HaRP exposes unecessary ports ?

[meepmeep]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. deploy harp with docker compose and this file

version: "3"
services:
    nextcloud-appapi-harp:
        environment:
            - HP_SHARED_KEY=MySecretKeyxxxxxxxxxxxxxxxxxxxxxx
            - NC_INSTANCE_URL=http://domain.tld/nextcloud
            - HP_EXAPPS_ADDRESS=192.168.10.20:8780
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /opt/harp/certs:/certs
        container_name: appapi-harp
        hostname: appapi-harp
        restart: unless-stopped
        network_mode: host
        image: ghcr.io/nextcloud/nextcloud-appapi-harp:release

2. check netstat for open port : netstat -taupen |grep -v LISTEN
3. Surprise :

docker (haproxy) is listening on configured port (8780), as asked in the config file
tcp 0 0 192.168.10.20:8780 0.0.0.0:* LISTEN 0 1278092793 2925/haproxy
But another binary (frps) is listening on other ports, publicly (line 2 and 3)

# netstat -taupen  |grep -v earnapp |grep frps
tcp        0      0 127.0.0.1:36614         127.0.0.1:8200          ESTABLISHED 0          1278090791 2907/frps
tcp6       0      0 :::24000                :::*                    LISTEN      0          1278093581 2907/frps
tcp6       0      0 :::8782                 :::*                    LISTEN      0          1278087105 2907/frps
tcp6       0      0 127.0.0.1:8782          127.0.0.1:59346         ESTABLISHED 0          1278093578 2907/frps

Expected behaviour

Only "192.168.10.20:8780" should be used,. No other port should be bind, even more publicly

Actual behaviour

check step 3 above.

Server configuration

Web server: nginx

Database: unrelated

PHP version: unrelated

Nextcloud version: (see Nextcloud admin page) : Nextcloud Hub 25 Autumn (32.0.1)

[oleksandr-nc]

Only "192.168.10.20:8780" should be used,. No other port should be bind, even more publicly

Hello. HaRP can use more then one port.

Port 24000 is used to communicate with Docker Engine.
Port 8782 is used by FRP server to listen for connections from ExApps.

While for some configurations these ports can be not opened(there is a mode to run HaRP in the old way, like DSP does - without FRP) - for some configurations these ports are needed.

The only thing I noticed is that port 24000 should probably be on the localhost interface, as it's for the built-in Docker Engine. This needs to be looked into; you've raised an interesting point.