Upgrading from 417 > 418+ breaks proxy host for the NPM+ web panel

[DessertOverlord]

For a few months I hosted NPM on an RPi5, and recently I have been migrating all of my containers over to my x86 server PC. When I did so, I accidentally updated NPM+ to latest, up from v417 on Dockerhub. The only thing that appears to have broken is that previously I had a proxy host that went from https://npm.mydomain.tld/ to https://127.0.0.1:81, so that I could remotely access the webUI.

I use Cloudflare's tunnels and SSL, and my setup was working in v417, but updating to v418 irreversibly breaks it. Navigating to https://npm.mydomain.tld/ enters an infinite redirect loop. I can also confirm that the "Force HTTPS" option is disabled.

Even if I tear the container down and rebuild on v417, npmplus throws an error in the logs, which implies that the breaking change lives somewhere in my persistent data:

npmplus | nginx: [emerg] open() "/usr/local/nginx/conf/conf.d/include/tls-ciphers-no-stapling.conf" failed (2: No such file or directory) in /data/nginx/default.conf:19 npmplus | nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

The only way I have gotten this to work again is by reverting to my original backup on v417.

[Zoey2936]

yes downgrading is not supported. Can you please share the config file of the host redirecting in loop?

[DessertOverlord]

Here is the config, I only scrubbed my own domain names from it.

# ------------------------------------------------------------
# npm.mydomain.tld
# ------------------------------------------------------------


server {
    set $forward_scheme https;
    set $server "127.0.0.1";
    set $port 81;

    listen unix:/run/nginx-2.sock;

    listen 0.0.0.0:80;
    listen [::]:80;


    listen 0.0.0.0:443 ssl;
    listen [::]:443 ssl;

    listen 0.0.0.0:443 quic;
    listen [::]:443 quic;


    more_set_headers 'Alt-Svc: h3=":443"; ma=86400';


    server_name npm.mydomain.tld;


    # Certbot TLS
    include conf.d/include/tls-ciphers.conf;
    ssl_certificate /data/tls/certbot/live/npm-2/fullchain.pem;
    ssl_certificate_key /data/tls/certbot/live/npm-2/privkey.pem;
    ssl_trusted_certificate /data/tls/certbot/live/npm-2/chain.pem;


    # Enable Brotli
    include conf.d/include/brotli.conf;


    include conf.d/include/always.conf;


    # custom locations
    location / {
        include conf.d/include/always.conf;


        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;


        # Proxy!
        include conf.d/include/proxy.conf;
    }


    # Custom
    include /data/nginx/custom/server_proxy.conf;
}

[Zoey2936]

it is included by NPMplus own config:

NPMplus/rootfs/usr/local/nginx/conf/conf.d/npm.conf

Line 8 in f8a7ff0

include conf.d/include/force-tls.conf;

[Zoey2936]

hoiw did you configured your tunnels?

there is your issue, please try to use https

[DessertOverlord]

I did a docker compose down and docker compose up -d to refresh the container, and validated I still got the loop.

Then I changed to this new CF Tunnel config:

Result:

[Zoey2936]

try this (additionally): https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/origin-configuration/#notlsverify

[DessertOverlord]

Mint, that did it. All is well.

So in summary, that means the issue was that Cloudflare was sending HTTP traffic to NPM, which it was trying to redirect to HTTPS because the NPM+ panel has the force-tls included by default? Either way, thank you very much for the help!

[Zoey2936]

yes exactly