Lets Encrypt crashes on Raspberry Pi if you use DNS Challenge

[plantysnake]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

When trying to generate Lets Encrypt SSL certificate, if you check Use DNS Challenge and select either DuckDNS or Cloudflare as DNS provider, after you start generating, the pip error shows up, saying there was an error installing cffi package.
I'm doing this on Raspberry Pi 4 (arm/v7).

Nginx Proxy Manager Version

2.9.19

To Reproduce
Steps to reproduce the behavior:

1. Go to SSL Certificates
2. Click on Add SSL Certificate -> Let's Encrypt
3. Fill in data
4. Check Use DNS Challenge
5. Select DuckDNS or Cloudflare as DNS provider (others not tested)
6. Click Save
7. Wait for generation
8. Scroll to the top
9. See error

Expected behavior

No pip installation error during SSL generation.

Screenshots

Operating System

Raspberry Pi 4, arm/v7

Full error body

  error: subprocess-exited-with-error
  
  × pip subprocess to install build dependencies did not run successfully.
  │ exit code: 1
  ╰─> [120 lines of output]
      Collecting setuptools!=60.9.0,>=40.6.0
        Using cached setuptools-65.5.1-py3-none-any.whl (1.2 MB)
      Collecting wheel
        Using cached wheel-0.38.4-py3-none-any.whl (36 kB)
      Collecting cffi>=1.12
        Using cached cffi-1.15.1.tar.gz (508 kB)
        Preparing metadata (setup.py): started
        Preparing metadata (setup.py): finished with status 'done'
      Collecting setuptools-rust>=0.11.4
        Using cached setuptools_rust-1.5.2-py3-none-any.whl (23 kB)
      Collecting pycparser
        Using cached pycparser-2.21-py2.py3-none-any.whl (118 kB)
      Collecting typing-extensions>=3.7.4.3
        Using cached typing_extensions-4.4.0-py3-none-any.whl (26 kB)
      Collecting semantic-version<3,>=2.8.2
        Using cached semantic_version-2.10.0-py2.py3-none-any.whl (15 kB)
      Building wheels for collected packages: cffi
        Building wheel for cffi (setup.py): started
        Building wheel for cffi (setup.py): finished with status 'error'
        error: subprocess-exited-with-error
      
        × python setup.py bdist_wheel did not run successfully.
        │ exit code: 1
        ╰─> [36 lines of output]
            running bdist_wheel
            running build
            running build_py
            creating build
            creating build/lib.linux-armv7l-3.7
            creating build/lib.linux-armv7l-3.7/cffi
            copying cffi/pkgconfig.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/recompiler.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/verifier.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/ffiplatform.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/error.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/vengine_cpy.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/cparser.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/lock.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/commontypes.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/vengine_gen.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/__init__.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/model.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/backend_ctypes.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/api.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/setuptools_ext.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/cffi_opcode.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_cffi_include.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/parse_c_type.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_embedding.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_cffi_errors.h -> build/lib.linux-armv7l-3.7/cffi
            running build_ext
            building '_cffi_backend' extension
            creating build/temp.linux-armv7l-3.7
            creating build/temp.linux-armv7l-3.7/c
            arm-linux-gnueabihf-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -DFFI_BUILDING=1 -DUSE__THREAD -DHAVE_SYNC_SYNCHRONIZE -I/usr/include/ffi -I/usr/include/libffi -I/usr/include/python3.7m -c c/_cffi_backend.c -o build/temp.linux-armv7l-3.7/c/_cffi_backend.o
            c/_cffi_backend.c:2:10: fatal error: Python.h: No such file or directory
             #include 
                      ^~~~~~~~~~
            compilation terminated.
            error: command 'arm-linux-gnueabihf-gcc' failed with exit status 1
            [end of output]
      
        note: This error originates from a subprocess, and is likely not a problem with pip.
        ERROR: Failed building wheel for cffi
        Running setup.py clean for cffi
      Failed to build cffi
      Installing collected packages: wheel, typing-extensions, setuptools, semantic-version, pycparser, setuptools-rust, cffi
        Running setup.py install for cffi: started
        Running setup.py install for cffi: finished with status 'error'
        error: subprocess-exited-with-error
      
        × Running setup.py install for cffi did not run successfully.
        │ exit code: 1
        ╰─> [36 lines of output]
            running install
            running build
            running build_py
            creating build
            creating build/lib.linux-armv7l-3.7
            creating build/lib.linux-armv7l-3.7/cffi
            copying cffi/pkgconfig.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/recompiler.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/verifier.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/ffiplatform.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/error.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/vengine_cpy.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/cparser.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/lock.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/commontypes.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/vengine_gen.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/__init__.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/model.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/backend_ctypes.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/api.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/setuptools_ext.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/cffi_opcode.py -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_cffi_include.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/parse_c_type.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_embedding.h -> build/lib.linux-armv7l-3.7/cffi
            copying cffi/_cffi_errors.h -> build/lib.linux-armv7l-3.7/cffi
            running build_ext
            building '_cffi_backend' extension
            creating build/temp.linux-armv7l-3.7
            creating build/temp.linux-armv7l-3.7/c
            arm-linux-gnueabihf-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -DFFI_BUILDING=1 -DUSE__THREAD -DHAVE_SYNC_SYNCHRONIZE -I/usr/include/ffi -I/usr/include/libffi -I/usr/include/python3.7m -c c/_cffi_backend.c -o build/temp.linux-armv7l-3.7/c/_cffi_backend.o
            c/_cffi_backend.c:2:10: fatal error: Python.h: No such file or directory
             #include 
                      ^~~~~~~~~~
            compilation terminated.
            error: command 'arm-linux-gnueabihf-gcc' failed with exit status 1
            [end of output]
      
        note: This error originates from a subprocess, and is likely not a problem with pip.
      error: legacy-install-failure
      
      × Encountered error while trying to install package.
      ╰─> cffi
      
      note: This is an issue with the package mentioned above, not pip.
      hint: See above for output from the failure.
      [end of output]
  
  note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error

× pip subprocess to install build dependencies did not run successfully.
│ exit code: 1
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.

    at ChildProcess.exithandler (node:child_process:402:12)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:16)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:304:5)

Additional context

I was able to bypass this issue by going into the container, manually installing Rust and python3-dev related packages from scratch and running SSL generation again. It took about 10 minutes to complete and didn't bother me since, but on fresh install issue persists.

[plantysnake]

Comments in #2381 about Raspberry Pi issue seem to be directly related

[jc21]

I'm assuming this will also work:

pip install certbot-dns-duckdns --index-url https://www.piwheels.org/simple --prefer-binary

in which case it might be prudent to use the piwheels thing for all pip installs of plugins

[plantysnake]

@jc21
This fix does the job, but I have some concerns, because we already have all dependencies compiled locally, they are just under venv.
(From certbot build of nginx-full)

Or I might be wrong, if we are installing this package not for certbot, but into the system itself.

[jc21]

tbh I'm not a python guy so I don't know what the impact of one vs the other is. This is the base docker image that uses certbot, the final image doesn't do the compiling, it's copying the compiled folder and sets the venv. So it seems like things would be fine?

[plantysnake]

@jc21
You see, there are some things to consider how virtual environments for python work. They are isolated environments, i.e. installed packages in venv are not available outside of it.
So, in order to use cetbot's virtual environment, there is a file called ./activate in /opt/certbot/bin, which should be called in order to access venv, which you don't do.
It doesn't affect certbot itself, because it was already built, but plug-ins, as they seem to be installing into the system, don't see packages, start installing cryptography and here we are.

I can look into the code and tinker a little in couple of hours. But I believe, there would be just calling activate, then installation of plug-in and then deactivate

Small note: activate is an actual file, deactivate is just alias, that is set by activate script and acts as exit from venv

[plantysnake]

@jc21
Yep, seems to work better this way. Please, take a look here: #2411.

[github-actions]

Issue is now considered stale. If you want to keep it open, please comment 👍

[github-actions]

Issue was closed due to inactivity.