Skip to content

heartbeat check failed #63

@maximelehericy

Description

@maximelehericy

How to use GitHub

  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

Steps to reproduce

  1. Follow https://github.com/nextcloud/HaRP#nextcloud-32-migrating-existing-exapps-from-dsp-to-harp until step 2

Expected behaviour

Heartbeat check should succeed :)

Actual behaviour

heartbeat check failed

Context

I am trying to upgrade to the HaRP from DSP on my local test environment, but I am having issues.

my config is the following:
a RP (nginx) does the TLS termination between the outside (my laptop) and my docker containers (with trusted certificates from LetsEncrypt).

I added the /exapps/ location to the RP configuration, that proxies to appapi-harp:8780.

all containers are on the docker network apps (nextcloud server, RP, etc.)

configuration of haRP is the following, the connection test is successful.

Image

When I hit test deploy, I reached the heartbeat step, but it fails.

Do you have any idea of what I did wrong ?

BTW, I ran the following to launch the haRP docker container:

docker run \
  -e HP_SHARED_KEY="some_very_secure_password" \
  -e NC_INSTANCE_URL="https://nc1.local.mlh.ovh" \
  -e HP_TRUSTED_PROXY_IPS="172.18.0.0/16,127.0.0.1" \
  -e HP_FRP_DISABLE_TLS="true" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --name appapi-harp -h appapi-harp \
  --network apps \
  --restart unless-stopped \
  -p 8780:8780 \
  -p 8782:8782 \
  -d ghcr.io/nextcloud/nextcloud-appapi-harp:release

Logs

Here are the logs:

logs from the nc_app_test_deploy

FO:     Uvicorn running on unix socket /tmp/exapp.sock (Press CTRL+C to quit)
HP_SHARED_KEY is set, creating /frpc.toml configuration file...
Directory /certs/frp not found. Creating configuration without TLS certificates.
Starting frpc in the background...
Starting main application...
2025-11-04 12:21:47.941 [I] [sub/root.go:142] start frpc service for config file [/frpc.toml]
2025-11-04 12:21:47.941 [I] [client/service.go:295] try to connect to server...
2025-11-04 12:21:47.943 [I] [client/service.go:287] [8d0e41d9d141f9d6] login to server success, get run id [8d0e41d9d141f9d6]
2025-11-04 12:21:47.943 [I] [proxy/proxy_manager.go:173] [8d0e41d9d141f9d6] proxy added: [test-deploy]
2025-11-04 12:21:47.943 [I] [client/control.go:168] [8d0e41d9d141f9d6] [test-deploy] start proxy success
Started
INFO:     Started server process [1]
INFO:     Waiting for application startup.
TRACE:    ASGI [1] Started scope={'type': 'lifespan', 'asgi': {'version': '3.0', 'spec_version': '2.0'}, 'state': {}}
TRACE:    ASGI [1] Receive {'type': 'lifespan.startup'}
TRACE:    ASGI [1] Send {'type': 'lifespan.startup.complete'}
INFO:     Application startup complete.
INFO:     Uvicorn running on unix socket /tmp/exapp.sock (Press CTRL+C to quit)

logs from the appapi-harp

maxime_n@fedora:~/Nextcloud/Docs/Docker$ docker logs -f appapi-harp 
INFO: HP_FRP_DISABLE_TLS is set to true. Skipping certificate generation.
INFO: Creating /haproxy.cfg from haproxy.cfg.template...
INFO: No /certs/cert.pem found, disabling HTTPS frontends...
INFO: Final /haproxy.cfg:
# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: AGPL-3.0-or-later

###############################################################################
# haproxy.cfg.template
#
# This template is processed by envsubst in start.sh to replace variables:
#   HP_EXAPPS_ADDRESS,
#   HP_EXAPPS_HTTPS_ADDRESS,
#   HP_TIMEOUT_CONNECT,
#   HP_TIMEOUT_CLIENT,
#   HP_TIMEOUT_SERVER,
#
## If /certs/cert.pem is not found, lines containing "_HTTPS_FRONTEND_" are
# commented out automatically in start.sh.
###############################################################################

global
    log stdout local0 warning
    maxconn 8192
    ca-base /etc/ssl/certs

defaults
    log global
    option httplog
    option dontlognull
    timeout connect 30s
    timeout client 30s
    timeout server 1800s


###############################################################################
# FRONTEND: ex_apps (HTTP)
###############################################################################
frontend ex_apps
    mode http
    bind 0.0.0.0:8780

    filter spoe engine exapps-spoe config /etc/haproxy/spoe-agent.conf
    http-request silent-drop if { var(txn.exapps.bad_request) -m int eq 1 }
    http-request return status 401 content-type text/plain string "401 Unauthorized" if { var(txn.exapps.unauthorized) -m int eq 1 }
    http-request return status 403 content-type text/plain string "403 Forbidden" if { var(txn.exapps.forbidden) -m int eq 1 }
    http-request return status 404 content-type text/plain string "404 Not Found" if { var(txn.exapps.not_found) -m int eq 1 }
    use_backend %[var(txn.exapps.backend)]

###############################################################################
# FRONTEND: ex_apps_https (only enabled if /certs/cert.pem exists)
###############################################################################
#_HTTPS_FRONTEND_ frontend ex_apps_https
#_HTTPS_FRONTEND_     mode http
#_HTTPS_FRONTEND_     bind 0.0.0.0:8781 ssl crt /certs/cert.pem

#_HTTPS_FRONTEND_     filter spoe engine exapps-spoe config /etc/haproxy/spoe-agent.conf
#_HTTPS_FRONTEND_     http-request silent-drop if { var(txn.exapps.bad_request) -m int eq 1 }
#_HTTPS_FRONTEND_     http-request return status 401 content-type text/plain string "401 Unauthorized" if { var(txn.exapps.unauthorized) -m int eq 1 }
#_HTTPS_FRONTEND_     http-request return status 403 content-type text/plain string "403 Forbidden" if { var(txn.exapps.forbidden) -m int eq 1 }
#_HTTPS_FRONTEND_     http-request return status 404 content-type text/plain string "404 Not Found" if { var(txn.exapps.not_found) -m int eq 1 }
#_HTTPS_FRONTEND_     use_backend %[var(txn.exapps.backend)]

###############################################################################
# BACKENDS: ex_apps & ex_apps_backend_w_bruteforce
###############################################################################
backend ex_apps_backend
    mode http
    server frp_server 0.0.0.0
    http-request set-path %[var(txn.exapps.target_path)]
    http-request set-dst var(txn.exapps.target_ip)
    http-request set-dst-port var(txn.exapps.target_port)
    http-request set-header EX-APP-ID %[var(txn.exapps.exapp_id)]
    http-request set-header EX-APP-VERSION %[var(txn.exapps.exapp_version)]
    http-request set-header AUTHORIZATION-APP-API %[var(txn.exapps.exapp_token)]
    http-request set-header AA-VERSION "32"  # TO-DO: temporary, remove it after we update all ExApps.

backend ex_apps_backend_w_bruteforce
    mode http
    server frp_server 0.0.0.0
    http-request set-path %[var(txn.exapps.target_path)]
    http-request set-dst var(txn.exapps.target_ip)
    http-request set-dst-port var(txn.exapps.target_port)
    http-request set-header EX-APP-ID %[var(txn.exapps.exapp_id)]
    http-request set-header EX-APP-VERSION %[var(txn.exapps.exapp_version)]
    http-request set-header AUTHORIZATION-APP-API %[var(txn.exapps.exapp_token)]
    http-request set-header AA-VERSION "32"  # TO-DO: temporary, remove it after we update all ExApps.
    filter spoe engine exapps-bruteforce-protection-spoe config /etc/haproxy/spoe-agent.conf

###############################################################################
# BACKEND: nextcloud_control (HTTP)
###############################################################################
backend nextcloud_control_backend
    mode http
    server nextcloud_control 127.0.0.1:8200
    http-request set-path %[var(txn.exapps.target_path)]

###############################################################################
# BACKEND: docker_engine (HTTP)
###############################################################################
backend docker_engine_backend
    mode http
    server frp_server 127.0.0.1
    http-request set-dst-port var(txn.exapps.target_port)
    http-request set-path %[var(txn.exapps.target_path)]

    # docker system _ping
    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping$ } METH_GET
    # docker inspect image
    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images/.*/json } METH_GET
    # container inspect: GET containers/%s/json
    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/json } METH_GET
    # container inspect: GET containers/%s/logs
    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/nc_app_[a-zA-Z0-9_.-]+/logs } METH_GET

    # image pull: POST images/create?fromImage=%s
    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images/create } METH_POST
    http-request deny


backend agents
    mode tcp
    timeout connect 5s
    timeout server  3m
    option spop-check
    server agent1 127.0.0.1:9600 check
INFO: FRP server configuration generated at /frps.toml.
INFO: Detected /var/run/docker.sock, generating /frpc-docker.toml configuration file...
INFO: Starting Python HaProxy Agent on 127.0.0.1:8200 and 127.0.0.1:9600...
INFO: Starting FRP server on 0.0.0.0:8782...
INFO: Starting FRP client for Docker Engine...
INFO: Starting HAProxy...
2025-11-04 11:29:15.236 [I] [sub/root.go:142] start frpc service for config file [/frpc-docker.toml]
2025-11-04 11:29:15.236 [I] [client/service.go:295] try to connect to server...
[NOTICE]   (1) : Initializing new worker (39)
2025-11-04 11:29:15.238 [I] [client/service.go:287] [3f6be77714b6b5ee] login to server success, get run id [3f6be77714b6b5ee]
2025-11-04 11:29:15.238 [I] [proxy/proxy_manager.go:173] [3f6be77714b6b5ee] proxy added: [bundled-deploy-daemon]
2025-11-04 11:29:15.239 [I] [client/control.go:168] [3f6be77714b6b5ee] [bundled-deploy-daemon] start proxy success
[NOTICE]   (1) : Loading success.
[2025-11-04T11:29:35+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T11:58:17+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T12:13:43+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.
[2025-11-04T12:21:37+0000] [WARNING] FRP certificate file '/certs/frp/ca.crt' not found on HaRP agent. Skipping FRP cert installation.

In nc apache logs:

172.19.1.0 - - [04/Nov/2025:13:17:16 +0000] "GET /apps/app_api/daemons/harp_proxy_host/test_deploy/status HTTP/1.1" 200 841 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0"

Nextcloud logs:

{"reqId":"ore3AXIXNG6fBHGhhg23","level":3,"time":"2025-11-04T12:26:46+00:00","remoteAddr":"","user":"--","app":"app_api","method":"","url":"--","message":"ExApp test-deploy heartbeat check failed. Make sure that Nextcloud instance and ExApp can reach it other.","userAgent":"--","version":"32.0.1.2","data":{"app":"app_api"},"id":"6909f108b1b92"}
{"reqId":"ugTHngiNvbFdwpGJRsRF","level":3,"time":"2025-11-04T12:26:46+00:00","remoteAddr":"172.19.1.0","user":"admin","app":"app_api","method":"POST","url":"/apps/app_api/daemons/harp_proxy_host/test_deploy","message":"Error executing occ command. Return code: 1, stdout: , stderr: ","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0","version":"32.0.1.2","data":{"app":"app_api"},"id":"6909f108b1b8d"}

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions