2024-10-21-r1

[Zoey2936]

Breaking changes in host names and custom acme servers, fixed upstreams CVEs, please report any issues you find

What's Changed

• merge upstream (including CVE fixes - shell/command injection while creating certificates - permission to create certs was required to exploit)
  • Note: upstream fixed this by adding regex checks in API endpoint (is included), this may break new hosts/your hosts if you update them, and you are using regex inside your host names
  • Note: I added a second fix by switching from ('child_process').exec to require('child_process').execFile, this should prevent this kind of injection completely, so the regex change from upstream should be safe to revert if needed
  • I also fixed some small upstream bugs which I already noticed while testing, so there are probably more through new regex checks
• dep updates
• generate nginx access lists using node module instead of apache2-utils
• for new instances, fix appsec file upload: increase appsec timeouts, I recommend that you create a backup of your /opt/npm/etc/crowdsec/crowdsec.conf config file, delete it, then restart NPMplus (so the file gets recreated) and you then configure it again, so you have the new timeouts
• reload nginx after certbot-ocsp-fetcher.sh finished
• custom certbot.ini support REMOVED, if you want to use a custom acme server please do this using the new envs you can find in the compose.yaml
• fix disabling ipv6
• nginx/custom is now nginx_custom (from sub folder to new folder)
• you no longer need to enter your email while creating certs (please do this in compose.yaml)
• DNS propagation delay support removed
• fixed duplicating '#' in nginx.conf in rootless mode
• allow backend to compress
• improve default ssl_ecdh_curve (enable X25519MLKEM768)
• also disable proxy_request_buffering if you disable proxy buffering using env
• limit mine types to compress (text/images/auido) - if you have ideas if something is missing or should not be compressed please open a discussion (currently: text/html text/css text/javascript text/xml application/atom+xml application/rss+xml text/markdown text/mathml text/plain text/vnd.sun.j2me.app-descriptor text/vnd.wap.wml text/x-component application/json application/xhtml+xml application/xspf+xml font/woff font/woff2 image/avif image/bmp image/png image/svg+xml image/tiff image/vnd.wap.wbmp image/webp image/x-icon image/x-jng audio/midi audio/mpeg audio/ogg audio/x-m4a audio/x-realaudio)

How to update

• Read the changes above
• Pull the zoeyvid/npmplus:latest image
• apply possible changes that maybe effect you from above to your compose.yaml/NPMplus
• redeploy the compose stack
• report any issues you find

Full Changelog: 2024-10-05-r1...2024-10-21-r1

---

This discussion was created from the release 2024-10-21-r1.

[tokar86a]

Seems to be stuck doing following task: npmplus | [Global ] › ⬤ debug CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot -o /data/tls/certbot/live --no-reload-webserver --quiet

Nothing seems to be happen and the container report as unhealthy.

[Zoey2936]

ACME_EMAIL has no influence on this

[gadget78]

the default compose.yml
https://raw.githubusercontent.com/ZoeyVid/NPMplus/refs/heads/develop/compose.yaml
has on line 13
- "ACME_EMAIL=your-email" # email address which should be used for acme, ......

so with this in place, it fails with "ACME_EMAIL needs to contains @."

and so fails to load...

EDIT, sorry this doesnt have any connection with the OP now ... thought this was a "any issues" thread ..

[Zoey2936]

it only throws this error if you set it to somnething invalid, you can also keep it empty and also it has nothing to do with the nginx_custom folder

[gadget78]

indeed, it does only throw this error when its set with something invalid,
which is how you have left the compose.yml by default...
so "out of the box" it fails. (if you had commented/# this out by default, it will then work "out of the box")

and indeed, this has nothing to do with "nginx_custom" folder, sorry these where two different issues...
i initially didn't realise, and hadn't migrated, and then found the email error too....

i have fully replied here to hopefully make things a little clearer, for people reading along, as it may help someone.
(i have found another issue on newer a build, with connection to this email issues, i will post on the newer build thread after this)

[Zoey2936]

yes the fail is wanted since it should be changed, like TZ