkBox] bundled app (Jellyfin, Pi-hole, Vaultwarden, Nextcloud, etc.) runs [SparkBox] the same either way — there is nothing to fix unless you plan to [SparkBox] activate a paid license. [SparkBox] If you DO want to fix it, common causes (in rough order of likelihood): [SparkBox] 1. UFW forwarding policy: grep DEFAULTFORWARDPOLICY /etc/default/ufw (should be ACCEPT) [SparkBox] 2. Run: sudo sparkbox repair-network [SparkBox] 3. If you have a custom /etc/docker/daemon.json, check its DNS settings. [SparkBox] (Only consider removing it if you didn't put it there yourself.) [SparkBox] 4. From inside dashboard: sudo docker exec sb-dashboard node -e "require('dns').lookup('webhook.tomsparkbox.com',(e,a)=console.log(e?e.code:a))" [SparkBox] iptablenat module persisted for boot (wg-easy support) [SparkBox] SSH: /etc/ssh/sshdconfig not found — skipping SSH hardening (no sshd installed)
tomspark wrote:
Your own diagnostics actually look healthy — DNS resolved fine and the fetch returned 404. The webhook is a Cloudflare Worker that only serves POST endpoints, so 404 on a GET is the correct response, and our install check was using curl -f which (annoyingly) treats any 4xx as a network failure. Just shipped 1.6.89 with that fixed — sudo /opt/sparkbox/sparkbox update and re-run install if you want the clean output. Pro tier isn't live yet, so nothing to buy — free SparkBox is the full bundle. WSL2 on Windows 11 isn't a supported environment (designed for bare-metal/VM Linux on a NAS or VPS) but if your containers are running you're effectively fine.
GamerX06 wrote:
So maybe I need to take a step back and rethink my deployment and environment. My ultimate goal is to have this manage all my media that I'm currently using with Plex on a Win11 box separate from my PVE host. I did this originally for cheap HW encoding since I lacked the bandwidth for the direct streaming, but that will change in the near future. I am getting a 10G sym fiber connection. In the interim, I'd still like to get it functional, but don't want to add to your load for an unsupported deployment so I'll keep my requests to a minimum
tomspark wrote:
All good — questions are exactly what this forum is for, not load. Honestly your best path for media management is a Proxmox VM or LXC on your PVE host: SparkBox runs cleanly in either, hardware transcoding passes through cleanly, and you get a dedicated IP on the LAN instead of WSL2's NAT shuffle. A 2-core 4GB LXC running install.sh is enough for Jellyfin + the arr stack. Hold off on the 10G fiber decision until you've tried that — the network shape matters less than the host OS, and SparkBox-on-WSL is fighting Windows' container plumbing the whole way.
GamerX06 wrote:
Sweet! I will keep asking questions :) Starting with, do you see a path for me to fully jump into Jellyfin in Sparkbox but still be able to link to Plex? I am by no means a Linux guy, so I am on the edge of my comprehension with most of what I am saying here, but I am assuming that I can spin up an LXC of Sparkbox (no idea where to start there) and then one of Plex and somehow link the datastores so that all my friends can access via Plex? As for the 10G fiber, I will be getting it for less than I pay for my Spectrum connection, since I am signing on as a referral partner. Just waiting for the construction to finish :)
tomspark wrote:
Totally doable — and a really common pattern. The play is two LXC containers side by side on your PVE host: one running SparkBox (Jellyfin + arr stack), one running just Plex. Both mount the same media folder on the Proxmox host, so your friends keep streaming via Plex while you migrate to Jellyfin at your own pace. Easiest on-ramp as a Linux beginner is the Proxmox community-scripts project (search 'proxmox community scripts plex' on GitHub — they have one-liners for both Plex and a generic Ubuntu LXC where you'd then run the SparkBox install.sh). Get both LXCs up first, then ping me here and I'll walk you through the shared-storage config — it's basically 2 lines in each LXC's conf file.
GamerX06 wrote:
Ok so I have Both LXCs up and running, I got Sparkbox installed and now I am attempting to get my NordVPN account to work with the WireGuard Protocol. i followed this guide ( https://lazyadmin.nl/home-network/nordvpn-wireguard-as-unifi-vpn-client/ ) to get a conf file that has [Interface] ListenPort = REMOVED PublicKey = REMOVED PrivateKey = REMOVED Address = 10.5.0.2/32 DNS = 1.1.1.1 [Peer] PublicKey = REMOVED AllowedIPs = 0.0.0.0/0, ::/0 Endpoint = REMOVED PersistentKeepalive = 60 ForcedHandshake = 5 but things dont seem to be connecting also when going to Setting - Network - Edit VPN Settings the widow doesnt appear till i click over to the Home page then i see it but i need to set Chrome magnification to 75% to see the top option I just ordered 2 4TB refurb drives that will be here tomorrow so that I can make a ZFS.... i think.... of 8TBs to store my media on. I don't know if the mounting commands will need all that done first but assuming it will.
GamerX06 wrote:
I also just tried to access Portainer for the first time on the LXC, and when using the generated creds I get error Failure Unauthorized �2026-05-11T19:28:26.665269119Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/cmd/portainer/main.go:321[0m[36m [0m encryption key file not present | [36mfilename=[0m/run/secrets/portainer �2026-05-11T19:28:26.665301444Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/cmd/portainer/main.go:360[0m[36m [0m proceeding without encryption key | �2026-05-11T19:28:26.665306459Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/database/boltdb/db.go:137[0m[36m [0m loading PortainerDB | [36mfilename=[0mportainer.db �2026-05-11T19:28:26.871587169Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/cmd/portainer/main.go:514[0m[36m [0m instance already has an administrator user defined, skipping admin password related flags. | �2026-05-11T19:28:26.871686132Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/chisel/service.go:199[0m[36m [0m found Chisel private key file on disk | [36mprivate-key=[0m/data/chisel/private-key.pem V2026-05-11T19:28:26.871914456Z 2026/05/11 19:28:26 server: Reverse tunnelling enabled t2026-05-11T19:28:26.871922567Z 2026/05/11 19:28:26 server: Fingerprint REMOVED \2026-05-11T19:28:26.872202691Z 2026/05/11 19:28:26 server: Listening on REMOVED �2026-05-11T19:28:26.932318175Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/cmd/portainer/main.go:634[0m[36m [0m starting Portainer | [36mbuildnumber=[0m21 [36mgoversion=[0mgo1.26.2 [36mimagetag=[0m2.41.0-linux-amd64 [36mnodejsversion=[0mv22.22.2 [36mpnpmversion=[0m10.27.0 [36mversion=[0m2.41.0 [36mwebpackversion=[0m5.105.0 �2026-05-11T19:28:26.939187923Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/http/server.go:370[0m[36m [0m starting HTTPS server | [36mbindaddress=[0m:9443 �2026-05-11T19:28:26.942148163Z [90m2026/05/11 07:28PM[0m [32mINF[0m [1mgithub.com/portainer/portainer/api/http/server.go:354[0m[36m [0m starting HTTP server | [36mbindaddress=[0m:9000
tomspark wrote:
Glad both LXCs are humming. Two answers: VPN — we've moved over to Surfshark since their WireGuard config is cleaner (they hand you the private key directly). Nord doesn't expose the private key from their dashboard; you have to generate it via their CLI (nordvpn set technology nordlynx then wg show wg0 private-key). Want to switch to Surfshark, or want me to walk you through the Nord-CLI key-extract step? Portainer — the "encryption key file not present" line in the log is normal (it's an optional Portainer-side feature, not the cause of your Unauthorized). The Unauthorized is just the admin password. Run sudo cat /opt/sparkbox/state/portainer-admin-password.txt and paste that with username admin. If THAT also fails, your install hit the v1.6.82 portainer regen bug — fixed by sudo /opt/sparkbox/sparkbox update && sudo /opt/sparkbox/sparkbox restart core.
GamerX06 wrote:
so i ran sudo cat /opt/sparkbox/state/portainer-admin-password.txt and it shows the same user and pass that are displayed as the generated but still doesnt work so I ran sudo /opt/sparkbox/sparkbox update && sudo /opt/sparkbox/sparkbox restart core and still the same behavior when trying the generated creds. The issue with going to Setting - Network - Edit VPN Settings the widow doesnt appear till clicking over to the Home page then it there waiting for me but i need to set Chrome magnification down to 75% to see the top and save options is still there I have my PrivateKey out of my .conf that I created, it seems to connect fine with I try it with WireGuard but not with sparkbox i am using $Token = REMOVED ; (Invoke-RestMethod -Uri "https://api.nordvpn.com/v1/users/services/credentials" -Headers @{Authorization=("Basic " + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("token:$Token"))) }).nordlynxprivatekey to get the key
tomspark wrote:
Hey @GamerX06 — couple things on the new questions. On the egress check: v1.6.89 dropped the -f flag from that curl so the 404 from webhook.tomsparkbox.com doesn't trip it anymore. Your diagnostic (DNS resolves, fetch returns 404) is the expected-success path now. Can you paste the exact text of the error message you're seeing, plus the output of sudo /opt/sparkbox/sparkbox --version? Want to confirm you're on the current install (1.6.97) and not somehow on a cached older install.sh. On Pro: free beta — Pro isn't live for sale yet, what you have is the full bundle. Nothing to buy right now, the support intent is appreciated though. On WSL: yep, your path (launch Ubuntu in WSL → curl install.sh) is exactly right. No separate Windows install — WSL gives you a real Linux env which is all the script needs.
GamerX06 wrote:
root@ubuntu:~ /opt/sparkbox/sparkbox --version SparkBox v1.6.97 I am no longer on WSL I am on LXCs on PVE based on your advice from before so the portainer issue seems to have followed over to brand new set up that im pretty sure was after the v1.6.82 portainer regen bug but i did try that fix and same result of unauthorized Also just what to make sure i am being clear that there seems to be a GUI issue with the Edit VPN Settings on Setting - Network. it doesnt open till you switch to the home tab
tomspark wrote:
Three things @GamerX06: Portainer — the log line "instance already has an administrator user defined, skipping admin password related flags" means its DB has a stale admin user from before the regen ran. Manual nuke: sudo docker stop sb-portainer sudo rm -rf /opt/sparkbox/modules/core/config/portainer/ sudo docker start sb-portainer Wait ~30s, hit http://NAS-IP:9000, generated creds from sudo cat /opt/sparkbox/state/portainer-admin-password.txt should work. VPN Settings tab not rendering until you switch back — confirmed new GUI bug, will investigate. Workaround for now: go direct to http://NAS-IP:8443//settings/network. The egress warning is a known cosmetic false-positive on v1.6.97 — the docker run for the check has a 15s timeout that runs out on cold installs without curlimages/curl cached locally. Shipping v1.6.98 shortly with a 60s timeout. Your install is fine, ignore the warning.