Connection Refused #1663

akavkl · 2025-03-27T14:42:42Z

akavkl
Mar 27, 2025

npmplus logs :-

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 18:45:34 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

npm-1   updated
LINEAGE RESULT  REASON

Starting services...
2025/03/27 18:45:35 [notice] 242#242: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:91
2025/03/27 18:45:35 [notice] 242#242: ModSecurity-nginx v1.0.3 (rules loaded inline/local/remote: 0/0/0)
2025/03/27 18:45:35 [notice] 242#242: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:183
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
[Migrate  ] › ℹ  info      Current database version: none
[Certbot  ] › ▶  start     Installing dynu...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-dynu
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
[Certbot  ] › ☒  complete  Installed dynu
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[SSL      ] › ℹ  info      Certbot Renewal Timer initialized
[IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[Global   ] › ℹ  info      Backend PID 244 listening on port 48681
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
2025/03/27 18:45:44 [emerg] 242#242: quic bpf setsockopt(SO_ATTACH_REUSEPORT_EBPF) failed (22: Invalid argument)
2025/03/27 18:45:44 [emerg] 242#242: ngx_quic_bpf_module failed to initialize properly, ignored.please check limits and note that nginx state now can be inconsistent and restart may be required

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 19:19:08 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.
removed '/usr/local/nginx/logs/nginx.pid'

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

npm-1   failed to update
LINEAGE RESULT                  REASON

Starting services...
2025/03/27 19:23:48 [notice] 336#336: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:91
2025/03/27 19:23:48 [notice] 336#336: ModSecurity-nginx v1.0.3 (rules loaded inline/local/remote: 0/0/0)
2025/03/27 19:23:48 [notice] 336#336: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:183
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
[Migrate  ] › ℹ  info      Current database version: none
[Certbot  ] › ▶  start     Installing dynu...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-dynu
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
2025/03/27 19:24:08 [error] 345#345: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:24:38 [error] 345#345: *3 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:25:08 [error] 345#345: *5 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:25:38 [error] 345#345: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:26:08 [error] 345#345: *9 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:26:38 [error] 345#345: *11 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:27:08 [error] 345#345: *13 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:27:38 [error] 345#345: *15 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:28:08 [error] 345#345: *17 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:28:38 [error] 345#345: *19 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:29:09 [error] 345#345: *21 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:29:39 [error] 345#345: *23 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 19:30:09 [error] 345#345: *25 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
[Certbot  ] › ☒  complete  Installed dynu
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ✖  error
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[SSL      ] › ℹ  info      Certbot Renewal Timer initialized
[IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[Global   ] › ℹ  info      Backend PID 338 listening on port 48681
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload

docker compose file:-

services:
  npmplus:
    container_name: npmplus
    image: docker.io/zoeyvid/npmplus:447 # or ghcr.io/zoeyvid/npmplus:latest
    restart: always
#    network_mode: host
    ports:
      - "80:80"
      - "81:81"
      - "443:443"
#    ipc: service:openappsec-agent # required when you want to use the openappsec attachment module
    privileged: true # required if you set NGINX_QUIC_BPF to true
    volumes:
      - "/opt/npmplus:/data"
      - "/var/run/docker.sock:/tmp/docker.sock:ro"
#      - "/var/www:/var/www" # optional, if you want to use NPMplus directly as webserver for html/php
#      - "/path/to/old/npm/letsencrypt/folder:/etc/letsencrypt" # Only needed for first time migration from original nginx-proxy-manager to this fork
    environment:
      - "TZ=Asia/Kolkata" # set timezone, required, set it to one of the values from the "TZ identifier" https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
      - "ACME_EMAIL=swarnim68@gmail.com" # email address which should be used for acme, currently optional, may be required in the future, so I recommend you to enter your email here, optional for letsencrypt, but required for zerossl and google public ca
#      - "ACME_SERVER=https://dv.acme-v02.api.pki.goog/directory (google public ca) / https://acme.zerossl.com/v2/DV90 (zerossl)" # acme server used when requesting/renewing certs using certbot, default is set to: https://acme-v02.api.letsencrypt.org/directory (letsencrypt)
#      - "ACME_EAB_KID=123456789abcdef" # Key Identifier for External Account Binding for the acme server, not supported by letsencrypt, optional for zerossl (Login on theier site => Developer), but required for google public ca: https://cloud.google.com/certificate-manager/docs/public-ca-tutorial?hl=de#request-key-hmac
#      - "ACME_EAB_HMAC_KEY=123456789abcdef" # HMAC key for External Account Binding for the acme server, not supported by letsencrypt, optional for zerossl (Login on theier site => Developer), but required for google public ca: https://cloud.google.com/certificate-manager/docs/public-ca-tutorial?hl=de#request-key-hmac
#      - "ACME_MUST_STAPLE=true" # enables must-staple, default false, I recommend you to enable this if your CA supports it, supported by zerossl, google public ca ignores this, unsupported by letsencrypt (will fail), overrides ACME_OCSP_STAPLING to true
#      - "ACME_OCSP_STAPLING=false" # enables ocsp stapling, default true, I recommend you to enable this if your CA supports it, supported by zerossl and google public ca, unsupported by letsencrypt certs created after May 7, 2025 (will create warning in your log, default value will change then)
#      - "ACME_KEY_TYPE=rsa" # which key type to use ecdsa or rsa, default and recommended: ecdsa
#      - "ACME_SERVER_TLS_VERIFY=false" # enables checking if ACME_SERVER has a valid TLS cert, default true
#      - "CUSTOM_OCSP_STAPLING=true" # enables ocsp stapling for custom certs, default false, I recommend you to enable this if your custom certs support it
#      - "PUID=1000" # set group id, needs to be a number greater or equal to 99, or equal to 0, default 0 (root)
#      - "PGID=1000" # set user id, needs to be a number greater or equal to 99, or equal to 0, default 0 (root), requires PUID to be not 0
#      - "NIBEP=48682" # internal port of the NPMplus API, always bound to 127.0.0.1, default 48681, you need to change it, if you want to run multiple npm instances in network mode host
#      - "GOAIWSP=48692" # internal port of goaccess, always bound to 127.0.0.1, default 48691, you need to change it, if you want to run multiple npm with goaccess instances in network mode host
#      - "NPM_PORT=81" # Port the NPM UI should be bound to, default 81, you need to change it, if you want to run multiple npm instances in network mode host
#      - "GOA_PORT=92" # Port the goaccess should be bound to, default 91, you need to change it, if you want to run multiple npm with goaccess instances in network mode host
#      - "IPV4_BINDING=172.20.0.1" # IPv4 address to bind, defaults to all
#      - "NPM_IPV4_BINDING=172.20.0.1" # IPv4 address to bind for the NPM UI, defaults to all
#      - "GOA_IPV4_BINDING=127.0.0.1" # IPv4 address to bind for the goaccess, defaults to all
#      - "IPV6_BINDING=[::1]" # IPv6 address to bind, defaults to all
#      - "NPM_IPV6_BINDING=[::1]" # IPv6 address to bind for the NPM UI, defaults to all
#      - "GOA_IPV6_BINDING=[::1]" # IPv6 address to bind for goaccess, defaults to all
#      - "DISABLE_IPV6=true" # fully disables listing on IPv6 and the IPv6 resolver of nginx, overrides IPV6_BINDING/NPM_IPV6_BINDING/GOA_IPV6_BINDING, default false
#      - "NPM_LISTEN_LOCALHOST=true" # Binds the NPM UI only to localhost, overrides NPM_IPV4_BINDING/NPM_IPV6_BINDING, default false
#      - "GOA_LISTEN_LOCALHOST=true" # Binds goaccess only to localhost, overrides NPM_IPV4_BINDING/NPM_IPV6_BINDING, default false
#      - "DEFAULT_CERT_ID=1" # ID of cert, which should be used instead of dummycerts, default 0/unset/dummycerts
#      - "HTTP_PORT=80" # tcp port to use for http traffic, changing this may breaks certbot http challenge, default 80
#      - "HTTPS_PORT=443" # udp and tcp port to use for https traffic, changing this may breaks certbot http challenge, default 443
#      - "HTTP3_ALT_SVC_PORT=8443" # please change this if the udp port the clients connect to is not 443, default 443
#      - "DISABLE_HTTP=true" # disables nginx to listen on port 80, default false
#      - "LISTEN_PROXY_PROTOCOL=true" # should listeners of http(s) hosts (proxy/redirect/dead and default) use proxy protocol instead of http(s)? default false, overrides DISABLE_H3_QUIC to true
#      - "DISABLE_H3_QUIC=true" # disables nginx to listen on port 443 udp for default host and all your hosts, this will fully disable HTTP/3 and QUIC, even if you enable it inside the UI, not recommended, default false
      - "NGINX_QUIC_BPF=true" # enables nginxs quic_bpf (https://nginx.org/en/docs/http/ngx_http_v3_module.html#quic_bpf), you also need to to give the NPMplus container privileged permissions to use this, default false
#      - "NGINX_LOG_NOT_FOUND=true" # Allow logging of 404 errors, default false
#      - "NGINX_404_REDIRECT=true" # Redirect to / instead of showing a 404 error page, default false
#      - "NGINX_HSTS_SUBDMAINS=false" # when enabling security headers, also enable hsts for subdomains, default true
#      - "X_FRAME_OPTIONS=deny" # value to use for the X-Frame-Options header when enabling security headers, valid is deny, sameorigin and none (means unset), default sameorigin, since this applies to all hosts I recommend you to instead keep the default and only change it for hosts which need it using the advanced config and more_set_headers
      - "NGINX_DISABLE_PROXY_BUFFERING=true" # Disables the proxy_buffering/proxy_request_buffering options of nginx, default false, may not work if you use crowdsec/appsec
#      - "NGINX_WORKER_PROCESSES=8" value of worker_processes, default and recommended: auto
#      - "DISABLE_NGINX_BEAUTIFIER=true" # disables nginxbeautifier, useful when it fails parsing non-standard configs, default false
#      - "FULLCLEAN=true" # Clean unused config folders, default false
#      - "SKIP_IP_RANGES=true" # Skip feteching/whitelisting ip ranges from cloudflare, default false
#      - "LOGROTATE=true" # Enables writing http access logs to /opt/npmplus/nginx/access.log, stream access logs to /opt/npmplus/nginx/stream.log and enables daily logrotation, default false
#      - "LOGROTATIONS=7" # Set how often the access.log should be rotated until it is deleted, default 3
#      - "CRT=36" # Set how many hours should be between certbot trying to renew your certs, default 24
#      - "IPRT=3" # Set how many hours should be between updating ip ranges from aws and cloudflare, default 1, ignored when SKIP_IP_RANGES is true
#      - "GOA=true" # Enables goaccess, requires LOGROTATE, default false --- if you download the GeoLite2-Country.mmdb, GeoLite2-City.mmdb AND GeoLite2-ASN.mmdb file from MaxMind and place them in /opt/npmplus/goaccess/geoip it will automatically enable GeoIP in goaccess after restarting NPMplus (no need to change GOACLA below), you may also enable the geoipupdate container below (please change the timezone)
#      - "GOACLA=--agent-list --real-os --double-decode --anonymize-ip --anonymize-level=2 --keep-last=7 --with-output-resolver --no-query-string" # Arguments that should be passed to goaccess, default: --agent-list --real-os --double-decode --anonymize-ip --anonymize-level=1 --keep-last=30 --with-output-resolver --no-query-string
#      - "PHP82=true" # Activate PHP82, default false
#      - "PHP82_APKS=php82-curl php82-openssl" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php82-*, default none, requires PHP82
#      - "PHP83=true" # Activate PHP83, default false
#      - "PHP83_APKS=php83-curl php83-openssl" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php83-*, default none, requires PHP83
#      - "PHP84=true" # Activate PHP84, default false
#      - "PHP84_APKS=php84-curl php84-openssl" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php84-*, default none, requires PHP84
#      - "PHP_APKS=php-pecl-apcu php-pecl-redis" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/packages?branch=v3.21&repo=community&arch=x86_64&name=php-*, default none, requires PHP82, PHP83 and/or PHP84, not recommended, please use PHP82_APKS, PHP83_APKS or PHP84_APKS
      - "INITIAL_ADMIN_EMAIL=demo@example.com" # email to use instead of admin@example.org on first start of NPMplus for the initial user
      - "INITIAL_ADMIN_PASSWORD=password" # password to use instead of a random password which is logged on first start of NPMplus for the initial user
#      - "INITIAL_DEFAULT_PAGE=444" # default page to set on first start of NPMplus for the initial user, default congratulations, can be one of: 404, 444, redirect, congratulations or html
#      - "ENABLE_PRERUN=true" # see readme, default off
#      - "NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=true" # loads the openappsec attachment module, you also need to set ipc for NPMplus in this composse file, this will fully disable brotli, even if you enable it inside the UI, default false
#      - "NGINX_LOAD_OPENTELEMETRY_MODULE=true" # loads the opentelemetry module, you need to configure this yourself, default false
#      - "NGINX_LOAD_FANCYINDEX_MODULE=true" # loads the fancyindex module, default false
#      - "NGINX_LOAD_GEOIP2_MODULE=true" # loads the geoip2 module, you need to configure this yourself, default false
#      - "NGINX_LOAD_NJS_MODULE=true" # loads the njs module (nginx JavaScript module), you need to configure this yourself, default false
#      - "NGINX_LOAD_NTLM_MODULE=true" # loads the ntml module, you need to configure this yourself, default false
#      - "NGINX_LOAD_VHOST_TRAFFIC_STATUS_MODULE=true" # loads the virtual host traffic status module, you need to configure this yourself, default false

# This can be used to enable crowdsec, see README for a guide
#  crowdsec:
#    container_name: crowdsec
#    image: docker.io/crowdsecurity/crowdsec:latest
#    restart: always
#    network_mode: bridge
#    ports:
#      - "127.0.0.1:7422:7422"
#      - "127.0.0.1:8080:8080"
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "COLLECTIONS=ZoeyVid/npmplus"
#    volumes:
#      - "/opt/crowdsec/conf:/etc/crowdsec"
#      - "/opt/crowdsec/data:/var/lib/crowdsec/data"
#      - "/opt/npmplus/nginx:/opt/npmplus/nginx:ro"
#      - "/opt/openappsec/logs:/opt/openappsec/logs:ro" # only uncomment if you also use the openappsec-agent container

# This can be used with GOA=true, to keep the geopip database updated, you need to change the envs to make it work
#  geoipupdate:
#    container_name: npmplus-geoipupdate
#    image: docker.io/maxmindinc/geoipupdate:latest
#    restart: always
#    network_mode: bridge
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "GEOIPUPDATE_EDITION_IDS=GeoLite2-Country GeoLite2-City GeoLite2-ASN"
#      - "GEOIPUPDATE_ACCOUNT_ID=<your-account-id>" # needs to be changed
#      - "GEOIPUPDATE_LICENSE_KEY=<your-license-key>" # needs to be changed
#      - "GEOIPUPDATE_FREQUENCY=24"
#    volumes:
#      - "/opt/npmplus/goaccess/geoip:/usr/share/GeoIP"

# This can be used to run openappsec, you also need to set NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE to true and set ipc for NPMplus
#  openappsec-agent:
#    container_name: openappsec-agent
#    image: ghcr.io/openappsec/agent:latest
#    restart: always
#    ipc: shareable
#    volumes:
#      - "/opt/openappsec/conf:/etc/cp/conf"
#      - "/opt/openappsec/data:/etc/cp/data"
#      - "/opt/openappsec/logs:/var/log/nano_agent"
#      - "/opt/openappsec/localconf:/ext/appsec" # if you don't set AGENT_TOKEN, then please put a local_policy.yaml in the /opt/openappsec/localconf folder before deploying
#      - "/opt/openappsec/open-appsec-advanced-model.tgz:/advanced-model/open-appsec-advanced-model.tgz" # optional, if you want to use a different model
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "autoPolicyLoad=true"
#      - "registered_server=NPMplus"
#      - "user_email=your-email" # optional, from theier docs: "This allows the open-appsec team to provide you easy assistance in case of any issues you might have with your specific deployment in the future and also to provide you information proactively regarding open-appsec in general or regarding your specific deployment. [...] If we send automatic emails there will also be an opt-out option included for receiving similar communication in the future."
#      - "AGENT_TOKEN=" # optional, you can specify an openappsec deployment profile token for connecting to their central webinterface  at https://my.openappsec.io, if you leave this commented, make sure to uncomment all other openappsec containers below, see: https://docs.openappsec.io/getting-started/using-the-web-ui-saas/create-a-profile
#      - "SHARED_STORAGE_HOST=openappsec-shared-storage" # uncomment if you don't set AGENT_TOKEN
#      - "LEARNING_HOST=openappsec-smartsync" # uncomment if you don't set AGENT_TOKEN
#      - "TUNING_HOST=openappsec-tuning-svc" # uncomment if you don't set AGENT_TOKEN
#    command: /cp-nano-agent

# uncomment if you don't set AGENT_TOKEN
#  openappsec-smartsync:
#    container_name: openappsec-smartsync
#    image: ghcr.io/openappsec/smartsync:latest
#    restart: always
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "SHARED_STORAGE_HOST=openappsec-shared-storage"
#    depends_on:
#      - openappsec-shared-storage
#  openappsec-shared-storage:
#    container_name: openappsec-shared-storage
#    image: ghcr.io/openappsec/smartsync-shared-files:latest
#    restart: always
#    ipc: service:openappsec-agent
#    user: root # if you do not want to run this container as "root" user you can comment it out and instead run the following command after the deployment: docker exec -u root openappsec-shared-storage chown -R appuser:appuser /db
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#    volumes:
#      - "/opt/openappsec/storage:/db"
#  openappsec-tuning-svc:
#    container_name: openappsec-tuning-svc
#    image: ghcr.io/openappsec/smartsync-tuning:latest
#    restart: always
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "SHARED_STORAGE_HOST=openappsec-shared-storage"
#      - "QUERY_DB_HOST=openappsec-db"
#      - "QUERY_DB_PASSWORD=password" # replace with something secure, should match POSTGRES_PASSWORD from openappsec-db container
#      - "QUERY_DB_USER=appsec"
#    volumes:
#      - "/opt/openappsec/conf:/etc/cp/conf"
#    depends_on:
#      - openappsec-shared-storage
#      - openappsec-db
#  openappsec-db:
#    image: postgres
#    container_name: openappsec-db
#    restart: always
#    environment:
#      - "TZ=your-timezone" # needs to be changed
#      - "POSTGRES_PASSWORD=password" # replace with something secure, should match QUERY_DB_PASSWORD from openappsec-tuning-svc container
#      - "POSTGRES_USER=appsec"
#    volumes:
#      - "/opt/openappsec/pgdb:/var/lib/postgresql/data"

# This can be used with DISABLE_HTTP=true, to force HTTPS redirects for every host
#  npmplus-caddy:
#    container_name: npmplus-caddy
#    image: docker.io/zoeyvid/npmplus:caddy
#    restart: always
#    network_mode: bridge
#    ports:
#      - "80:80"
#    environment:
#      - "TZ=your-timezone"

  portainer:
    container_name: portainer
    image: portainer/portainer-ce:lts
    command: -H unix:///var/run/docker.sock
    restart: always
    environment:
      - VIRTUAL_HOST=portainer.example.com
      - VIRTUAL_PORT=9000
    ports:
      - 8000:8000
#      - 9000:9000
      - 9443:9443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data

volumes:
  portainer_data:

Answered by Zoey2936

Apr 2, 2025

maybe something is blocking network while logged out?

View full answer

Zoey2936 · 2025-03-27T15:30:02Z

Zoey2936
Mar 27, 2025
Maintainer

does it work if you disable NGINX_QUIC_BPF?

1 reply

akavkl Mar 27, 2025
Author

with NGINX_QUIC_BPF disabled

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 20:28:37 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

npm-1   updated
LINEAGE RESULT  REASON

Starting services...
2025/03/27 20:28:39 [notice] 240#240: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:91
2025/03/27 20:28:39 [notice] 240#240: ModSecurity-nginx v1.0.3 (rules loaded inline/local/remote: 0/0/0)
2025/03/27 20:28:39 [notice] 240#240: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:183
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
[Migrate  ] › ℹ  info      Current database version: none
[Certbot  ] › ▶  start     Installing dynu...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-dynu
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
[Certbot  ] › ☒  complete  Installed dynu
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[SSL      ] › ℹ  info      Certbot Renewal Timer initialized
[IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[Global   ] › ℹ  info      Backend PID 242 listening on port 48681
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 21:07:09 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.
removed '/usr/local/nginx/logs/nginx.pid'

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

npm-1   failed to update
LINEAGE RESULT                  REASON

Starting services...
2025/03/27 21:11:52 [notice] 335#335: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:91
2025/03/27 21:11:52 [notice] 335#335: ModSecurity-nginx v1.0.3 (rules loaded inline/local/remote: 0/0/0)
2025/03/27 21:11:52 [notice] 335#335: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:183
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
[Migrate  ] › ℹ  info      Current database version: none
[Certbot  ] › ▶  start     Installing dynu...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-dynu
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
2025/03/27 21:12:09 [error] 344#344: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:12:39 [error] 344#344: *3 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:13:10 [error] 344#344: *5 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:13:40 [error] 344#344: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:14:10 [error] 344#344: *9 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:14:40 [error] 344#344: *11 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:15:10 [error] 344#344: *13 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:15:40 [error] 344#344: *15 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:16:10 [error] 344#344: *17 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
2025/03/27 21:16:40 [error] 344#344: *19 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 21:17:35 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.
removed '/usr/local/nginx/logs/nginx.pid'

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

akavkl · 2025-03-27T17:38:40Z

akavkl
Mar 27, 2025
Author

Below is the logs when docker compose down then up -d is used

-------------------------------------
 _ _  ___  __ __       _
| \ || . \|  \  \ ___ | | _ _  ___
|   ||  _/|     || . \| || | |[_-[
|_\_||_|  |_|_|_||  _/|_| \__|/__/
                 |_|
-------------------------------------
Version:  2.12.3+017cc79
Date:     Thu Mar 27 22:30:47 IST 2025
-------------------------------------

no DEFAULT_CERT_ID set, using dummycerts.

-------------------------------------
User:     root
PUID:     0
User ID:  0
PGID:     0
Group ID: 0
-------------------------------------

Running in stand-alone mode...

LINEAGE RESULT  REASON
npm-1   updated

Starting services...
2025/03/27 22:30:48 [notice] 241#241: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:91
2025/03/27 22:30:48 [notice] 241#241: ModSecurity-nginx v1.0.3 (rules loaded inline/local/remote: 0/0/0)
2025/03/27 22:30:48 [notice] 241#241: parsed a resolver: "127.0.0.11" in /usr/local/nginx/conf/nginx.conf:183
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
[Migrate  ] › ℹ  info      Current database version: none
[Certbot  ] › ▶  start     Installing dynu...
[Global   ] › ⬤  debug     CMD: pip install --upgrade --no-cache-dir certbot-dns-dynu
[Global   ] › ⬤  debug     CMD: nginxbeautifier -s 4 /usr/local/nginx/conf/conf.d/default.conf
[Certbot  ] › ☒  complete  Installed dynu
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[SSL      ] › ℹ  info      Certbot Renewal Timer initialized
[IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[Global   ] › ℹ  info      Backend PID 243 listening on port 48681
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload

11 replies

Zoey2936 Mar 28, 2025
Maintainer

does it break after every reboot?

akavkl Mar 28, 2025
Author

yes, it breaks after every reboot

Zoey2936 Mar 28, 2025
Maintainer

do you run in a lxc? or some kind of virtualization?

akavkl Mar 28, 2025
Author

yes, lxc is installed with Incus, but I haven't set it up yet.

Zoey2936 Mar 28, 2025
Maintainer

so is npmplus running in lxc or not?

akavkl · 2025-03-28T13:54:24Z

akavkl
Mar 28, 2025
Author

Npmplus is on docker. Docker and lxc are on the same server

…

On Fri, 28 Mar, 2025, 7:23 pm Zoey, ***@***.***> wrote: so is npmplus running in lxc or not? — Reply to this email directly, view it on GitHub <#1663 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGTQJRMJ24N5TN7JUXZDSFD2WVA23AVCNFSM6AAAAABZ5TYARWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENRVGM2DMOA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

1 reply

Zoey2936 Mar 28, 2025
Maintainer

but docker is not running in lxc?

akavkl · 2025-03-28T14:00:33Z

akavkl
Mar 28, 2025
Author

Lxc and docker is installed side by side. Docker is not install inside lxc.

…

On Fri, 28 Mar, 2025, 7:26 pm Zoey, ***@***.***> wrote: but docker is not running in lxc? — Reply to this email directly, view it on GitHub <#1663 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGTQJRKFBO6E7AAQNUQSKU32WVBGJAVCNFSM6AAAAABZ5TYARWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENRVGM2TANQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

1 reply

Zoey2936 Mar 28, 2025
Maintainer

I can't reproduce can please describe it a bit more in detail please (what the error is, how to reproduce, etc)

akavkl · 2025-03-28T15:20:02Z

akavkl
Mar 28, 2025
Author

I've installed docker and lxc on an arch-based server, i.e. both lxc and docker are installed via their package manager alongside each other. lxc is not running docker. Both lxc and docker are passing data via bridges on one IP but with different ports.

11 replies

Zoey2936 Mar 30, 2025
Maintainer

can you put them in diffrent compose.yamls?

akavkl Mar 30, 2025
Author

They were separate before, and then Portainer was still accessible after the reboot, but NPM was not. I had to restart the NPM stack from Portainer to make it accessible again. Then, for some reason, Portioner was not accessible anymore, and to fix that, I had to restart Docker from Systemd. Then Portainer was accessible again, but then NPM wasn't, and then the loop went on.
So, to combat this issue, I combined Portainer and NPM. Then, this issue was solved, as both previously did not work together, then came this topic's issue, i.e., I had to manually docker-compose down and then up -d to make them work after every reboot.

akavkl Mar 30, 2025
Author

docker exec -it npmplus nginx 2025/03/31 01:55:06 [error] 459#459: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81" 2025/03/31 01:55:36 [error] 460#460: *3 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81" 2025/03/31 01:56:06 [error] 472#472: *5 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81" 2025/03/31 01:56:36 [error] 483#483: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81" 2025/03/31 01:57:06 [error] 459#459: *9 connect() failed (111: Connection refused) while connecting to upstream, client: 127.0.0.1, server: _, request: "GET /api/ HTTP/2.0", upstream: "http://127.0.0.1:48681/", host: "127.0.0.1:81"
This is when I try to start nginx from inside the container.

Zoey2936 Mar 30, 2025
Maintainer

Which docker version do you tun?

akavkl Mar 30, 2025
Author

Something to add, If I use docker-compose to restart the stack then the above command works fine without any errors.

akavkl · 2025-03-30T21:19:17Z

akavkl
Mar 30, 2025
Author

Which docker version do I use? Docker version 28.0.4, build b8034c0ed7

…

On Mon, 31 Mar, 2025, 2:08 am Zoey, ***@***.***> wrote: Which docker version do you tun? — Reply to this email directly, view it on GitHub <#1663 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGTQJRJB3C74DVELI7RQGOT2XBI55AVCNFSM6AAAAABZ5TYARWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENRWHE3DKMQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

1 reply

Zoey2936 Mar 30, 2025
Maintainer

And the issue always occurs when rebooting the system?

akavkl · 2025-03-30T21:33:31Z

akavkl
Mar 30, 2025
Author

Yes

…

On Mon, 31 Mar, 2025, 2:54 am Zoey, ***@***.***> wrote: And the issue always occurs when rebooting the system? — Reply to this email directly, view it on GitHub <#1663 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGTQJRNTZQXZTDZHE44OY2D2XBOIJAVCNFSM6AAAAABZ5TYARWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENRWHE4DENI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

2 replies

akavkl Apr 2, 2025
Author

A new insight: For some reason, this case only happens when login via sddm has not been done. But docker is running on root, so a non-root user's login shouldn't matter.

Zoey2936 Apr 2, 2025
Maintainer

maybe something is blocking network while logged out?

Answer selected by Zoey2936

Connection Refused #1663

Uh oh!

Uh oh!

akavkl Mar 27, 2025

Replies: 7 comments · 28 replies

Uh oh!

Zoey2936 Mar 27, 2025 Maintainer

Uh oh!

Uh oh!

akavkl Mar 27, 2025 Author

Uh oh!

Uh oh!

akavkl Mar 27, 2025 Author

Uh oh!

Zoey2936 Mar 28, 2025 Maintainer

Uh oh!

akavkl Mar 28, 2025 Author

Uh oh!

Zoey2936 Mar 28, 2025 Maintainer

Uh oh!

akavkl Mar 28, 2025 Author

Uh oh!

Zoey2936 Mar 28, 2025 Maintainer

Uh oh!

akavkl Mar 28, 2025 Author

Uh oh!

Zoey2936 Mar 28, 2025 Maintainer

Uh oh!

akavkl Mar 28, 2025 Author

Uh oh!

Zoey2936 Mar 28, 2025 Maintainer

Uh oh!

akavkl Mar 28, 2025 Author

Uh oh!

Zoey2936 Mar 30, 2025 Maintainer

Uh oh!

akavkl Mar 30, 2025 Author

Uh oh!

akavkl Mar 30, 2025 Author

Uh oh!

Zoey2936 Mar 30, 2025 Maintainer

Uh oh!

akavkl Mar 30, 2025 Author

Uh oh!

akavkl Mar 30, 2025 Author

Uh oh!

Zoey2936 Mar 30, 2025 Maintainer

Uh oh!

akavkl Mar 30, 2025 Author

Uh oh!

Uh oh!

akavkl Apr 2, 2025 Author

Uh oh!

Zoey2936 Apr 2, 2025 Maintainer

akavkl
Mar 27, 2025

Replies: 7 comments 28 replies

Zoey2936
Mar 27, 2025
Maintainer

akavkl Mar 27, 2025
Author

akavkl
Mar 27, 2025
Author

Zoey2936 Mar 28, 2025
Maintainer

akavkl Mar 28, 2025
Author

Zoey2936 Mar 28, 2025
Maintainer

akavkl Mar 28, 2025
Author

Zoey2936 Mar 28, 2025
Maintainer

akavkl
Mar 28, 2025
Author

Zoey2936 Mar 28, 2025
Maintainer

akavkl
Mar 28, 2025
Author

Zoey2936 Mar 28, 2025
Maintainer

akavkl
Mar 28, 2025
Author

Zoey2936 Mar 30, 2025
Maintainer

akavkl Mar 30, 2025
Author

akavkl Mar 30, 2025
Author

Zoey2936 Mar 30, 2025
Maintainer

akavkl Mar 30, 2025
Author

akavkl
Mar 30, 2025
Author

Zoey2936 Mar 30, 2025
Maintainer

akavkl
Mar 30, 2025
Author

akavkl Apr 2, 2025
Author

Zoey2936 Apr 2, 2025
Maintainer