invalid number of arguments in "location" directive

[crackhawk]

Hi!

I've encountered an issue with virtual hosts that use only a slash ("/") in the location under "individual paths." Since the last update, the following error appears:

I temporarily resolved the problem by restoring the old "_location.conf" file from "/app/templates/_location.conf."
(https://github.com/ZoeyVid/NPMplus/blob/423ec0136d75429a0a54fa34a87277de73a6a53d/backend/templates/_location.conf)

Could you please check this?

Thank you very much!

[Zoey2936]

can you please test with this template please?

{% assign forward_path_last_char = forward_path | slice: -1 -%}
{% assign path_last_char = path | slice: -1 -%}
{% if path != "/" %}
location {% if path_last_char != "/" %}{{ path }}{% else %}{{ path | remove_last: "/" }}{% endif %} {
    absolute_redirect off;
    return 301 {{ path }}{% if path_last_char != "/" %}/{% endif %};
}
{% endif %}

location {{ path }}{% if path_last_char != "/" %}/{% endif %} {
  set $forward_scheme "{{ forward_scheme }}";
  set $server         "{{ forward_host }}";
  set $port           "{{ forward_port }}";
  set $forward_path   "{{ forward_path }}";
  
  {{ advanced_config }}
    
  {% if allow_websocket_upgrade %}
  proxy_set_header Upgrade    $http_upgrade;
  proxy_set_header Connection $connection_upgrade;
  {% endif %}

  include conf.d/include/proxy-headers.conf;
  proxy_pass {{ forward_scheme }}://{{ forward_host }}{% if forward_port != null %}:{{ forward_port }}{% endif %}{{ forward_path }}{% if forward_path_last_char != "/" %}$request_uri{% endif %};
}

[Zoey2936]

this fix is now released

[crackhawk]

Thank's! I tested it. Saving the host works, and the host is online. However, I can't access the website. Error 404 - Not Found.

[Zoey2936]

can you send me a screenshot of your custom location configuration please? the template change will be released with the next update

[Zoey2936]

I tested and it worked for me with mailcow.
thunderbird make sits requests to:
https://autoconfig.example.com/mail/[email protected]
I've proxies my mailcow to /something (path is not important since mailcow uses regex for this)
and then opened
https://autoconfig.example.com/mail/[email protected]
it showed me the page
it shows me 404 when opening the subdomain directly, but no client uses that

[Zoey2936]

also you don't need a custom location/individueller pfad for this, you can directly do this in the details tab, since the last update

[Zoey2936]

but if you need that it works under / please report back, I will try to make it possible, but it should work without

[crackhawk]

Thanks for the hint!

In the case of autoconfig.domain.com, it works if I specify the XML file directly, see here:

The same applies to autodiscover.domain.com. I didn’t know this was possible now. Thanks! I think I can manage from here.

Edit:
I tested it with the latest "_location.conf" file, and it works with that. Not with the version you posted above.

[crackhawk]

Bonus:
autoconfig.domain.com directly shows the xml, same as autoconfig.domain.com/mail/config-v1.1.xml, same as autoconfig.domain.com/whatever. I like that!

[Joly0]

Hey, i am having a similar issue. So my proxy hosts are still there, though npmplus complains about an error in my 1.conf file which contains this invalid location:

# custom locations
location  {
    absolute_redirect off;
    return 301 /;
}

I tried removing it and deactivated and reactivated the host, but the location is readded directly. The location tab for that proxy looks like this:

Also for some reasons there are only 3 proxy host files, of which 1.conf has the mentioned error, 2.conf is fine though and 3.conf has a different error (atleast the file name currently is 3.conf.err). But i have 21 proxy hosts in the webui.

[Zoey2936]

While we are at it, might be good to have some information somewhere in the webui, which headers are already included and not needed

proxy heaeders are all set, there should be no need to set more headers, for headers sent to the user there is a link near the security headers button which links to the set headers, also there is one header which is set when uisng quic, but thats a diffrent topic (the quic header)

[Zoey2936]

the biggest problem currently is X-XSS-Protection, it needs to be off, but nextcloud still warns the user that the value is wrong and recommends to set it to a "Insecure" value

[Zoey2936]

I even added a note to the reverse proxy guid of nextcloud aio: https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#npmplus-fork-of-nginx-proxy-manager---npm Please note: Nextcloud will complain that X-XXS-Protection is set to the wrong value, this is intended by NPMplus.

[Joly0]

Ok, so i went through each host and removed the individual paths where they were not needed and added only these headers to the advanced tab:

server_tokens off;

more_set_headers "Referrer-Policy: no-referrer, strict-origin-when-cross-origin";
more_set_headers "X-Robots-Tag: none";
more_set_headers "Cache-Control: no-transform" always;

and a CSP for each host which i confirmed and adusted for each host using more_set_headers "Content-Security-Policy: XYZ
I think that should be good. Some hosts do have additional headers like jellyfin which recommends:

proxy_buffering off;
proxy_headers_hash_max_size 2048;
proxy_headers_hash_bucket_size 128; 
client_max_body_size 20M;

or nextcloud which has these additional ones:

client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;

but other than that, all my hosts are pretty basic now and should not interfere with npmplus

Cache-control is probably not optimal for each and every service, but i would have to configure that on a per path basis for the services and i dont want to do that now

[Zoey2936]

looks good (see comments):

more_set_headers "Referrer-Policy: no-referrer, strict-origin-when-cross-origin"; # if you don't need refferer, also fine
more_set_headers "X-Robots-Tag: none"; # if you want no indexing by google, etc. then this looks good
more_set_headers "Cache-Control: no-transform" always; # I think the "always" can be removed, but else it looks fine if you want his

already set by npmplus (see comments):

server_tokens off; # npmplus goes even further by completly removing this header (but setting is still set)
proxy_headers_hash_max_size 2048; # default value of npmplus
proxy_headers_hash_bucket_size 128;  # default value of npmplus
client_max_body_size 20M; # not exactly, but default set to 0, which means no limit
# I think theese are from the AIO reverse proxy guide and not needed with npmplus (because default values), see the guide itself (I wrote the npm and npmplus aio reverse proxy docs)
client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;

if you set proxy_buffering to off, then you should also set proxy_request_buffering to off, but this only makes sense if the latency between npmplus and the upstream is very low (so same host or lan), but this setting is ignored when using crowdsec, crowdsec will ever set this to on (when using it), if you run all yourt upstreams on the same host/lan you can also set NGINX_DISABLE_PROXY_BUFFERING to true, thsi will change the global default value of both directives

Hope this helps you!