st2 --debug outputs URLs that are not accessible from remote hosts

[nmaludy]

When trying to determine what the CLI command st2 is doing behind the scenes (and also help learn the API) i often use the --debug flag. However, the URLs shown in this output are only accessible when running commands on the stackstorm host and NOT from an external host:

Example output from an st2 command:

[root@stackstorm .st2]# st2 --debug timer list
# -------- begin 60551632 request ----------
curl -X POST -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.11.1' -H  'content-type: application/json' -H  'Content-Length: 2' -H  'Authorization: Basic xxx' --data-binary '{}' http://127.0.0.1:9100/tokens
# -------- begin 60551632 response ----------
{"user": "st2admin", "token": "2e325ed4358145aab40fd9e4f3cd84b2", "expiry": "2017-04-11T21:49:01.976485Z", "id": "58ebfdcda814c00d538869c2", "metadata": {}}
# -------- end 60551632 response ------------

2017-04-10 17:49:01,984  DEBUG - Token has been cached in "/root/.st2/token-st2admin"
# -------- begin 60552208 request ----------
curl -X GET -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.11.1' -H  'X-Auth-Token: 2e325ed4358145aab40fd9e4f3cd84b2' http://127.0.0.1:9101/v1/timers
# -------- begin 60552208 response ----------
[{"uid": "trigger:core:31ae9d8d-a8dd-46d9-89b0-7fca830ee4e4:889c1c0b04f53100997af85f35ad3979", "parameters": {"unit": "seconds", "delta": 5}, "name": "31ae9d8d-a8dd-46d9-89b0-7fca830ee4e4", "type": "core.st2.IntervalTimer", "id": "58c9debfa814c063ec62970a", "pack": "core"}]
# -------- end 60552208 response ------------

+--------------------------+------+--------------------+--------------------+--------------------+
| id                       | pack | name               | type               | parameters         |
+--------------------------+------+--------------------+--------------------+--------------------+
| 58c9debfa814c063ec62970a | core | 31ae9d8d-a8dd-46d9 | core.st2.IntervalT | {u'unit':          |
|                          |      | -89b0-7fca830ee4e4 | imer               | u'seconds',        |
|                          |      |                    |                    | u'delta': 5}       |
+--------------------------+------+--------------------+--------------------+--------------------+

If you try to copy and paste those curl commands to an external host they fail with an error Connection Refused:

$ curl -X POST -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.11.1' -H  'content-type: application/json' -H  'Content-Length: 2' -H  'Authorization: Basic xxx' --data-binary '{}' http://192.168.122.9:9100/tokens
curl: (7) Failed connect to 192.168.122.9:9100; Connection refused
$ curl -X GET -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.11.1' -H  'X-Auth-Token: 2e325ed4358145aab40fd9e4f3cd84b2' 
curl: (7) Failed connect to 192.168.122.9:9100; Connection refused

Looking at the nginx config /etc/nginx/conf.d/st2.conf reveals several things:

• http is redirected to https, so all urls should be https:// instead of http://
• all urls in the curl output destined for port 9101 (api) should be prefixed with /api/
• all urls in the curl output destined for port 9100 (auth) should be prefixed with /auth/
• all urls in the curl output destined for port 9102 (stream) should be prefixed with /stream/v1/ (not 100% sure about this one, there's some magic going on here and i haven't seen any curl commands with stream URLs to test with).

Should/could the output of st2 be updated to show the proper url for accessing the API from an external host?

I'm more than happy to do the work, i would just like some direction on how this should be handled.

[nmaludy]

Looks like the code that's outputting these URLs is here: https://github.com/StackStorm/st2/blob/master/st2client/st2client/utils/httpclient.py#L143-L165

[armab]

You can adjust both api and auth URLs used by st2 cli via environment variables or via ~/.st2/config file. This way CLI with debug enabled will show updated URLs.

See https://docs.stackstorm.com/reference/cli.html for more info.

Example with ~/.st2/config:

[api]
url = https://your-domain/api/

[auth]
url = https://your-domain/auth/

Example with env variables:

ST2_API_URL=https://your-domain/api/ ST2_AUTH_URL=https://your-domain/auth/ st2 --debug action list

You can find/configure remote endpoints in nginx config which is located in /etc/nginx/conf.d/st2.conf if you installed StackStorm with our installer.

Hope that helps.

[nmaludy]

It would be great to have those documented in https://docs.stackstorm.com/reference/cli.html as you described.

Currently the documentation simply points to server:9100 and the like.

[armab]

~/.st2/config options like [api] url and [auth] url as well as environment variable like ST2_API_URL are included in https://docs.stackstorm.com/reference/cli.html
Those are actual StackStorm API endpoints which CLI client st2 tries to access.

But yeah, if you see an improvement, - feel free to open a Pull Request in https://github.com//StackStorm/st2docs/blob/master/docs/source/reference/cli.rst for better documentation.
Since it's OSS, contributions are very welcome! :+1:

[nmaludy]

Perfect, i didn't realize there was another repo that controlled the documentation!

I'll create a PR tonight.

Thanks!