some file

Geolocation database

The management server looks up the country and city of each device's public IP address. That location feeds the Country & Region posture check and the location shown for devices on the Peers page. On a self-hosted server, management keeps the lookup databases in its own data folder. This page shows how they get there and how to keep them current.

On Netzilo Cloud there is nothing to do.

The databases are MaxMind GeoLite2 City data. MaxMind retains ownership; see the GeoLite2 license.

How it works

Management uses two files in its data folder, /var/lib/netzilo inside the management container (the netzilo_management volume):

FileHolds
GeoLite2-City.mmdbThe IP address to location database
geonames.dbThe list of countries and cities offered in the posture check
  1. When management starts and a file is missing, it downloads the data and creates the file. This needs outbound HTTPS from the server.
  2. If the download fails, management starts without geolocation. Its log shows could not initialize geo location service: ... we proceed without geo support, the Country & Region check cannot be set up, and the API's location endpoints answer 412.
  3. Every five minutes, management checks whether either file changed and loads a new copy without a restart.
  4. Management does not update the data by itself. The source is refreshed about twice a week; a server that never updates gradually misplaces addresses.

Check the databases

Run these on the server, in the compose folder (/opt/netzilo, or /opt/netzilo/run on a marketplace image):

if [ -f /opt/netzilo/run/docker-compose.yml ]; then C=/opt/netzilo/run; else C=/opt/netzilo; fi
cd "$C"
sudo docker compose logs management | grep -i "geo"
MV=$(sudo docker inspect -f '{{range .Mounts}}{{if eq .Destination "/var/lib/netzilo"}}{{.Name}}{{end}}{{end}}' management)
GEO=$(sudo docker volume inspect -f '{{.Mountpoint}}' "$MV")
sudo ls -l "$GEO/GeoLite2-City.mmdb" "$GEO/geonames.db"

Both files present and no proceed without geo support line mean geolocation works. The file dates show when the data was last updated.

Update the databases

On a server with outbound internet access, move the old files aside and restart management. It downloads current data at start.

cd "$C"
sudo mv "$GEO/GeoLite2-City.mmdb" "$GEO/GeoLite2-City.mmdb.old"
sudo mv "$GEO/geonames.db" "$GEO/geonames.db.old"
sudo docker compose restart management
sudo docker compose logs --since 5m management | grep -i "geo"

Restarting management interrupts the dashboard and the API for a few seconds; tunnels are not affected. Use the C, MV and GEO values from Check the databases.

If the log shows proceed without geo support, the download failed. Put the old files back and restart again:

sudo mv "$GEO/GeoLite2-City.mmdb.old" "$GEO/GeoLite2-City.mmdb"
sudo mv "$GEO/geonames.db.old" "$GEO/geonames.db"
sudo docker compose restart management

Once the new files work, delete the .old copies. To update regularly, schedule these steps, for example once a week.

Servers without internet access

A server that cannot reach the internet starts without geolocation. Copy the two files from a Netzilo Server that has them, for example a test server with internet access:

  1. On the connected server, copy GeoLite2-City.mmdb and geonames.db out of its data volume, as in Check the databases.

  2. Transfer them to the offline server.

  3. On the offline server, put them into the management data volume and restart management:

    sudo cp GeoLite2-City.mmdb geonames.db "$GEO/"
sudo docker compose restart management

Repeat this from time to time to keep the data current. Without a restart, management also picks up changed files within five minutes.

Troubleshooting

The Country & Region posture check shows no countries, or the API answers 412 for locations. Management started without geolocation. Check its log for proceed without geo support and follow Update the databases, or Servers without internet access.

Devices show the wrong country. The data is old, or the device reaches the server through a proxy or VPN whose address is elsewhere. Update the databases.

Browser sessions all show the same location. A clientless-access gateway on another host is not trusted by the server's Caddy, so management sees the gateway's address. See Clientless-access gateway.