2025-01-03-alpha

[Zoey2936]

Note: this is a prerelease, please back up NPMplus and test it if you can, please report back if something does not work (to see how many people test it, please give at least a reaction if you test and it works)

The following still needs to happen before new latest release:

• merge upstream
• compose.yaml remove comments
• create new release (and remember people to switch back to latest now)

What's Changed

• all your hosts will now regenerate once and when you update an env which influences a template
• use liquidjs itself instead of sed to modify persistent hosts and templates based on envs
• slim start.sh because many migrations are now done by simply recreating all hosts
• remove migrations from very old NPMplus versions (migration from upstream NPM still possible)
• allow changing http/https ports
• merge tls-ciphers-no-stapling.conf tls-ciphers.conf into one file
• disable ACME_MUST_STAPLE by default
• new ACME_OCSP_STAPLING env controlling if stapling should happen, currently on, will be disabled end april
• env DB_SQLITE_FILE is now unsupported
• NPM_DISABLE_IPV6 and GOA_DISABLE_IPV6 are now removed and included in DISABLE_IPV6
• http3 should now be way faster (http3_stream_buffer_size was too small)
• update all stapling files before starting all services
• default host is not mounted anymore and recreated on each container start
• nginxbeautifier now only runs on hosts generation
• fix unresponsive start page (upstream issue, fixed by reverting upstream commit)
• dep updates
• support php84
• update readme
• update security.txt
• improve folder structure
• frontend now only allows enabling coreruleset if modsec is also enabled
• quic_bpf support (default off, since it needs NPMplus to run as a privileged container)
• NIBEP and GOAIWSP have switched their default values
• streams forwarding_port now allows $server_port as a valid input
• allowed syntax for domain names and stream/proxy forward_host have changed
• added support for INITIAL_DEFAULT_PAGE
• remove kyber (mlkem is supported)
• use freenginx default tls setting when connecting to upstream server
• rename nginx_custom folder to custom_nginx
• unify proxy.conf and proxy-location.conf to proxy.conf
• new dummy certs now use secp384r1 instead of rsa4096
• integrate no-servername files in the normal configs
• allow disabling hsts subdomains via env
• support upstream X_FRAME_OPTIONS env, also change its default from SAMEORIGIN to DENY, add option to not set it
• remove Referrer-Police header (default value when unset is the same as NPMplus used before: strict-origin-when-cross-origin)
• don't expose version when making a (authenticated/unauthenticated) request to NPMplus API
• add ACME_KEY_TYPE env (default and recommended is still ecdsa)
• use #!/usr/bin/env sh instead of #!/bin/sh
• dns secrets are not mounted anymore, since they are saved in the db and rewritten on every container start, so they don't need to be mounted
• certbot is now built together with nginx

How to test

• Read the changes above
• change the tag in your compose yaml from latest/nothing to develop
• redeploy the compose stack
• report any issues you find

Full Changelog: 2024-12-14-r1...2025-01-03-alpha

---

This discussion was created from the release 2025-01-03-alpha.

[zoe-tek]

After switching to develop tag i get
nginx: [emerg] open() "/data/nginx_custom/server_proxy.conf" failed (2: No such file or directory) in /data/nginx/proxy_host/1.conf:66
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

I do see custom_nginx in the directory though.
Looking at backup the old path was /data/nginx_custom/server_proxy.conf
on dev it has nginx_custom inside custom_nginx

[zoe-tek]

That looks like it is working. dashboard links work again. Certs are broken. Sites say there is no cert.

ok if i edit and saved the host it fixed 1 of the 4 but the other 3 now just lead back to npm itself, the default page.

[zoe-tek]

did another wipe and restore and get this error now.
nginx: [emerg] open() "/data/nginx/default.conf" failed (2: No such file or directory) in /usr/local/nginx/conf/nginx.conf:139

I don't have default.conf in my backup.

[Zoey2936]

please try again with the new develop build in five minutes

[Zoey2936]

and for the certs... this should also be fixed with the next build in five minutes

[zoe-tek]

Looks like everything is good. Certs, dashboard. I don't have much running thru it but thank you.

[zoe-tek]

Sites says cert is self signed and won't let me renew.

• Tried the migration script first
• tried restoring from backup with the script
• restored from back on latest with the script and then going to develop
  All lead to the same issue.

Version:  2.12.1+8b582bf

Date:     Sat Jan  4 17:24:56 UTC 2025

-------------------------------------

At least one ENV changed, all hosts will be regenerated.

renamed '/data/nginx_custom' -> '/data/custom_nginx'

removed '/data/tls/certbot/archive/npm-1/privkey3.pem'

removed '/data/tls/certbot/archive/npm-1/fullchain3.pem'

removed '/data/tls/certbot/archive/npm-1/chain3.pem'

removed '/data/tls/certbot/archive/npm-1/cert3.pem'

no DEFAULT_CERT_ID set, using dummycerts.

Working on file: /data/nginx/default.conf

Working on file: /data/nginx/proxy_host/1.conf

Working on file: /data/nginx/proxy_host/16.conf

Working on file: /data/nginx/proxy_host/2.conf

Working on file: /data/nginx/proxy_host/3.conf

Success.

removed '/usr/local/nginx/logs/nginx.pid'

-------------------------------------

User:     root

PUID:     0

User ID:  0

PGID:     0

Group ID: 0

-------------------------------------

removed '/data/tls/certbot/live/npm-1.der'

Starting services...

An unexpected error occurred:

unable to revoke :: no certificate with serial 0302e8e23a9af5ea8ec0273272c7e0a0d2de and status other than revoked

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/certbot-log/letsencrypt.log or re-run Certbot with -v for more details.

[Zoey2936]

can you restore the backup again please and then try again? Thanks!