Openappsec agent not connecting to webui

[Clemv95]

Hello

I try the new openappsec feature, but impossible to have the agent connected with their webui
I setup the compose and the environment var
Do you have clues ?

[Zoey2936]

your comnpose.yaml?

[Clemv95]

  npmplus:
    container_name: npmplus
    image: zoeyvid/npmplus
    restart: always
    network_mode: host
    ipc: service:openappsec-agent # required when you want to use the openappsec attachment module
    volumes:
      - "/opt/npm:/data"
#      - "/var/www:/var/www" # optional, if you want to use it as webserver for html/php
#      - "/opt/npm-letsencrypt:/etc/letsencrypt" # Only needed for first time migration from original nginx-proxy-manager to this f>    environment:
      - "TZ=Europe/Paris" # set timezone, required, set it to one of the values from the "TZ identifier" https://en.wikipedia.org/w>      - "[email protected]" # email address which should be used for acme, currently optional, may be required >#      - "ACME_SERVER=https://acme.zerossl.com/v2/DV90" # acme server to use for NEW certificates, default is (currently, may chang>
#      - "ACME_EAB_KID=123456789abcdef" # Key Identifier for External Account Binding for the acme server
#      - "ACME_EAB_HMAC_KEY=123456789abcdef" # HMAC key for External Account Binding for the acme server
#      - "ACME_MUST_STAPLE=false" # enables must-staple, default true, please only disable it if you get this error MOZILLA_PKIX_ER>
#      - "ACME_SERVER_TLS_VERIFY=false" # enables checking if ACME_SERVER has a valid TLS cert, default true
#      - "PUID=1000" # set group id, default 0 (root)
#      - "PGID=1000" # set user id, default 0 (root), requires PUID
#      - "NIBEP=48694" # internal port of the NPMplus API, always bound to 127.0.0.1, default 48693, you need to change it, if you >#      - "GOAIWSP=48684" # internal port of goaccess, always bound to 127.0.0.1, default 48683, you need to change it, if you want >#      - "NPM_PORT=82" # Port the NPM UI should be bound to, default 81, you need to change it, if you want to run multiple npm ins>#      - "GOA_PORT=92" # Port the goaccess should be bound to, default 91, you need to change it, if you want to run multiple npm w>
#      - "IPV4_BINDING=127.0.0.1" # IPv4 address to bind, defaults to all
#      - "NPM_IPV4_BINDING=127.0.0.1" # IPv4 address to bind for the NPM UI, defaults to all
#      - "GOA_IPV4_BINDING=127.0.0.1" # IPv4 address to bind for the goaccess, defaults to all
#      - "IPV6_BINDING=[::1]" # IPv6 address to bind, defaults to all
#      - "NPM_IPV6_BINDING=[::1]" # IPv6 address to bind for the NPM UI, defaults to all
#      - "GOA_IPV6_BINDING=[::1]" # IPv6 address to bind for goaccess, defaults to all
#      - "DISABLE_IPV6=true" # disable IPv6 and IPv6 resolver of nginx, overrides with IPV6_BINDING, default false
#      - "NPM_DISABLE_IPV6=true" # disable IPv6 for the NPM UI, overrides NPM_IPV6_BINDING, default false
#      - "GOA_DISABLE_IPV6=true" # disable IPv6 for goaccess, overrides GOA_IPV6_BINDING, default false
#      - "NPM_LISTEN_LOCALHOST=true" # Binds the NPM UI only to localhost, overrides NPM_IPV4_BINDING/NPM_IPV6_BINDING, default fal>
#      - "GOA_LISTEN_LOCALHOST=true" # Binds goaccess only to localhost, overrides NPM_IPV4_BINDING/NPM_IPV6_BINDING, default false
#      - "DEFAULT_CERT_ID=1" # ID of cert, which should be used instead of dummycerts, default 0/unset/dummycerts
#      - "DISABLE_HTTP=true" # disables nginx to listen on port 80, default false
#      - "DISABLE_H3_QUIC=true" # disables nginx to listen on port 443 udp for default and your hosts, this will disable HTTP/3 and>
#      - "NGINX_LOG_NOT_FOUND=true" # Allow logging of 404 errors, default false
#      - "NGINX_404_REDIRECT=true" # Redirect to / instead of showing a 404 error page, default false
#      - "NGINX_DISABLE_PROXY_BUFFERING=true" # Disables the proxy_buffering/proxy_request_buffering options of nginx, default fals>#      - "DISABLE_NGINX_BEAUTIFIER=true" # disables nginxbeautifier, useful when it fails parsing non-standard configs, default fal>
#      - "CLEAN=false" # Clean folders, default true
#      - "FULLCLEAN=true" # Clean unused config folders, default false
#      - "SKIP_IP_RANGES=true" # Skip feteching/whitelisting ip ranges from aws and cloudflare, default false
      - "LOGROTATE=true" # Enables writing http access logs to /opt/npm/nginx/access.log, stream access logs to /opt/npm/nginx/stre>
      - "LOGROTATIONS=7" # Set how often the access.log should be rotated until it is deleted, default 3
#      - "CRT=36" # Set how many hours should be between certbot trying to renew your certs, default 24
#      - "IPRT=3" # Set how many hours should be between updating ip ranges from aws and cloudflare, default 1, ignored when SKIP_I>      - "GOA=true" # Enables goaccess, requires LOGROTATE, default false --- if you download the GeoLite2-Country.mmdb, GeoLite2-Ci>#      - "GOACLA=--agent-list --real-os --double-decode --anonymize-ip --anonymize-level=2 --keep-last=7 --with-output-resolver --n>
#      - "PHP82=true" # Activate PHP82, default false
#      - "PHP82_APKS=php82-curl php82-openssl" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/pack>
#      - "PHP83=true" # Activate PHP83, default false
#      - "PHP83_APKS=php83-curl php83-openssl" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/pack>#      - "PHP_APKS=php-pecl-apcu php-pecl-redis" # Add php extensions, see available packages here: https://pkgs.alpinelinux.org/pa>#      - "INITIAL_ADMIN_EMAIL=initial-email" # email to use instead of [email protected] on first start of NPMplus for the initial >#      - "INITIAL_ADMIN_PASSWORD=initial-password" # password to use instead of the one in the README.md on first start of NPMplus >      - "NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=true" # loads the openappsec attachment module, you also need to set ipc for NPMpl>
# This can be used with DISABLE_HTTP=true, to force HTTPS redirects for every host
#  npmplus-caddy:
#    container_name: npmplus-caddy
#    image: zoeyvid/npmplus:caddy
#    restart: always
#    network_mode: bridge
#    ports:
#      - "80:80"
#    environment:
#      - "TZ=your-timezone"

  openappsec-agent:
    container_name: openappsec-agent
    image: ghcr.io/openappsec/agent:1.1.20-arm64-beta
    restart: always
    ipc: shareable
    volumes:
      - "/opt/openappsec/conf:/etc/cp/conf"
      - "/opt/openappsec/data:/etc/cp/data"
      - "/opt/openappsec/logs:/var/log/nano_agent"
      - "/opt/openappsec/localconf:/ext/appsec" # if you don't set AGENT_TOKEN, then please put a local_policy.yaml in the /opt/ope>      - "/opt/openappsec/open-appsec-advanced-model.tgz:/advanced-model/open-appsec-advanced-model.tgz" # optional, if you want to >    environment:
      - "TZ=Europe/Paris" # needs to be changed
      - "autoPolicyLoad=true"
      - "registered_server=NPMplus"
      - "AGENT_TOKEN=xxxx" # optional, can be set if you use>
    command: /cp-nano-agent

[Zoey2936]

you are missing this env:

NPMplus/compose.yaml

Line 24 in e855681

# - "NGINX_LOAD_OPENAPPSEC_ATTACHMENT_MODULE=true" # loads the openappsec attachment module, you also need to set ipc for NPMplus in this composse file

[Clemv95]

I have already, the compose is not well formated on github

[Zoey2936]

can you send me your docker logs of npmplus?

[Clemv95]

logs.txt

[Zoey2936]

sorry, no idea, but I think you should disable brotli for your hosts as appsec seems to have no support for it (I think in this case I need to disable brotli for all servers using openappsec)

[Clemv95]

Well thanks, i'm gonna leave this aside for a while

[ByteSkater]

Hi @Clemv95, thanks for checking out open-appsec WAF integration with NPMplus, I just verified with our developers, as of today the open-appsec attachment doesn't include support for "brotli" compression algorithm yet, but we are considering adding this in the future.
Can you please request support for this in the open-appsec GitHub here? https://github.com/openappsec/openappsec/discussions