2025-01-10-r1

[Zoey2936]

Note: All hosts will regenerate when updating to this version

Note: The path where the geoip databases for goaccess are saved has move from etc/goaccess/geoip to goaccess/geoip inside the mounted data folder, if you auto update them, please adjust the path

Note if you used the last alpha, please switch back to the latest tag

What's Changed

• http3 should now be way faster (http3_stream_buffer_size was too small)
• all your hosts will now regenerate once and when you update an env which influences a template
• use liquidjs itself instead of sed to modify persistent hosts and templates based on envs
• slim start.sh because many migrations are now done by simply recreating all hosts
• remove migrations from very old NPMplus versions (migration from upstream NPM still possible)
• allow changing http/https ports
• merge tls-ciphers-no-stapling.conf tls-ciphers.conf into one file
• disable ACME_MUST_STAPLE by default
• new ACME_OCSP_STAPLING env controlling if stapling should happen, currently on, will be disabled end april
• env DB_SQLITE_FILE and env CLEAN are now unsupported
• NPM_DISABLE_IPV6 and GOA_DISABLE_IPV6 are now removed and included in DISABLE_IPV6
• update all stapling files before starting all services
• default host is not mounted anymore and recreated on each container start
• nginxbeautifier now only runs on hosts generation
• fix unresponsive start page (upstream issue, fixed by reverting upstream commit)
• dep updates
• support php84
• update readme
• update security.txt
• merge upstream
• improve folder structure (mainly move all folders inside etc to root data folder)
• watchtower is now allowed to update NPMplus (envs have moved to start.sh)
• frontend now only allows enabling coreruleset if modsec is also enabled
• quic_bpf support (default off, since it needs NPMplus to run as a privileged container)
• NIBEP and GOAIWSP have changed their default values
• streams forwarding_port now allows $server_port as a valid input
• allowed syntax for domain names and stream/proxy forward_host have changed
• added support for INITIAL_DEFAULT_PAGE
• remove kyber (mlkem is supported)
• use freenginx default tls setting when connecting to upstream server
• rename nginx_custom folder to custom_nginx
• unify proxy.conf and proxy-location.conf to proxy-headers.conf
• new dummy certs now use secp384r1 instead of rsa4096
• integrate no-servername files in the normal configs
• allow disabling hsts subdomains via env
• support upstream X_FRAME_OPTIONS env, also change its default from SAMEORIGIN to DENY, add option to not set it
• remove Referrer-Police header (default value when unset is the same as NPMplus used before: strict-origin-when-cross-origin)
• don't expose version when making a (authenticated/unauthenticated) request to NPMplus API (yes I know it is still visible on frontend)
• add ACME_KEY_TYPE env (default and recommended is still ecdsa)
• use #!/usr/bin/env sh instead of #!/bin/sh
• dns secrets are not mounted anymore, since they are saved in the db and rewritten on every container start, so they don't need to be mounted
• certbot is now built together with nginx

How to update

• read the changes above
• repull the docker image
• apply possible changes that maybe effect you from above to your compose.yaml
• redeploy the compose stack
• report any issues you find

Full Changelog: 2024-12-14-r1...2025-01-10-r1

---

This discussion was created from the release 2025-01-10-r1.

[Raxiel1987]

I see the docker compose file with npm + crowdsec + geoip, but I have 2 docker compose, 1 with npm and 1 with crowdsec, so my question is:

It's the same ? Or I should move the crowdesec compose in the npm compose ?

(I see in npm logs that crowdsec is working 'cause I see bans from it)

[Zoey2936]

you can keep them separate if you want, it makes no difference

[Zoey2936]

I mainly merged them to keep them easier in sync with this: https://github.com/crowdsecurity/example-docker-compose/tree/main/NPMplus

[Raxiel1987]

Oh ok I will let them separate thank you (i'm lazy and don't want to modify this XD )

[Zoey2936]

I have them separate myself

[Matthias-vdE]

This update seems to have broken GEOIP for me. (Yup, I've read the release notes and moved the folder to the new location and verified all data is there.) This is my error in the log when starting the npm-plus container:

-------------------------------------

 _ _  ___  __ __       _

| \ || . \|  \  \ ___ | | _ _  ___

|   ||  _/|     || . \| || | |[_-[

|_\_||_|  |_|_|_||  _/|_| \__|/__/

                 |_|

-------------------------------------

Version:  2.12.2+eea4015

Date:     Tue Jan 14 08:28:21 CET 2025

-------------------------------------

At least one env or the template version changed, all hosts will be regenerated.

'/usr/local/nginx/conf/conf.d/include/crowdsec_nginx.conf' -> '/usr/local/nginx/conf/conf.d/crowdsec.conf'

no DEFAULT_CERT_ID set, using dummycerts.

'/usr/local/nginx/conf/conf.d/include/goaccess.conf' -> '/usr/local/nginx/conf/conf.d/goaccess.conf'

-------------------------------------

User:     root

PUID:     0

User ID:  0

PGID:     0

Group ID: 0

-------------------------------------

nginx: [emerg] MMDB_open("/data/etc/goaccess/geoip/GeoLite2-Country.mmdb") failed - Error opening the specified MaxMind DB file in /data/custom_nginx/http_top.conf:1

nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

This is my compose.yaml file which I've been using for a while now. The only thing that I changed compared the previous version is the GEOIP volume path from "/opt/npm/etc/goaccess/geoip:/usr/share/GeoIP" to "/opt/npm/goaccess/geoip:/usr/share/GeoIP":

services:
  npmplus:
    container_name: npmplus
    image: zoeyvid/npmplus:latest
    restart: always
    network_mode: host
    volumes:
      - "/opt/npm:/data"
    environment:
      - "TZ=Europe/Brussels" 
      - "ACME_EMAIL=REDACTED"
      - "ACME_MUST_STAPLE=false"
      - "NGINX_LOG_NOT_FOUND=true" 
      - "LOGROTATE=true"
      - "LOGROTATIONS=7" 
      - "GOA=true" 
      - "CRT=36"
      - "IPRT=3"

  crowdsec:
    container_name: crowdsec
    image: crowdsecurity/crowdsec:latest
    restart: always
    network_mode: bridge
    ports:
      - "127.0.0.1:7422:7422"
      - "127.0.0.1:8080:8080"
    environment:
      - "TZ=Europe/Brussels"
      - "COLLECTIONS=ZoeyVid/npmplus"
      - "LEVEL_FATAL=true"
      - "LEVEL_ERROR=true"
      - "LEVEL_WARN=true"
      - "LEVEL_INFO=false"
      - "LEVEL_DEBUG=false"
      - "LEVEL_TRACE=false"
    volumes:
      - "/opt/crowdsec/conf:/etc/crowdsec"
      - "/opt/crowdsec/data:/var/lib/crowdsec/data"
      - "/opt/npm/nginx:/opt/npm/nginx:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  geoipupdate:
    container_name: geoipupdate
    image: maxmindinc/geoipupdate:latest
    restart: always
    network_mode: bridge
    environment:
      - "TZ=Europe/Brussels"
      - "GEOIPUPDATE_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN"
      - "GEOIPUPDATE_ACCOUNT_ID=REDACTED"
      - "GEOIPUPDATE_LICENSE_KEY=REDACTED"
      - "GEOIPUPDATE_FREQUENCY=24"
    volumes:
      - "/opt/npm/goaccess/geoip:/usr/share/GeoIP"

[Matthias-vdE]

Nevermind. I just realized one of my config files probably still references the old location.

Edit, yup that was it. As stated literally in the error message lol. My http_top.conf file contains a reference to the DB in order to use geoip blocking in the Advanced Config tabs:

geoip2 /data/etc/goaccess/geoip/GeoLite2-Country.mmdb {
    auto_reload 60m;
    $geoip2_data_country_code default=ZZ country iso_code;
} 

Correcting the path here obviously fixed it.