Many hosts offline

[apocaliss92]

Hey good afternoon! I just notice that half of the hosts created on NPM are now marked offline and if I try to access them I get this error message

net::ERR_CERT_AUTHORITY_INVALID
Subject: *
Issuer: *
Expires on: 11 apr 3024
Current date: 27 gen 2025
PEM encoded chain:
Certificate

The expiring data is not the one I have on npm
I tried IP lookup and seems still fine
My domain is hosted on cloudflare, any idea on what could be the issue? Is it some kind of cyber attack?

[Zoey2936]

are your hosts marked as offline in the npm dashboard?

[apocaliss92]

Yea, I have ~20 hosts, ~10 are offline on the dashboard, and for the same I get this message on chrome

[Zoey2936]

if you hover of the red dot what's written in the small pop up?

[apocaliss92]

[Zoey2936]

do you configured something in the advanced config?

[apocaliss92]

Oh yes, all these offline have actually ruleas against Authentik
What could have broken them though, I didn't touch anything lately

[Zoey2936]

then please read the last changelog and the new template in the readme

[apocaliss92]

Oh ok! Will do! Thanks for the super quick answer

[Zoey2936]

please always read the changelogs before updating npmplus

[Zoey2936]

Oh ok! Will do! Thanks for the super quick answer

no problem

[apocaliss92]

This time was an autoupdate from unraid :) Sorry again where can I find the new template

[Zoey2936]

readme: https://github.com/ZoeyVid/NPMplus?tab=readme-ov-file#authentik-advanced-config-example

[apocaliss92]

Sorry I looked at the readme if any change about this, but could not find any mention
I could make all the hosts green now but now I'm getting this
Request Header Or Cookie Too Large
I didn't need to increase the buffer before, should I do it now?

[Zoey2936]

where do you get this error?

[apocaliss92]

On the browser

[apocaliss92]

Right after the authentication on Authentik, I get the redirecto to authentik, go for to login and this appears on the redirect. Now that I'm authenticated it appears right away

[Zoey2936]

is there maybe a redirect loop? (see F12 (developer tools of browser) => network => keep history)

[apocaliss92]

No, no redirections appear to be happening

[Zoey2936]

also after deleting the cookies again? how big is the request uri and the request header?

[apocaliss92]

Deleting the cookies get me to authentik correctly but again same issue on login
Headers seems quiet small, but it happens for any host I have authentik on
Sorry now I need to take care of my son, will check maybe with increasing the buffers tomorrow...
Thanks for the support here

[apocaliss92]

It's not possible to downgrade right? I got errors with some migration scripts

[Zoey2936]

only if you have a backup

[apocaliss92]

Anything changed around this ?
https://stackoverflow.com/questions/17524396/400-bad-request-request-header-or-cookie-too-large

[Zoey2936]

no, but you can try to set this directive by just putting it at the top of the advanced config

[Zoey2936]

but there must be a header which is too large, are you sur ethat there is no big header? or many headers?

[apocaliss92]

Don't think so, most of my apps are very simple and just behind authentik, must be something with it
They suggest this on the configuration

proxy_buffers 8 16k;
proxy_buffer_size 32k;
But makes the host offline

[Zoey2936]

you need to change large_client_header_buffers, proxy_buffer is something completely different and handled by npmplus

[apocaliss92]

Ok added
large_client_header_buffers 4 32k;
Still same issue unfortunately..
How can I check the headers coming from authentik into npm?

[Zoey2936]

and you are sure that there is no redirect loop?

[Zoey2936]

I will try to revert a small part of the last release, maybe you can then try again

[apocaliss92]

Sure I will wait a bit more then

[Zoey2936]

will try to release this part today, but I can't guarantee that I have the time and that it will it

[Zoey2936]

so you can try the nwest release with the updated example, but if it does not work, then I have no idea

[JohnFawkes]

looking at dev menu (f12) I see
Access to fetch at 'https://REDACTED/application/o/authorize/?client_id=REDACTEDredirect_uri=https%3A%2F%2FREDACTED%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=profile+openid+email+ak_proxy+entitlements&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L203ZTBwbnR4UnQyUzZaTVpzSG1VTzc0RXBTQXlyMlFLS3lFVHM1WFIiLCJzaWQiOiIzUjNKQ0VPUVBGWDdHM0czTUVQV1pDVVEzWFVQMjRXRzZOV1lPMk41SFBRNlpGQzJUVVJRIiwic3RhdGUiOiI2RDJOOE8ycWlTaFFUYVdsOHRqNm5DZXVaNVFzTG5keDdEcjRyN1FvVnZrIiwicmVkaXJlY3QiOiJodHRwczovL3NlcnZlcm5hdGlvbi54eXovYXNzZXRzL2ltYWdlcy9zdGF0dXMtaWNvbi1zcHJpdGUuc3ZnIn0.H9eFzQdxekewVLo5ZL_kmWWa4EUij8cu3WOUEA-TjFs#select' (redirected from 'https://REDACTED/assets/images/status-icon-sprite.svg#select') from origin 'https://REDACTED' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[JohnFawkes]

this is using the new template from the readme for authentik

[Zoey2936]

looks like a different issue or whats your issue exactly?

[JohnFawkes]

I can get authentik to show but after entering user/pass it wont forward to the app. it stays on the auth page

[Zoey2936]

please open a diffrent discssion for this and port your advaned config and issue there. Thanks!