-
Notifications
You must be signed in to change notification settings - Fork 2
Description
How to use GitHub
- Please use the 👍 reaction to show that you are affected by the same issue.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Steps to reproduce
- Follow https://github.com/nextcloud/HaRP#nextcloud-32-migrating-existing-exapps-from-dsp-to-harp until step 2
Expected behaviour
Heartbeat check should succeed :)
Actual behaviour
heartbeat check failed
Context
I am trying to upgrade to the HaRP from DSP on my local test environment, but I am having issues.
my config is the following:
a RP (nginx) does the TLS termination between the outside (my laptop) and my docker containers (with trusted certificates from LetsEncrypt).
I added the /exapps/ location to the RP configuration, that proxies to appapi-harp:8780.
all containers are on the docker network apps (nextcloud server, RP, etc.)
configuration of haRP is the following, the connection test is successful.
When I hit test deploy, I reached the heartbeat step, but it fails.
Do you have any idea of what I did wrong ?
BTW, I ran the following to launch the haRP docker container:
docker run \
-e HP_SHARED_KEY="some_very_secure_password" \
-e NC_INSTANCE_URL="https://nc1.local.mlh.ovh" \
-e HP_TRUSTED_PROXY_IPS="172.18.0.0/16,127.0.0.1" \
-e HP_FRP_DISABLE_TLS="true" \
-v /var/run/docker.sock:/var/run/docker.sock \
--name appapi-harp -h appapi-harp \
--network apps \
--restart unless-stopped \
-p 8780:8780 \
-p 8782:8782 \
-d ghcr.io/nextcloud/nextcloud-appapi-harp:releaseLogs
Here are the logs:
logs from the nc_app_test_deploy
FO: Uvicorn running on unix socket /tmp/exapp.sock (Press CTRL+C to quit)
HP_SHARED_KEY is set, creating /frpc.toml configuration file...
Directory /certs/frp not found. Creating configuration without TLS certificates.
Starting frpc in the background...
Starting main application...
2025-11-04 12:21:47.941 [I] [sub/root.go:142] start frpc service for config file [/frpc.toml]
2025-11-04 12:21:47.941 [I] [client/service.go:295] try to connect to server...
2025-11-04 12:21:47.943 [I] [client/service.go:287] [8d0e41d9d141f9d6] login to server success, get run id [8d0e41d9d141f9d6]
2025-11-04 12:21:47.943 [I] [proxy/proxy_manager.go:173] [8d0e41d9d141f9d6] proxy added: [test-deploy]
2025-11-04 12:21:47.943 [I] [client/control.go:168] [8d0e41d9d141f9d6] [test-deploy] start proxy success
Started
INFO: Started server process [1]
INFO: Waiting for application startup.
TRACE: ASGI [1] Started scope={'type': 'lifespan', 'asgi': {'version': '3.0', 'spec_version': '2.0'}, 'state': {}}
TRACE: ASGI [1] Receive {'type': 'lifespan.startup'}
TRACE: ASGI [1] Send {'type': 'lifespan.startup.complete'}
INFO: Application startup complete.
INFO: Uvicorn running on unix socket /tmp/exapp.sock (Press CTRL+C to quit)
logs from the appapi-harp
maxime_n@fedora:~/Nextcloud/Docs/Docker$ docker logs -f appapi-harp
INFO: HP_FRP_DISABLE_TLS is set to true. Skipping certificate generation.
INFO: Creating /haproxy.cfg from haproxy.cfg.template...
INFO: No /certs/cert.pem found, disabling HTTPS frontends...
INFO: Final /haproxy.cfg:
# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: AGPL-3.0-or-later
###############################################################################
# haproxy.cfg.template
#
# This template is processed by envsubst in start.sh to replace variables:
# HP_EXAPPS_ADDRESS,
# HP_EXAPPS_HTTPS_ADDRESS,
# HP_TIMEOUT_CONNECT,
# HP_TIMEOUT_CLIENT,
# HP_TIMEOUT_SERVER,
#
## If /certs/cert.pem is not found, lines containing "_HTTPS_FRONTEND_" are
# commented out automatically in start.sh.
###############################################################################
global
log stdout local0 warning
maxconn 8192
ca-base /etc/ssl/certs
defaults
log global
option httplog
option dontlognull
timeout connect 30s
timeout client 30s
timeout server 1800s
###############################################################################
# FRONTEND: ex_apps (HTTP)
###############################################################################
frontend ex_apps
mode http
bind 0.0.0.0:8780
filter spoe engine exapps-spoe config /etc/haproxy/spoe-agent.conf
http-request silent-drop if { var(txn.exapps.bad_request) -m int eq 1 }
http-request return status 401 content-type text/plain string "401 Unauthorized" if { var(txn.exapps.unauthorized) -m int eq 1 }
http-request return status 403 content-type text/plain string "403 Forbidden" if { var(txn.exapps.forbidden) -m int eq 1 }
http-request return status 404 content-type text/plain string "404 Not Found" if { var(txn.exapps.not_found) -m int eq 1 }
use_backend %[var(txn.exapps.backend)]
###############################################################################
# FRONTEND: ex_apps_https (only enabled if /certs/cert.pem exists)
###############################################################################
#_HTTPS_FRONTEND_ frontend ex_apps_https
#_HTTPS_FRONTEND_ mode http
#_HTTPS_FRONTEND_ bind 0.0.0.0:8781 ssl crt /certs/cert.pem
#_HTTPS_FRONTEND_ filter spoe engine exapps-spoe config /etc/haproxy/spoe-agent.conf
#_HTTPS_FRONTEND_ http-request silent-drop if { var(txn.exapps.bad_request) -m int eq 1 }
#_HTTPS_FRONTEND_ http-request return status 401 content-type text/plain string "401 Unauthorized" if { var(txn.exapps.unauthorized) -m int eq 1 }
#_HTTPS_FRONTEND_ http-request return status 403 content-type text/plain string "403 Forbidden" if { var(txn.exapps.forbidden) -m int eq 1 }
#_HTTPS_FRONTEND_ http-request return status 404 content-type text/plain string "404 Not Found" if { var(txn.exapps.not_found) -m int eq 1 }
#_HTTPS_FRONTEND_ use_backend %[var(txn.exapps.backend)]
###############################################################################
# BACKENDS: ex_apps & ex_apps_backend_w_bruteforce
###############################################################################
backend ex_apps_backend
mode http
server frp_server 0.0.0.0
http-request set-path %[var(txn.exapps.target_path)]
http-request set-dst var(txn.exapps.target_ip)
http-request set-dst-port var(txn.exapps.target_port)
http-request set-header EX-APP-ID %[var(txn.exapps.exapp_id)]
http-request set-header EX-APP-VERSION %[var(txn.exapps.exapp_version)]
http-request set-header AUTHORIZATION-APP-API %[var(txn.exapps.exapp_token)]
http-request set-header AA-VERSION "32" # TO-DO: temporary, remove it after we update all ExApps.
backend ex_apps_backend_w_bruteforce
mode http
server frp_server 0.0.0.0
http-request set-path %[var(txn.exapps.target_path)]
http-request set-dst var(txn.exapps.target_ip)
http-request set-dst-port var(txn.exapps.target_port)
http-request set-header EX-APP-ID %[var(txn.exapps.exapp_id)]
http-request set-header EX-APP-VERSION %[var(txn.exapps.exapp_version)]
http-request set-header AUTHORIZATION-APP-API %[var(txn.exapps.exapp_token)]
http-request set-header AA-VERSION "32" # TO-DO: temporary, remove it after we update all ExApps.
filter spoe engine exapps-bruteforce-protection-spoe config /etc/haproxy/spoe-agent.conf
###############################################################################
# BACKEND: nextcloud_control (HTTP)
###############################################################################
backend nextcloud_control_backend
mode http
server nextcloud_control 127.0.0.1:8200
http-request set-path %[var(txn.exapps.target_path)]
###############################################################################
# BACKEND: docker_engine (HTTP)
###############################################################################
backend docker_engine_backend
mode http
server frp_server 127.0.0.1
http-request set-dst-port var(txn.exapps.target_port)
http-request set-path %[var(txn.exapps.target_path)]
# docker system _ping
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping$ } METH_GET
# docker inspect image
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images/.*/json } METH_GET
# container inspect: GET containers/%s/json
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/json } METH_GET
# container inspect: GET containers/%s/logs
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/logs } METH_GET
# image pull: POST images/create?fromImage=%s
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images/create } METH_POST
http-request deny
backend agents
mode tcp
timeout connect 5s
timeout server 3m
option spop-check
server agent1 127.0.0.1:9600 check
INFO: FRP server configuration generated at /frps.toml.
INFO: Detected /var/run/docker.sock, generating /frpc-docker.toml configuration file...
INFO: Starting Python HaProxy Agent on 127.0.0.1:8200 and 127.0.0.1:9600...
INFO: Starting FRP server on 0.0.0.0:8782...
INFO: Starting FRP client for Docker Engine...
INFO: Starting HAProxy...
2025-11-04 11:29:15.236 [I] [sub/root.go:142] start frpc service for config file [/frpc-docker.toml]
2025-11-04 11:29:15.236 [I] [client/service.go:295] try to connect to server...
[NOTICE] (1) : Initializing new worker (39)
2025-11-04 11:29:15.238 [I] [client/service.go:287] [3f6be77714b6b5ee] login to server success, get run id [3f6be77714b6b5ee]
2025-11-04 11:29:15.238 [I] [proxy/proxy_manager.go:173] [3f6be77714b6b5ee] proxy added: [bundled-deploy-daemon]
2025-11-04 11:29:15.239 [I] [client/control.go:168] [3f6be77714b6b5ee] [bundled-deploy-daemon] start proxy success
[NOTICE] (1) : Loading success.
[2025-11-04T11:29:35+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T11:58:17+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T12:13:43+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T12:21:37+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
In nc apache logs:
172.19.1.0 - - [04/Nov/2025:13:17:16 +0000] "GET /apps/app_api/daemons/harp_proxy_host/test_deploy/status HTTP/1.1" 200 841 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0"
Nextcloud logs:
{"reqId":"ore3AXIXNG6fBHGhhg23","level":3,"time":"2025-11-04T12:26:46+00:00","remoteAddr":"","user":"--","app":"app_api","method":"","url":"--","message":"ExApp test-deploy heartbeat check failed. Make sure that Nextcloud instance and ExApp can reach it other.","userAgent":"--","version":"32.0.1.2","data":{"app":"app_api"},"id":"6909f108b1b92"}
{"reqId":"ugTHngiNvbFdwpGJRsRF","level":3,"time":"2025-11-04T12:26:46+00:00","remoteAddr":"172.19.1.0","user":"admin","app":"app_api","method":"POST","url":"/apps/app_api/daemons/harp_proxy_host/test_deploy","message":"Error executing occ command. Return code: 1, stdout: , stderr: ","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","version":"32.0.1.2","data":{"app":"app_api"},"id":"6909f108b1b8d"}