Skip to content

enh: add harp config #382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kyteinsky wants to merge 7 commits into
base: master
Choose a base branch
from
+37 −0
Open

enh: add harp config #382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
67ebfa4
enh: add harp config
kyteinsky Feb 12, 2025
88e3d89
env var changes
kyteinsky Feb 12, 2025
339bac2
vhost change to location + env fixes
kyteinsky Feb 25, 2025
2fdfba0
updates
kyteinsky Feb 27, 2025
5d24fd0
add env HP_SESSION_LIFETIME
kyteinsky Feb 27, 2025
0c56460
change name to appapi-harp
kyteinsky Mar 3, 2025
4335801
chore: adjust to the new changes
kyteinsky Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions data/nginx/vhost.d/nextcloud.local_location
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
location /exapps/ {

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will be good to add:

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

here to allow ExApps to receive websocket connections

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 1800s;

set $harp_addr appapi-harp:8780;

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in my setup the proxy_pass with a variable and a URI part discards the request URI

I used this:

set $harp_upstream http://appapi-harp:8780;
proxy_pass $harp_upstream;

do not know what is more correct, my setup is a fresh one and is not fully tested...

proxy_pass http://$harp_addr/exapps/;
}

Empty file added data/ssl/harp/.gitkeep
View file
Open in desktop
Empty file.
26 changes: 26 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1404,6 +1404,32 @@ services:
- ./authentik-custom-templates:/templates
- ./authentik-certs:/certs

appapi-harp:
image: ghcr.io/nextcloud/nextcloud-appapi-harp:latest
container_name: appapi-harp
network_mode: ${HP_NETWORK_MODE:-master_default}
volumes:
- /var/run/docker.sock:/var/run/docker.sock

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The convention here is ${DOCKER_SOCKET-/var/run/docker.sock} (lines 11, 1312, 1328), documented at example.env:62 for rootless Docker

- ${CERT_PATH:-./data/ssl/harp/}:/certs

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Line 1329 uses it for appapi-dsp-https as ${CERT_PATH:-./data/ssl/app_api/app_api.pem}:/certs/cert.pem, and example.env:68 documents it as that .pem file. Anyone who uncomments it per example.env gets a single file bind-mounted at HaRP's /certs, where start.sh does mkdir -p /certs/frp on boot, so HaRP will not start. A separate HP_CERT_PATH avoids the clash

ports:
- "8780:8780"
- "8781:8781"
- "8782:8782"
environment:
- HP_SHARED_KEY=${HP_SHARED_KEY:-some_very_secure_password}
- HP_TRUSTED_PROXY_IPS={HP_TRUSTED_PROXY_IPS:-${DOCKER_SUBNET:-192.168.21.0/24}}

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does $ is missing here for HP_TRUSTED_PROXY_IPS?

- NC_INSTANCE_URL=${HP_NC_INSTANCE_URL:-http://nextcloud.local}

@oleksandr-nc oleksandr-nc Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rest of the stack parameterises host names with ${DOMAIN_SUFFIX} (example.env:38). With e.g. DOMAIN_SUFFIX=.test the vhost becomes nextcloud.test, nginx-proxy finds no matching <host>_location file

- HP_FRP_DISABLE_TLS=${HP_FRP_DISABLE_TLS:-false}
- HP_EXAPPS_ADDRESS=${HP_EXAPPS_ADDRESS:-0.0.0.0:8780}
- HP_EXAPPS_HTTPS_ADDRESS=${HP_EXAPPS_HTTPS_ADDRESS:-0.0.0.0:8781}
- HP_FRP_ADDRESS=${HP_FRP_ADDRESS:-0.0.0.0:8782}
- HP_LOG_LEVEL=${HP_LOG_LEVEL:-info}
- HP_VERBOSE_START=${HP_VERBOSE_START:-1}
- HP_WATCHDOG_ENABLED=${HP_WATCHDOG_ENABLED:-true}
- HP_BLACKLIST_COUNT=${HP_BLACKLIST_COUNT:-10}
- HP_TIMEOUT_CLIENT=${HP_TIMEOUT_CLIENT:-30s}
- HP_TIMEOUT_SERVER=${HP_TIMEOUT_SERVER:-1800s}

volumes:
data:
config:
Expand Down
Loading