App serverinfo provokes ip ban by apps.nextcloud.com

[ernolf]

This morning I thought that apps.nextcloud.com was offline, so I posted it, but I soon found out that it was only inaccessible from my network's IP address. It was accessible from elsewhere.
After each IP change, it only took a few minutes until it was blocked again.

The cause seemed to be a browser tab with serverinfo open.

Nextcloud 27.1.0 RC3

Since there have been no recent changes in the serverinfo code, I submit this issue here with the question:
Could it be that there is a too strict fail2ban rule or something similar on the server?

This is the messages repeating every 5 minutes, "192.168.188.36" was the laptop with the opened serverinfo-tab:

{
  "reqId": "b8CBrwvBRdUCetZK2DNY",
  "level": 2,
  "time": "2023-09-13T23:55:17+02:00",
  "remoteAddr": "192.168.188.36",
  "user": "ich",
  "app": "appstoreFetcher",
  "method": "GET",
  "url": "/apps/serverinfo/update",
  "message": "Could not connect to appstore: cURL error 7: Failed to connect to apps.nextcloud.com port 443 after 11 ms: Connection refused (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://apps.nextcloud.com/api/v1/apps.json",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 OPR/101.0.0.0",
  "version": "27.1.0.5",
  "data": {
    "app": "appstoreFetcher"
  }
}

After I close the serverinfo tab, the problem is over. Then I can with a new IP address access apps.nextcloud.com with curl (via script or directly from the console) or with the website as much as I want without being banned/blocked.

Opening serverinfo again results in an instant ban/block again.

Is this only hapening to me?

---

EDIT:
I was able to replicate this behaviour on all my instances, no matter what version, no matter what browser.

ernolf

[bigcat88]

Thanks, I will take a look tomorrow at this.

[kesselb]

I cannot say if the rate-limiting here is to strict.

The underlying issue is likely in server and the way the apps fetcher works. Even if we have a most recent version of the apps.json file locally we still send a request to the apps store with the etag to make sure our copy is up-to-date.

The upcoming serverinfo apps (28, 27.1.4, 26.0.9) will not request the available app update when not needed and provide a flag to not request it for the monitoring endpoint: https://github.com/nextcloud/serverinfo#api

[bigcat88]

Server repo has merged PR regarding this, we can close this now.