text:
Add  instruction

Add in struction about how to set up node.js,vue, yarn/npm on your pc.

Try to keep any readable files pushed to github as .txt or preferably .md or markdown files so that they can be easily read within github. Here is a guide to writing markdown on github: https://docs.github.com/en/get-started/writing-on-github and https://www.markdownguide.org/getting-started/. Content wise the guide looks good, feel free to send this in the discord.
If you decide to rewrite this and upload it to github be sure to cite any source you directly grab material from as they are potentially not open sourced. If you find yourself taking large sections of text from elsewhere it may also be better to link the resource instead. lmk if you need any help.

authors: PotatoPalooza icedfool

repo: NeRF-or-Nothing/web-app


text:
issue with hm-config container on RAK and OG (and possibly all other Pi 4 based) hotspots (gpio or libmraa issues - RuntimeError: Failed to add edge detection)

Seeing this on an original helium hotspot, and a couple of RAK units on the open fleet setup:
 gateway-config  upnpc : miniupnpc library test client, version 2.1.
 gateway-config   (c) 2005-2018 Thomas Bernard.
 gateway-config  Go to http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
 gateway-config  for more information.
 gateway-config  List of UPNP devices found on the network :
 gateway-config   desc: http://192.168.1.149:38753/
 gateway-config   st: upnp:rootdevice
 gateway-config
 gateway-config  No valid UPNP Internet Gateway Device found.
 gateway-config  Agent registered
[CHG] Controller E4:5F:01:3D:82:BF Pairable: yes
 gateway-config  [bluetooth]# pairable off
 gateway-config  [bluetooth]# quit
method return time=1647375130.488023 sender=org.freedesktop.DBus -> destination=:1.9398 serial=3 reply_serial=2
 gateway-config     array [
 gateway-config        string "org.freedesktop.DBus"
 gateway-config        string ":1.9398"
 gateway-config        string "com.helium.Miner"
 gateway-config        string ":1.8486"
 gateway-config     ]
 gateway-config  DBus is now accepting connections
 gateway-config  libmraa[12]: libmraa version v2.1.0-17-g10adedc initialised by user 'root' with EUID 0
 gateway-config  libmraa[12]: gpio: platform doesn't support chardev, falling back to sysfs
 gateway-config  libmraa[12]: libmraa initialised for platform 'Raspberry Pi Model B Rev 1' of type 5
 gateway-config  2022-03-15 20:12:11,662 - [DEBUG] - __main__ - (__main__.py).validate_env -- gatewayconfig/__main__.py:(52) - Starting with the following ENV:
 gateway-config          SENTRY_DSN=https://3234e2c67fe04c3e9f8b0c9b118c415a@o571444.ingest.sentry.io/5725518
 gateway-config          BALENA_APP_NAME=HELIUM-RAK
 gateway-config          BALENA_DEVICE_UUID=5c9c8b8b5b3631ee43adc923acfe6aa6
 gateway-config          VARIANT=COMP-RAKHM
 gateway-config          ETH0_MAC_ADDRESS_FILEPATH=/sys/class/net/eth0/address
 gateway-config          WLAN0_MAC_ADDRESS_FILEPATH=/sys/class/net/wlan0/address
 gateway-config          DIAGNOSTICS_JSON_URL=http://localhost/json
 gateway-config          ETHERNET_IS_ONLINE_FILEPATH=/sys/class/net/eth0/carrier
 gateway-config          FIRMWARE_VERSION=2022.03.07.0-2
 gateway-config
 gateway-config  Traceback (most recent call last):
 gateway-config    File "/usr/lib/python3.7/runpy.py", line 193, in _run_module_as_main
 gateway-config      "__main__", mod_spec)
 gateway-config    File "/usr/lib/python3.7/runpy.py", line 85, in _run_code
 gateway-config      exec(code, run_globals)
 gateway-config    File "gatewayconfig/__main__.py", line 77, in <module>
 gateway-config      main()
 gateway-config    File "gatewayconfig/__main__.py", line 30, in main
 gateway-config      start()
 gateway-config    File "gatewayconfig/__main__.py", line 66, in start
 gateway-config      FIRMWARE_VERSION
 gateway-config    File "/opt/gatewayconfig/gatewayconfig_app.py", line 36, in __init__
 gateway-config      self.init_gpio(variant)
 gateway-config    File "/opt/gatewayconfig/gatewayconfig_app.py", line 99, in init_gpio
 gateway-config      self.user_button = Button(self.get_button_gpio(), hold_time=USER_BUTTON_HOLD_SECONDS)
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/devices.py", line 108, in __call__
 gateway-config      self = super(GPIOMeta, cls).__call__(*args, **kwargs)
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/input_devices.py", line 416, in __init__
 gateway-config      bounce_time=bounce_time, pin_factory=pin_factory)
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/mixins.py", line 433, in __init__
 gateway-config      super(HoldMixin, self).__init__(*args, **kwargs)
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/input_devices.py", line 171, in __init__
 gateway-config      self.pin.when_changed = self._pin_changed
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/pins/__init__.py", line 432, in <lambda>
 gateway-config      lambda self, value: self._set_when_changed(value),
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/pins/pi.py", line 319, in _set_when_changed
 gateway-config      self._enable_event_detect()
 gateway-config    File "/opt/venv/lib/python3.7/site-packages/gpiozero/pins/rpigpio.py", line 229, in _enable_event_detect
 gateway-config      bouncetime=self._bounce)
 gateway-config  RuntimeError: Failed to add edge detection
 gateway-config  Sentry is attempting to send 1 pending error messages
 gateway-config  Waiting up to 2 seconds
 gateway-config  Press Ctrl-C to quit

Some references:
Slack - https://nebraltd.slack.com/archives/C024BNQ1Y6T/p1647375127495419
Balena device rak - https://dashboard.balena-cloud.com/devices/5c9c8b8b5b3631ee43adc923acfe6aa6/summary
Balena device rak 2 - https://dashboard.balena-cloud.com/devices/9c21f9001c11a9ffb42baf32e8615b00/summary
Belane device OG - https://dashboard.balena-cloud.com/devices/7597d8ef85262102132c96503c203910/summary

it definitely seems to be specific to rak and helium og units. I can’t seem to reproduce this on a sensecap (tried on 5). which implies an issue with gpio7 or one of the other gpios they use on rak / og

Apparently running with sudo can possibly fix this? https://forums.raspberrypi.com/viewtopic.php?f=32&t=125803
Seems to be a known issue with RPi.GPIO?

Interesting that you've noticed the error doesn't occur when the program is run by the root user. Noted.

We're already running as root, so sudo shouldn't be needed.
Could potentially be something in Balena or Docker.

@vpetersson maybe. But also it seems to be mainly happening on rak and OG units. But not a huge sample size so not sure.
Would be interesting to try the retries thing mentioned

The problem is pretty obvious :) It was fixed for the testnet, but I don't have enough privileges to fix it in production fleet.
Could someone add spi0-1cs parameter into dtoverlays configuration of the fleet and remove all the device overrides? Then it will be fixed.

I've added "spi0-1cs,vc4-kms-v3d" to the following fleets:

HELIUM-RAK
HELIUM-OG

@vpetersson They should be separate params. Could you fix it like "spi0-1cs","vc4-kms-v3d"?

Fixed!

Everything has been defined for the production fleet.

Ah strange. I thought those were already in there. But Balenacloud has been really buggy for me lately. I can't load that configuration page most of the time
Nice find anyway @MuratUrsavas

@MuratUrsavas why do we need "vc4-kms-v3d" ?

Weirdly, I deleted and re-added the fleet configuration for that DT param in the fleet that was in and it is now working. No idea why

That could be another Balena thing. It might not be actually applied on the device somehow.

why do we need "vc4-kms-v3d" ?

For a possible future necessity. We might be using a remote display in one of our projects, and I don't want to debug many unrelated items just due to this. I know it is a veeery low probability. But who knows? :smile:

source: gharchive/issue

authors: MuratUrsavas shawaj vpetersson

repo: NebraLtd/hm-config

license: MIT

license_type: permissive

license_source: github-api


text:
Hunts affecting your pokemon's name

My Groudon's name got changed from Fat Lava Lizard to > Groudon < when Groudon was in the /hunts command, It let me change it back but it would be a nuisance if It repeatedly happened to me or someone else.

This bug is now fixed, thank you for the report :)

authors: HackuJacku YouDoofus

repo: NebulaMC-GG/Support


text:
Specifiy minimum npm/nodejs version in README

The README does not specify which version of node is needed to run Sia-UI, but I seem to recall that it's higher than the latest LTS release (v4.6.0).

I was about to complain that their latest LTS was two major versions behind, but apparently their v6 LTS version gets released tomorrow.
Would still be good to specify a minimum version.

repo: NebulousLabs/Sia-UI

license: mit

license_source: bigquery


text:
factor of 64 sectors

error Could not add folder: storage folder must be a factor of 64 sectors
really annoying.
folder add doesn't accept any size, except exact byte size sectorSize*64
and then folder resize accept any size...

I just pushed a fix for this in #1670. Once it's merged, the size will be rounded down to the nearest multiple of 64 sectors.

authors: S-anasol lukechampine

repo: NebulousLabs/Sia


text:
Build system for creating a static site?

I've been thinking about a feature that would help SEO sort of like Next.js does with its ssg. The thought is to make stupid simple builder that snaps a static version of the site during the build process. This wouldn't be anything too fancy, just something that captures the initial rendered state of the components and spits out straightforward static HTML from that.
The aim here is to keep everything lean, using basic string operations or minimal adjustments to existing destam-dom functions, so it stays true to minimal bloat. This way, we could generate two versions of a page, one dynamic version for users and another stripped-down html static version that’s friendlier for search engines and users with JS disabled.
I think this could really help with landing pages and SEO without increasing the libraries footprint by much. I don't really have the know how on if this is a good idea or if you could already do this with npm scripts or something, so making this a feature could be overkill

This is called server side rendering. There are a couple of things needed to get this working:

Server components. These are components that can be run on the server and these are used to first generate the static content that is served as the initial request.
Hydration. Once the server side rendered content has made it to the client, it is up to the client code now to take that server side generated tree and associate that with client side rendered content.

Most existing solutions today use really complex build system steps to basically at build time create all the machinery required for this. As the library stands currently, destam-dom can be used withoun any sort of build step so really I'd like to be able to keep it that way even for server side rendering.
The current solution I have in my head is to write a version of dom.js that is re-implemented to instead run on the server. This is designed to basically render components on the server side with the same API as the client (plus native support for promises) and once that is generated, an HTML will be generated so that you can serve it. Then some magic on the client side will see the HTML, see identifiers that the server side conveniently added and associate that with the client tree.
This should ideally happen without build steps but that doesn't mean we can have more complex build systems to optimize the base system.


text:
🛑 Becpl Angular UI is down

In 22ea364, Becpl Angular UI ($BECPL_ANGULAR_URL) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Becpl Angular UI is back up in 3952b6f after 13 minutes.

repo: NehalDamania/becpl-uptime


text:
🛑 Becpl Angular UI is down

In d4dba15, Becpl Angular UI ($BECPL_ANGULAR_URL) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Becpl Angular UI is back up in c61fb25 after 11 minutes.


text:
🛑 Becpl Angular UI is down

In c85b7e8, Becpl Angular UI ($BECPL_ANGULAR_URL) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Becpl Angular UI is back up in fc04cb2 after 7 minutes.


text:
🛑 Becpl Angular UI is down

In 1963271, Becpl Angular UI ($BECPL_ANGULAR_URL) was down:

HTTP code: 0
Response time: 0 ms

Resolved: Becpl Angular UI is back up in 75ec6aa after 26 minutes.


text:
Deployable golem application

I think this is what you want. It works for me locally by running the run_dev.R file, from install_github() on my local machine, and I have also deployed to RStudio Connect. I don't use shinyapps.io but I imagine it will work on there too.
I tried not to make too much of a mess with the rest of the files in there, I think everything that should be untouched is untouched, but apologies if I overwrote anything.
Let me know how you get on, happy to have another look at it

Thank you very much, this works as expected! @ChrisBeeley

source: gharchive/pull-request

authors: ChrisBeeley Nelson-Gon

repo: Nelson-Gon/shinymde


text:
Set the height of the header in pixels

Kiosk mode sets the height of the header in 0 changing the --header-height variable. This variable is used to set the height of the #view element in this way:
height: calc(100vh - var(--header-height) - env(safe-area-inset-top))

And 100vh - 0 fails because 0 doesn‘t have units. This is problematic with those themes that set  a background in this specific element.
This pull request changes the value of the variable --header-height in 0px something that will fix this issue.
Closes #43

Hi @NemesisRE,
Please, check this one. It is a small change to fix #43.
Regards

repo: NemesisRE/kiosk-mode


text:
stereo_gui panning

stereo_gui panning (using the arrow keys) is implemented incorrectly (my bad). Should be looked into at some point.

Fixed.

repo: NeoGeographyToolkit/StereoPipeline


text:
block compile fail 2024.3

today i was developing my server mod and found myself creating a geckolib armor, that shouldnt be such a problem since when the minecraft dint run
i  just removed the element, but then i regenerated the code since i could open it anymore and found it couldnt load cus the blocks and a particle dint compile correctly(they worked fine before)(also got a character error but it stoppet it was somethin abt me writing "c~" wich is a character in my language) so i removed geckolib tried the 2 most common problem and it dint work, removed the blocks and elements and it noramlly just says one of my main mods is the problem
pls help fellas.
im running 1.20.1 geckolib latest version, the mcreator staff told me i should reach out to you.
i admire you for what you've done with you plugins as you havent just made the geckolib plugin but many others that have helped me in the past.
please help me for there were people that paid for my mod and i dont know what to tell em
https://www.mediafire.com/file/dxdvozhhmvkqpv0/my_post_traumatic_geckolib_experience.zip/file

https://pastebin.com/8L3aCCfu
build log

This is nothing to do with the plugin, this is gradle caches breaking.


text:
reusing and deploying  models?

Hi, I've trained a few models inside of coach now, love using coach to quickly test out algorithms.
After I've trained these models, is there a way to reuse or deploy these models in a live system?
Lets say I trained a few different algorithms with my env called "SolveMeaningOfLiveEnv" and PPO does best. Now I want to take the model and weights and use that in my production system with the coach system. I read through the docs but didn't see this kind of functionality, did I miss it?  Is it currently possible or are there plans to be able to do this?

Hi @jtoy ,
Coach allows saving the trained model weights every x seconds. These model weights can then be used to deploy your model to a real system using TensorFlow. Alternatively you can use the --evaluate flag, in order to run your model for inference directly from Coach, without further training the model. But I guess that you wouldn't want to run whole Coach framework on the real system, only for running inference with your model. Is using the trained model + weights directly with TensorFlow the thing that you're after?

@galleibo-intel yes, im looking for using the trained model + weights directly with TensorFlow .
The use case is:  I want to generate custom stats, graphs, videos, etc during the inference phase, so I need to use the trained model with custom code. Some method or system to do this with coach could be very useful.

TF Serving can be used to accomplish just that. currently Coach does not support it, yet.

The updated Getting Started Guide shows how to load a checkpoint and run inference, and also how the trained agent can interact with the environment step by step.
One more example can be found in issue 374.
Please reopen if additional support is needed.

authors: galleibo-intel galnov jtoy

repo: NervanaSystems/coach


text:
Can I reproduce the figures in Distiller docs?

Hi,
The figure of filter pruning in Distiller docs are useful for understanding.
I produced figures on my own but refer to your figures design.
Can I use these reproduced figures in my articles?
I will cite the website below.
https://nervanasystems.github.io/distiller/tutorial-struct_pruning.html

Hi @hcygeorge. Sure, you can use the figures citing the webpage you mentioned. If you could send as a link when your articles are done, that would be great.

authors: guyjacob hcygeorge

repo: NervanaSystems/distiller


text:
[Flink][bugfix] Fixed the problem of duplicate primary key data in Arctic table with upsert feature enabled

fixed #592
Why are the changes needed?
When an Arctic table with the write.upsert feature enabled is read, data with the same primary key will exist, which should be fixed
Brief change log

replace the shuffle policy involved in write operations

How was this patch tested?

[ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible

[ ] Add screenshots for manual tests if appropriate

[x] Run test locally before making a pull request

@lklhdu Could you please add some description of the case and solution of this bug.
And I'm very curious why only Flink 1.14/1.15 version is affected.

@lklhdu Could you please add some description of the case and solution of this bug. And I'm very curious why only Flink 1.14/1.15 version is affected.

@lklhdu Could you please add some description of the case and solution of this bug. And I'm very curious why only Flink 1.14/1.15 version is affected.

Actually, I also found the same problem with upsert on Flink 1.12 later. The reason for this problem is that when the write distribution mode is null, no shuffle is performed on the data, whereas for data with the same primary key, a shuffle should be performed by the primary key to keep the data in order.

@lklhdu Could you please add some description of the case and solution of this bug. And I'm very curious why only Flink 1.14/1.15 version is affected.

Actually, I also found the same problem with upsert on Flink 1.12 later. The reason for this problem is that when the write distribution mode is null, no shuffle is performed on the data, whereas for data with the same primary key, a shuffle should be performed by the primary key to keep the data in order.

When I use Flink SQL client to add two data with the same primary key to an Arctic table, in DistributionHashMode.NONE mode, the cdc data read may be out of order, causing the delete data to not work, like the following:
-D 1,eric,2022-07-01T12:32
-D 1,eric,2022-07-01T12:32
+I 1,eric,2022-07-01T12:32
+I 1,eric,2022-07-01T12:32

@lklhdu Could you please add some description of the case and solution of this bug. And I'm very curious why only Flink 1.14/1.15 version is affected.

Actually, I also found the same problem with upsert on Flink 1.12 later. The reason for this problem is that when the write distribution mode is null, no shuffle is performed on the data, whereas for data with the same primary key, a shuffle should be performed by the primary key to keep the data in order.

So the default None distribution mode in FlinkSink.Builder makes the table property write.distribution.hash-mode is not used, and all Flink version is affected. Is my understanding correct？
Can we add some unite test to validate this case?

authors: lklhdu zhoujinsong

repo: NetEase/arctic


text:
SG check empty users

I am trying to edit the iam_group auditor to alert on when a security group contains no users in it. currently I have in iam_group.py
def check_empty_users(self, iamgroup_item):
    """
    alert when an IAM Group has no users in it.
    """
    users = self.iamgroup_item.config.get('users', {})
    if rows not in users:
        self.add_issue(1, 'No users in security group', iamobj_item)

but it does not seem to be working. I may just be missing how the auditor functions work

Hey @huntergregal - The rows variable is not defined.
def check_empty_users(self, iamgroup_item):
    """
    alert when an IAM Group has no users in it.
    """
    users = self.iamgroup_item.config.get('users', {})
    if not users:
        self.add_issue(1, 'No users in security group', iamobj_item)

I changed the if-clause a bit; this should work.
I'd love a PR when you're ready.

I got it. I also added your new if statement. It's much cleaner:
def check_empty_users(self, iamgroup_item):
    """
    alert when an IAM Group has no users in it.
    """
    users = iamgroup_item.config.get('users', {})
    if not users:
      self.add_issue(1, 'No users in security group', iamgroup_item)

Neat! Does it work?

Yup! Also added a check for IAM groups with no group policies assigned. Figured why not, uses the same logic. Final code:
def check_empty_users(self, iamgroup_item):
    """
    alert when an IAM Group has no users in it.
    """
    users = iamgroup_item.config.get('users', {})
    if not users:
        self.add_issue(1, 'No users in IAM group', iamgroup_item)

def check_empty_group_policies(self, iamgroup_item):
   """
   alert when an IAM Group has no Group Policies attached.
   """
   grouppolicies = iamgroup_item.config.get('grouppolicies', {})
   if not grouppolicies:
       self.add_issue(1, 'No group policies attached to IAM group', iamgroup_item)

Thanks for your help!

authors: huntergregal monkeysecurity


text:
Get MonitorTag annotated fields from parent classes

Fixes #403

Thanks for the PR. Looks good to me.

authors: PavlikPolivka dmuino

repo: Netflix/servo


text:
spurious test failure

https://netflixoss.ci.cloudbees.com/job/NetflixOSS/job/spectator/job/spectator-release/lastCompletedBuild/testReport/com.netflix.spectator.tdigest/TDigestPluginTest/writeData/
com.fasterxml.jackson.core.JsonParseException: Unexpected end-of-input: expected close marker for ARRAY (from [Source: [B@73d17d67; line: -1, column: -1])
 at [Source: [B@73d17d67; line: -1, column: 49998]
	at com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1487)
	at com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:518)
	at com.fasterxml.jackson.core.base.ParserMinimalBase._reportInvalidEOF(ParserMinimalBase.java:455)
	at com.fasterxml.jackson.core.base.ParserBase._handleEOF(ParserBase.java:502)
	at com.fasterxml.jackson.dataformat.smile.SmileParser._eofAsNextToken(SmileParser.java:2670)
	at com.fasterxml.jackson.dataformat.smile.SmileParser.nextToken(SmileParser.java:571)
	at com.netflix.spectator.tdigest.Json.decode(Json.java:135)
	at com.netflix.spectator.tdigest.StreamTDigestReader.read(StreamTDigestReader.java:56)
	at com.netflix.spectator.tdigest.TDigestPluginTest.readFromFile(TDigestPluginTest.java:53)
	at com.netflix.spectator.tdigest.TDigestPluginTest.writeData(TDigestPluginTest.java:106)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassExecuter.runTestClass(JUnitTestClassExecuter.java:86)
	at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassExecuter.execute(JUnitTestClassExecuter.java:49)
	at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassProcessor.processTestClass(JUnitTestClassProcessor.java:69)
	at org.gradle.api.internal.tasks.testing.SuiteTestClassProcessor.processTestClass(SuiteTestClassProcessor.java:48)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35)
	at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24)
	at org.gradle.messaging.dispatch.ContextClassLoaderDispatch.dispatch(ContextClassLoaderDispatch.java:32)
	at org.gradle.messaging.dispatch.ProxyDispatchAdapter$DispatchingInvocationHandler.invoke(ProxyDispatchAdapter.java:93)
	at com.sun.proxy.$Proxy2.processTestClass(Unknown Source)
	at org.gradle.api.internal.tasks.testing.worker.TestWorker.processTestClass(TestWorker.java:105)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35)
	at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24)
	at org.gradle.messaging.remote.internal.hub.MessageHub$Handler.run(MessageHub.java:360)
	at org.gradle.internal.concurrent.DefaultExecutorFactory$StoppableExecutorImpl$1.run(DefaultExecutorFactory.java:64)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:745)

Haven't seen this in a while. Will revisit if there is another occurrence.

repo: Netflix/spectator


text:
chore: upgrade minimum node version to 20

also update the E2E test workflows

@maksadbek this contradicts the requirements. We are committed to supporting last 3 LTS versions (e.g., 18, 20, 22). Your changes could be detrimental from both a product and development perspective, as many workflows in Bright still rely on v18.
@orubin @bararchy fyi

@maksadbek this contradicts the requirements. We are committed to supporting last 3 LTS versions (e.g., 18, 20, 22). Your changes could be harmful from both a product and dev perspective, as many workflows in Bright still rely on v18 (and can rely until the end of April)
@orubin @bararchy fyi

We're still going to support v12 which is using node 18. I'm fine with dropping support from v13, which we're planning actively on pushing customers to upgrade to.

Also, please update the documentation. We have already dropped support for Linux 3.9 and are planning to do the same for Node v18 (as we have already done for versions 14, 16, etc.)

https://docs.brightsec.com/docs/2-standalone-installation#system-requirements
https://docs.brightsec.com/docs/npm-yarn-installation

@adirdidi @orubin fyi

Also, please update the documentation. We have already dropped support for Linux 3.9 and are planning to do the same for Node v18 (as we have already done for versions 14, 16, etc.)

https://docs.brightsec.com/docs/2-standalone-installation#system-requirements
https://docs.brightsec.com/docs/npm-yarn-installation

@adirdidi @orubin fyi

This is part of the ask I made to help me with fresh data so I can update the guide :)
I did ask for major OS release numbers instead of Kernel versions which are less clear to customers.

@adirdidi there are ton of Linux flavors, so we cannot specify just one (e.g., Ubuntu v20) and assume that there are same equivalent for Fedora/Debian/etc.
IMHO using the Linux kernel version is a more preferable and common. Even the kernel might not be sufficient CLI depends on the specific version of the C library (such as glibc, musl, etc.) as well.
So, it is better to use specific kernel versions and versions of glibc/musl. Or if you prefer to specify distros, just simply say that we support only the N latest releases of A, B, and C OSes
Currently, we support >= linux kernel 4.18 and  >= glibc 2.28 (and/or musl 1.1.24). This is equivalent to >= RHEL8, Ubuntu 20.04 (or 18.04, need to check), Debian 10, Alpine Linux 3.10.
MacOS and Windows remain as in the screenshot above.

While there are many indeed, the plan is to only specify the major ones (which I'm fine with the 4 you've specified). We can keep the 'raw' requirements if they want to use something else - but I think that enterprises won't go with something which is not one of the 4.

authors: adirdidi derevnjuk maksadbek

repo: NeuraLegion/bright-cli


text:
[WIP] - Deprecate Copy Behavior to support Quantities 16.0

I want to do this in a couple parts. First remove copy. Then ensure tests are passing (currently I've commented out the tests, but my plan is to delete the copy=True tests). Just so people can monitor progress I'll just have this open as a PR.
Fixes #1534
Fixes #1529

Things I found for us to discus:

we can't change the units or dtype during construction since we only get a view of the array. I deleted all tests changing units/dtype

time_shift required a different strategy so I implemented it

deleted all tests checking for copy vs view

I need help with the pickle tests. Reading from pickle just returns a None instead of the appropriate array. Someone who knows pickle better should check this for me. Currently they are commented out.

IO tests failing due to a CI issue right now.... We can check that later.

Try flushing the conda cashes just to see if the dependency issue goes away.

So now we have an issue in nix that I have propagated the fix for quantities here.
I just have pickleio that is broken and I don't know why. @samuelgarcia or @apdavison can either of you walk me through the pickling story a bit more.

@apdavison, if you have the brain power to look over this. We are running into one stumbling block with pickleio not working. Sam and I looked at it and we aren't quite sure why. The nix test failure needs to be fixed with my PR at quantities level.

@zm711 : I fixes the pickleio tsuff it was on the copy=True was still here in the __reduce__ (used by pickle)

Perfect thanks for the pickleio. I'll uncomment the core pickle and then we have the nix fix that needs to happen in quantities.

@apdavison, I convinced Sam to help with the pickle a bit more. So last thing we need for tests to pass is for a release of quantities with https://github.com/python-quantities/python-quantities/pull/242 merged in. Tests have passed there. Then you can do the final review for this!

https://pypi.org/project/quantities/0.16.1/

authors: apdavison h-mayorquin samuelgarcia zm711

repo: NeuralEnsemble/python-neo


text:
Improve embargoing and license specification process

fix #638 and #637
Instead of the direct suggestions in the previous PRs, I have opted to (1) ask a single direct question regarding your Embargo Status, (2) show/hide additional metadata like the NIH Award Number based on the embargo status, and (3) provide a search bar that appends to a list to handle license specification—and updated our tooling with new editors for simple arrays of strings (e.g. keywords).
Let me know if these changes are sufficient to improve the UX, otherwise I can take a stab at the suggestions otherwise proposed in the PRs.
The original suggestions will require some UI  changes that are inconsistent with previous designs (e.g. checkboxes with links, text on the side of the input rather than as a header, etc.), which would just have to be thought out in more detail.

Here are some related screenshots:
Embargo

License

Keywords

Can the question have Yes/No buttons instead of a checkbox? A little more personable since we're asking an actual question

And I think some of the confusion on the license is the fact that you can have both - legally I'm not even sure how that would work; would the more or less strict one take precedence? Despite it being a list in the DANDI schema it might make more sense for now to just limit to just one, which can be selected via a radio or other button selector

Letting @bendichter review this one

@garrettmflynn Though I will note, failing tests on this branch preventing merge once approved

I like this but the red is too red. It implies danger.

Fair. I'll de-emphasize the colors to indicate a neutral choice.

@garrettmflynn Small conflict

@bendichter All requested updates have been made. This should be ready to roll!

@garrettmflynn it looks like you still have some merge conflicts

authors: CodyCBakerPhD bendichter garrettmflynn

repo: NeurodataWithoutBorders/nwb-guide


text:
System.InvalidCastException => object => string

@David-Desmaisons  i think this is a bug. If u have a dropbox with a set of objects, clearing them to empty makes this kind of exception.  i think in this case Neutronium should set null instead of string.Empty.
TafApp.exe Information: 0 : Neutronium - Info: Unable to set C# from javascript object: property: SelectedPerfCheck of TafModel.Helpers.PerfTestCase, javascript value . Exception System.InvalidCastException: Unable to cast object of type 'System.String' to type 'TafModel.Helpers.PerfTestCase'.
   at SetSelectedPerfCheck(Object , Object )
   at Neutronium.Core.Binding.BidirectionalMapper.<>c__DisplayClass43_1.<OnJavaScriptObjectChanges>b__0() was thrown.
The thread 0x4820 has exited with code 0 (0x0).

It seems that you are trying to set from javascript a string to a property of type TafModel.Helpers.PerfTestCase.
This is not supported. Set it to null instead.

how?

im clearing a combo box from UI, i dont have any access to set it to null... or am i missing something?
this combobox is connectect to a property
        <v-combobox
          :disabled="viewModel.SelectedCase == null || viewModel.LoadingData"
          :loading="viewModel.LoadingData"
          v-model="viewModel.SelectedTargetBranch"
          item-text="Name"
          :items="viewModel.TargetBranches"
          label="Branch"
        ></v-combobox>

authors: David-Desmaisons jmecosta

repo: NeutroniumCore/Neutronium


text:
14000571_us - Tributary to Houston Tommy Creek

[ ] fiss site card has a note at the top saying "both us and ds for 14001106". Does this mean 14000571 and 14001106 have the same habitat data? 14001106_us has its own site cards so this doesn't really make sense. Maybe this note was a typo and it should say "both us and ds for 14000571"??

when a survey is done is a location that  is both downstream of one crossing and upstream of another (ie. in between the two crossings) the data applies to the reporting for both (in this case - 14000571_us and 14001106_ds).  For example - the gradient and channel widths, substrate, etc. downstream of 1401106 is the same as those characteristics upstream of 14000571.
Happens lots and there are quite a few examples in past reports.  Of interest there is an example of how this has been done incorrectly in Peace 2023 - which will need to be fixed.

Okay yup that makes sense. Turns out there is no 14001106_ds site so not much of an issue.

authors: NewGraphEnvironment newgraph-lschick


text:
template.mdx

@jejunpark

@ChanghyeonYoon
안녕하세요!
현재, 공식 Docs 에서 template.js 는 아래와 같이 작성중으로 나오고 있는데, 향후에 해당 작성이 마무리 되면 작업 진행 하면 되는걸까요??

@jejunpark 앗 그냥 저 그대로 작성 중 이라고 번역하고 PR올려주시면 될것 같습니다!

authors: ChanghyeonYoon jejunpark


text:
Debit Transactions are not returned in the finance API

Core: v.5.1
Description: Debit transactions are missing in the response of finance/transactions/account API.

Debits are events and not transactions, they do not happen on your sigchain so are not included in your transactions list

repo: Nexusoft/LLL-TAO


text:
Forwarding to a database

Im trying to create a proxy host that forwards to a database. There's an advanced tab where I see I can put something for the forward scheme but it doesn't seem to work for me. Can anyone assist with telling me how I can go about forwarding for services outside of HTTP?

I think what you're looking for is called a stream in nginx. But I don't think the NPM GUI will allow you to do it, I'm not 100% sure though. In my case I had to create a custom file (custom/stream.conf) and created the rule to stream DNS over TLS using a pihole container, mainly because the GUI doesn't let you manage the ssl certificate for the stream.
upstream dns-servers {
         server    pihole:53;
}

server {
    listen 853 ssl;
    ssl_certificate /etc/letsencrypt/live/npm-4/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/npm-4/privkey.pem;
    proxy_pass dns-servers;
}

repo: NginxProxyManager/nginx-proxy-manager


text:
Add GeoIP module

Hi! As I am noob with nginx is it possible to enable the GeoIP module so we can limit access also by location?
https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-by-geoip/
Thank you!

the geoip module is active by default so no worry. its just a bit of path mapping and edit config files :P
the main problem of geoip module is using legacy geoip databases that are deprecated.
from https://dev.maxmind.com/geoip/legacy/downloadable/
to https://dev.maxmind.com/geoip/geoip2/geolite2/ wich is using
maxmind databases
but the geoip module from nginx is using teh legacy databases. so i dont know if its an issue from nginx itselfs or from npm. it sounds nice to block countries etc but i thing nginx need to fix it first before this feature can addet by devs to the container or am i wrong ?
i wrote more to -> #78

Yep I've found the legacy databases are not longer supplied anymore so everyone has to convert to geo2.
Seems it's trivial to add the new module: https://docs.nginx.com/nginx/admin-guide/dynamic-modules/geoip2/
Also the geolite databases need to be baked in to the docker image.

I think it should be better to make this possible over mounting the nginx dir to host system. So everyone can edit this as wanted (use other modules or databases)
And I think the geo2 module should be addet by nginx docker Mainter. Many modules are installed by defoult: https://github.com/nginxinc/docker-nginx/blob/master/stable/alpine/Dockerfile

You can already do that if you want to. In any docker image there is no restriction in what you're mounting and where. Even though I bake in config or files you're always able to override them.

I would really love this feature. :)

This would be awesome because in order to use this
Currently nginx fails with this error when I add the custom log format:

2020/07/09 16:36:21 [emerg] 3022#3022: unknown "geoip2_data_city_name" variable

I need the geoIP information to send to InfluxDB custom format:

log_format custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" $host "$http_user_agent" "$request_time" "$upstream_connect_time" "$geoip2_data_city_name" "$geoip2_data_country_code"';

Looking forward to this!

Still missing and everything I'm waiting for! 👍

That sounds great to me

That sounds great to me

Likewise this will help massively in reducing attempted logons and bruteforcing on my network. Watching closely.

Hi guys,
this would be great! I was trying to get the geoip module or to at least implement a kind of monitoring possibility for the ngxin proxy manager with telegraf and grafana. But my limited docker knowledge is just not enough.
I would appreciate if this feature would be available out of the box :)
Stay healthy!

This would be great!

@jc21 any update? I would be happy to help develop on this if y'all need an extra hand in order to get it included.

+1

Is there any way, to do this without it implemented? If I can set it up manually I may be able to make an PR out of it.

Checking in to see if how this is going. @jc21 is there any update please. It would be great to have this implemented please and thank you!

See #1202

See #1202

Thanks and it's great to see there will be a V3! I wasn't aware.
It's not clear not me whether GeoIP2 will be part of this new version though... The closest statement I could find was "UI Configurable IP ranges for real_ip determination"
Will GeoIP2 be incorporated?
Thanks again!

@mouseron
Take a look at https://github.com/sherpya/geolite2legacy
and
https://www.miyuru.lk/geoiplegacy

the geoip module is active by default so no worry. its just a bit of path mapping and edit config files :P
the main problem of geoip module is using legacy geoip databases that are deprecated.
from https://dev.maxmind.com/geoip/legacy/downloadable/
to https://dev.maxmind.com/geoip/geoip2/geolite2/ wich is using
maxmind databases
but the geoip module from nginx is using teh legacy databases. so i dont know if its an issue from nginx itselfs or from npm. it sounds nice to block countries etc but i thing nginx need to fix it first before this feature can addet by devs to the container or am i wrong ?
i wrote more to -> #78

Hey @wuast94 i was wondering how the geoip module is active by default when the openresty doesnt get compiled with the flag to enable the geoip module? It would be nice if you could explain in detail how you managed it. The anweres you've made arent detailed.

Should anyone want to look at adding the module:

https://github.com/NginxProxyManager/docker-nginx-full/blob/master/docker/Dockerfile
https://github.com/NginxProxyManager/docker-nginx-full/blob/master/scripts/build-openresty

Did this get progressed any?  Or is it waiting for someone to pick it up?

No, I don't think there is any progress, and I don't think there will come an official integration in v2 of npm, unless someone wants to get working on it and creates a PR.

I've actually made my own custom version of it with geoIP in order to use it with loki and grafana.
https://github.com/Pacerino/docker-nginx-full
https://github.com/Pacerino/nginx-proxy-manager
The only think is that i've ported the CI to Drone. There is an error appearing if creating the container about missing deps. I've temporary fixed it by installing libgeoip1_1.6 manually with DPKG
wget http://ftp.de.debian.org/debian/pool/main/g/geoip/libgeoip1_1.6.12-7_amd64.deb
dpkg -i libgeoip1_1.6.12-7_amd64.deb

After a reboot of the container everything works.
This is a quick and dirty implementation of it and not the latest release the main repo. The Frontend is missing the Logo but everything works. I should merge into the latest release and trying to get rid of the missing dep and the logo.

Does anyone care about a geoip2 implementation? It would be a real pity if you have to give up the security of geoip2 for the really great and convenient variant of NPM.

Does anyone care about a geoip2 implementation? It would be a real pity if you have to give up the security of geoip2 for the really great and convenient variant of NPM.

I personally do.
On Sat, Jan 1, 2022, 13:58 firebowl @.***> wrote:

Does anyone care about a geoip2 implementation? It would be a real pity if
you have to give up the security of geoip2 for the really great and
convenient variant of NPM.
—
Reply to this email directly, view it on GitHub
https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601029,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AB6JNIY4BQSLDMNGMXLQ2YTUT5FEFANCNFSM4GOX4ASA
.
You are receiving this because you commented.Message ID:
@.***>

I personally do.
On Sat, Jan 1, 2022, 13:58 firebowl @.***> wrote:

Does anyone care about a geoip2 implementation? It would be a real pity if
you have to give up the security of geoip2 for the really great and
convenient variant of NPM.
—
Reply to this email directly, view it on GitHub
https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601029,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AB6JNIY4BQSLDMNGMXLQ2YTUT5FEFANCNFSM4GOX4ASA
.
You are receiving this because you commented.Message ID:
@.***>

I do as well!
--
Geoff
On Jan. 1, 2022, 2:03 p.m., at 2:03 p.m., Daniel Anner @.***> wrote:

I personally do.
On Sat, Jan 1, 2022, 13:58 firebowl @.***> wrote:

Does anyone care about a geoip2 implementation? It would be a real
pity if
you have to give up the security of geoip2 for the really great and
convenient variant of NPM.
—
Reply to this email directly, view it on GitHub

https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601029,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AB6JNIY4BQSLDMNGMXLQ2YTUT5FEFANCNFSM4GOX4ASA

.
You are receiving this because you commented.Message ID:
@.***>

--
Reply to this email directly or view it on GitHub:
https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601979
You are receiving this because you commented.
Message ID: @.***>

I do as well!
--
Geoff
On Jan. 1, 2022, 2:03 p.m., at 2:03 p.m., Daniel Anner @.***> wrote:

I personally do.
On Sat, Jan 1, 2022, 13:58 firebowl @.***> wrote:

Does anyone care about a geoip2 implementation? It would be a real
pity if
you have to give up the security of geoip2 for the really great and
convenient variant of NPM.
—
Reply to this email directly, view it on GitHub

https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601029,

or unsubscribe

https://github.com/notifications/unsubscribe-auth/AB6JNIY4BQSLDMNGMXLQ2YTUT5FEFANCNFSM4GOX4ASA

.
You are receiving this because you commented.Message ID:
@.***>

--
Reply to this email directly or view it on GitHub:
https://github.com/jc21/nginx-proxy-manager/issues/46#issuecomment-1003601979
You are receiving this because you commented.
Message ID: @.***>

Hi, this would be great for me too !

Hi, would like to have this as well!

I am new to NPM, seeing if it can replace my custom config.
I am glad to see this will be in v3.
I note despite someone saying the geoip modules are loaded in the base docker used for npm an nginx -V reveals this is not the case :-(
For now with v2 is there anyway to get the geoip modules working?
(i use them for my csustom log format)
I copied over ngx_http_geoip_module.so and tried loading it using /data/nginx/custom/root.conf
however  i get the error
nginx: [emerg] "load_module" directive is specified too late in /data/nginx/custom/root.conf:2
I assume this is because this is placed at the of the root conf?
Is there any other workaround?

I've actually made my own custom version of it with geoIP in order to use it with loki and grafana. https://github.com/Pacerino/docker-nginx-full https://github.com/Pacerino/nginx-proxy-manager
The only think is that i've ported the CI to Drone. There is an error appearing if creating the container about missing deps. I've temporary fixed it by installing libgeoip1_1.6 manually with DPKG
wget http://ftp.de.debian.org/debian/pool/main/g/geoip/libgeoip1_1.6.12-7_amd64.deb
dpkg -i libgeoip1_1.6.12-7_amd64.deb

After a reboot of the container everything works.
This is a quick and dirty implementation of it and not the latest release the main repo. The Frontend is missing the Logo but everything works. I should merge into the latest release and trying to get rid of the missing dep and the logo.

Hey, just tried to look at your custom repo's, but they're not public anymore, or deleted.
Do you still have these? I'd love to use these as I'd like to setup:
https://grafana.com/grafana/dashboards/12559
Thanks!

Im back at Friday and can take a Look. Ive probably deleted it.
Von meinem iPhone gesendet
Am 02.03.2022 um 14:52 schrieb Tehlo @.***>:

I've actually made my own custom version of it with geoIP in order to use it with loki and grafana. https://github.com/Pacerino/docker-nginx-full https://github.com/Pacerino/nginx-proxy-manager
The only think is that i've ported the CI to Drone. There is an error appearing if creating the container about missing deps. I've temporary fixed it by installing libgeoip1_1.6 manually with DPKG
wget http://ftp.de.debian.org/debian/pool/main/g/geoip/libgeoip1_1.6.12-7_amd64.deb
dpkg -i libgeoip1_1.6.12-7_amd64.deb
After a reboot of the container everything works.
This is a quick and dirty implementation of it and not the latest release the main repo. The Frontend is missing the Logo but everything works. I should merge into the latest release and trying to get rid of the missing dep and the logo.
Hey, just tried to look at your custom repo's, but they're not public anymore, or deleted.
Do you still have these? I'd love to use these as I'd like to setup:
https://grafana.com/grafana/dashboards/12559
Thanks!
—
Reply to this email directly, view it on GitHubhttps://github.com/NginxProxyManager/nginx-proxy-manager/issues/46#issuecomment-1057016139, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AFJKPD3HOXB3UX2342N4X63U556DTANCNFSM4GOX4ASA.
You are receiving this because you commented.Message ID: @.***>

Any updates on this? I think making it an optional config through env variables or something similar wouldn't sacrifice simplicity for basic use cases.

I'm also interested in this.

This geoip missing is what is stopping me to use this against the actual nginx.
My nginx confs work great what I miss is the actual ease of use of this software. But without geoip to protect my stuff and let only a country to access my websites and whitelist only some ip from the countrys i do not want to acess my stuff there is no way this is viable. Thanks for your consideration

It's possible to install the module  apt install libnginx-mod-http-geoip then create a custom file config nano /data/nginx/custom/http_top.conf Here you can add all your geo config then use created variable

Maybe using this as reference: https://github.com/jlesage/docker-nginx-proxy-manager

I've created a script that uses location data from db-ip.com to create country based access lists in nginx proxy manager.
They publish updated addresses monthly and you can just set up a cron schedule to run the script and update the access list that way.
More details here

I decide to use like you @lavinir but in router direct with firewall and ip sets, I just make download of geoip2 and use pandas to convert in CIDR ip list based on my needs. This solution have the advantage to remove the load from NPM, but will be great to have this. For someone that want to implement:
import pandas as pd

loc = pd.read_csv('data/GeoLite2-Country-Locations-en.csv')
ip4 = pd.read_csv('data/GeoLite2-Country-Blocks-IPv4.csv')

ip4loc = pd.merge(loc, ip4, on='geoname_id')

# countries you want to allow/block
country_list = ["BR","IT","NL","PT","CA"]

ip4loc = ip4loc[ip4loc['country_iso_code'].isin(country_list)]

path = 'data/allowed.zone.txt'
ip4loc.to_csv(path, columns = ["network"], header = False, index = False)

In my case I put this on a docker I make the update on Openwrt

@webysther . Cool.
For me, I have use cases where I need the filter on a per rule basis so I can't block everything at the router level. But if you want to block all traffic from certain locations to your home that's a great solution 👍

Yes my solution dont work per rule or domain.

Hello,
Any news regarding implementation of geo module ?
Thanks for info

Hi,
Unfortunately no, I haven't had the time to get back to this project yet..

If you install it directly on your server just install the dep :  apt install libnginx-mod-http-geoip
If you use docker, create a dockerfile and RUN  apt install libnginx-mod-http-geoip

We should just fork and add it...
On Fri, 15 Sept 2023, 07:53 facciolo, @.***> wrote:

If you install it directly on your server just install the dep : apt
install libnginx-mod-http-geoip
If you use docker, create a dockerfile and RUN apt install
libnginx-mod-http-geoip
—
Reply to this email directly, view it on GitHub
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/46#issuecomment-1720715568,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AABBYNEZ53EUH5PBZGKMUFLX2PUONANCNFSM4GOX4ASA
.
You are receiving this because you commented.Message ID:
@.***>

I don't think is a good ideia, the new version is comming and in some time in future, maybe add to the new version or make this new version flexible to support this kind of feature like mod of lsio

I don't think is a good ideia, the new version is coming and in some time in future, maybe add to the new version or make this new version flexible to support this kind of feature like mod of lsio

What is this mod site ?

I don't think is a good ideia, the new version is coming and in some time in future, maybe add to the new version or make this new version flexible to support this kind of feature like mod of lsio

What is this mod site ?

https://mods.linuxserver.io/?mod=create

Can someone make complete instruction how to add geop2 module in NPM docker?

I'm waiting too

Yeah, same. Considering switching back to baremetal nginx only because of this. :(
❯ Starting nginx ...
nginx: [emerg] unknown directive "geoip_country" in /data/nginx/custom/http_top.conf:1

+1 for the implementation of geoblock in nginx-proxy-manager

The nginx_http_geoip2 module has been added to the base nginx configuration and can now be configured in Nginx Proxy Manager with the latest images. I'm not keen on providing a ton of support for this, but here's how I have my config set up.
The PR above adds support for this geoip2 module: https://github.com/leev/ngx_http_geoip2_module.
I've got the GeoLite2-City database from MaxMind mounted in the container at /data/geoip2db/GeoLite2-City.mmdb.
I've got a conf file mounted in the container at /etc/nginx/modules/enable_ngx_http_geoip2_module.conf to enable the module.
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;

I've got a conf file mounted in the container at /data/nginx/custom/http_top.conf to configure the module, tell it where the GeoLite2 db is located, and configure a log format.
geoip2 /data/geoip2db/GeoLite2-City.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
$geoip2_data_city_name city names en;
}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

Finally, I've got a conf file mounted in the container at /data/nginx/custom/server_proxy.conf to instruct NPM to add a logging configuration to each proxy host.
access_log /data/logs/geoip.log geoip;

Feel free to tweak as it meets your needs, but this should get you up and running. This issue & #3334 should be able to be closed now.
Big thanks to @jc21 for getting the module merged so quickly.

Hi @nbently , thank you for this!
Could you give me an hint where and how i can now configure my whitelisted Countries following your setup?
Thanks man

The PR above adds support for this geoip2 module: https://github.com/leev/ngx_http_geoip2_module.
The nginx_http_geoip2 module has been added to the base nginx configuration and can now be configured in Nginx Proxy Manager with the latest images. I'm not keen on providing a ton of support for this, but here's how I have my config set up.
I've got the GeoLite2-City database from MaxMind mounted in the container at /data/geoip2db/GeoLite2-City.mmdb.
I've got a conf file mounted in the container at /etc/nginx/modules/enable_ngx_http_geoip2_module.conf to enable the module.
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;

I've got a conf file mounted in the container at /data/nginx/custom/http_top.conf to configure the module, tell it where the GeoLite2 db is located, and configure a log format.
geoip2 /data/geoip2db/GeoLite2-City.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
$geoip2_data_city_name city names en;
}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

Finally, I've got a conf file mounted in the container at /data/nginx/custom/server_proxy.conf to instruct NPM to add a logging configuration to each proxy host.
access_log /data/logs/geoip.log geoip;

Feel free to tweak as it meets your needs, but this should get you up and running. This issue & #3334 should be able to be closed now.
Big thanks to @jc21 for getting the module merged so quickly.
Hello,
would be possible to add more detail step by step tutorial and put it to documentation maybe  ?
I was not able to get it working in latest version of NPM :(

Thank in advance!

Have a look at bunkerweb. Has geoblock included and other waf rules.

Have a look at bunkerweb. Has geoblock included and other waf rules.

Thank you very much. Looks pretty neat, I'm wondering if it works with crowdsec. Will look into it.

What is bunkerweb? Maybe you have a link? Unfortunately I can't figure it out how it works and need more detailed instructions for dummies :-|

I somehow managed it. I can try to write a little noob tutorial here at the weekend, as I am one myself ^^

Wow that would be really great and I would be so grateful...... I have been waiting for this function in NPM for a long time and now I have no idea what to do :-(

I definitely wanted to whitelist countries, so I downloaded the country DB from https://dev.maxmind.com/geoip/geolite2-free-geolocation-data and put it in my Nginx folder.
My Folder looks like this:

you have to create 3 files (as described above)
http_top.conf (config)
enable_ngx_http_geoip2_module.conf (enables the geoip module)
server_proxy.conf (for logging)
my http_top.conf looks like this:

in this example Netherlands is accepted. just add your whitelistes countries here
try to access your new log (/data/logs/geoip.log) and look if the country db works when you access your urls (-> look at the last two values of the log line)
if this looks correct then just go to your ngx-gui and set this advanced config to make it work on your desired proxy

hope this helps in a way

@phyte22
Thank you so much!
I will be testing this very soon. I have NPM in Docker. I think my data folder is already set up “perstistent”. I'll have to check that again.
What I understood.

Create 3 confs with the corresponding content.
What content must the other two .conf have?
enable_ngx_http_geoip2_module.conf
server_proxy.conf

Download the GeoLite2 Database:
/data/geiip2db/GeoLite2-Country.mmdb

for 1.
look at the post from https://github.com/NginxProxyManager/nginx-proxy-manager/issues/46#issuecomment-1971318240
There you can see the content

What does it look like in your created files?
Before you
if($allowed_country=no) {
    return 444;
}

you should first have a working log.
The file geoip.log is not created under any circumstances?
Then something fundamental does not seem to be working...

Here the content from the files and once again my current structure:
access/
custom/
  http_top.conf
  server_proxy.conf
custom_ssl/
database.sqlite
geoip2db/
   GeoLite2-Country.mmdb
keys.json
letsencrypt-acme-challenge/
logs/
nginx/

http_top.conf
geoip2 /data/geoip2db/GeoLite2-City.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
}

map $geoip2_data_country_iso_code $allowed_country {
   default: no;
   DE yes; # Germany
}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

server_proxy.conf
access_log /data/logs/geoip.log geoip;
enable_ngx_http_geoip2_module.conf, mounted on /etc/nginx/modules/
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
I also look to the usr/lib/nginx/mdules path if the .so file exists and it is there!
But at the end the geoip.log is not created.

geoip2 /data/geoip2db/GeoLite2-City.mmdb {
you referenced the City DB. But you downloaded, as i did, the Country DB :D

You 're right :-) I changed it and restart the container but same result. The geoip.log still not created :-(
The configuration looks good I think but still not working.....

Hmm..  you can remove $geoip2_data_city_name out of the log.
Additionally this are all my Files Mounts for the NPM Container:
/data/nginx/custom/server_proxy.conf
/data/nginx/custom/http_top.conf
/data/geoip2db/GeoLite2-Country.mmdb
/etc/nginx/modules/enable_ngx_http_geoip2_module.conf
maybe you are missing something here?

I don't know what you mean with remove "$geoip2_data_city_name" out of the log? Can you explain again please?
It looks the same for me as it does for you, I have the same mounts as you.
The version is Version 2.11.2
See from inside the container:
http_top.conf
 _   _       _            ____                      __  __
| \ | | __ _(_)_ __ __  _|  _ \ _ __ _____  ___   _|  \/  | __ _ _ __   __ _  __ _  ___ _ __
|  \| |/ _` | | '_ \\ \/ / |_) | '__/ _ \ \/ / | | | |\/| |/ _` | '_ \ / _` |/ _` |/ _ \ '__|
| |\  | (_| | | | | |>  <|  __/| | | (_) >  <| |_| | |  | | (_| | | | | (_| | (_| |  __/ |
|_| \_|\__, |_|_| |_/_/\_\_|   |_|  \___/_/\_\\__, |_|  |_|\__,_|_| |_|\__,_|\__, |\___|_|
       |___/                                  |___/                          |___/
Version 2.11.2 (12d77e3) 2024-05-22 22:49:17 UTC, OpenResty 1.21.4.3, debian 12 (bookworm), Certbot certbot 2.10.0
Base: debian:bookworm-slim, linux/amd64
Certbot: nginxproxymanager/nginx-full:latest, linux/amd64
Node: nginxproxymanager/nginx-full:certbot, linux/amd64

[root@docker-a256c6b611ca:/app]# cat /data/custom/http_top.conf
geoip2 /data/geoip2db/GeoLite2-Country.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
}

map $geoip2_data_country_iso_code $allowed_country {
   default: no;
   DE yes; # Germany
}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';
[root@docker-a256c6b611ca:/app]#

server_proxy.conf
[root@docker-a256c6b611ca:/app]# cat /data/custom/server_proxy.conf
access_log /data/logs/geoip.log geoip;

GeoLite2-Country.mmdb
[root@docker-a256c6b611ca:/app]# ls /data/geoip2db/
GeoLite2-Country.mmdb

enable_ngx_http_geoip2_module.conf
[root@docker-a256c6b611ca:/app]# cat /etc/nginx/modules/enable_ngx_http_geoip2_module.conf
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;

in my log_format I don't have “$geoip2_data_city_name” because we don't get the variable from the database.
apart from that, it's really weird... i didn't do more, if i remember correctly. Do you have any other NPM logs that might indicate that the geoip module could not be loaded or similar?

I have now adjusted the log format, but it does not change anything.
log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

This is the log when I restart the NPM docker container:
[6/1/2024] [4:22:19 PM] [Global   ] › ℹ  info      PID 166 received SIGTERM
[6/1/2024] [4:22:19 PM] [Global   ] › ℹ  info      Stopping.
❯ Configuring npm user ...
0
usermod: no changes
❯ Configuring npm group ...
❯ Checking paths ...
❯ Setting ownership ...
❯ Dynamic resolvers ...
❯ IPv6 ...
Enabling IPV6 in hosts in: /etc/nginx/conf.d
- /etc/nginx/conf.d/include/force-ssl.conf
- /etc/nginx/conf.d/include/proxy.conf
- /etc/nginx/conf.d/include/letsencrypt-acme-challenge.conf
- /etc/nginx/conf.d/include/block-exploits.conf
- /etc/nginx/conf.d/include/assets.conf
- /etc/nginx/conf.d/include/ssl-ciphers.conf
- /etc/nginx/conf.d/include/ip_ranges.conf
- /etc/nginx/conf.d/include/resolvers.conf
- /etc/nginx/conf.d/production.conf
- /etc/nginx/conf.d/default.conf
Enabling IPV6 in hosts in: /data/nginx
- /data/nginx/proxy_host/3.conf
- /data/nginx/proxy_host/6.conf
- /data/nginx/proxy_host/7.conf
- /data/nginx/proxy_host/18.conf
- /data/nginx/proxy_host/15.conf
- /data/nginx/proxy_host/2.conf
- /data/nginx/proxy_host/4.conf
- /data/nginx/proxy_host/24.conf
- /data/nginx/proxy_host/28.conf
- /data/nginx/proxy_host/29.conf
- /data/nginx/proxy_host/27.conf
- /data/nginx/proxy_host/5.conf
- /data/nginx/stream/1.conf
❯ Docker secrets ...
-------------------------------------
 _   _ ____  __  __
| \ | |  _ \|  \/  |
|  \| | |_) | |\/| |
| |\  |  __/| |  | |
|_| \_|_|   |_|  |_|
-------------------------------------
User:  npm PUID:0 ID:0 GROUP:0
Group: npm PGID:0 ID:0
-------------------------------------
❯ Starting backend ...
❯ Starting nginx ...
[6/1/2024] [4:22:24 PM] [Global   ] › ℹ  info      Using Sqlite: /data/database.sqlite
[6/1/2024] [4:22:25 PM] [Migrate  ] › ℹ  info      Current database version: none
[6/1/2024] [4:22:25 PM] [Setup    ] › ℹ  info      Logrotate Timer initialized
[6/1/2024] [4:22:25 PM] [Global   ] › ⬤  debug     CMD: logrotate /etc/logrotate.d/nginx-proxy-manager
[6/1/2024] [4:22:25 PM] [Setup    ] › ℹ  info      Logrotate completed.
[6/1/2024] [4:22:25 PM] [IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[6/1/2024] [4:22:25 PM] [IP Ranges] › ℹ  info      Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[6/1/2024] [4:22:25 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[6/1/2024] [4:22:25 PM] [IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[6/1/2024] [4:22:26 PM] [SSL      ] › ℹ  info      Let's Encrypt Renewal Timer initialized
[6/1/2024] [4:22:26 PM] [SSL      ] › ℹ  info      Renewing SSL certs expiring within 30 days ...
[6/1/2024] [4:22:26 PM] [IP Ranges] › ℹ  info      IP Ranges Renewal Timer initialized
[6/1/2024] [4:22:26 PM] [Global   ] › ℹ  info      Backend PID 166 listening on port 3000 ...
[6/1/2024] [4:22:26 PM] [SSL      ] › ℹ  info      Completed SSL cert renew process

@maboxx
Hey there. Since you seem to be German, you might want to have a look at this site: https://decatec.de/home-server/nginx-besucher-mittels-geoip2-nach-laendern-blockieren-geoblocking/
This is pretty much the same as @phyte22 described. So maybe that helps you. Would be nice if you report your config if it works correctly.
Also think about not blocking your own LAN by adding something like:
`
geo $lan-ip {
default no;
192.168.1.0/24 yes; # your personal LAN
}
if ($lan-ip = yes) {
set $allowed_country yes;
}
if ($allowed_country = no) {
return 444;
}
`

Thank you for the link but
But I just don't think I understand it completely, I'm so sorry. The link only concerns me from the point "nginx-Konfiguration für GeoIP2" Because the geoip module is already integrated in NPM, isn't it?

@maboxx you might want to check to make sure your log_format configuration only includes variables present in the file you downloaded. I haven't tested this on the Country db, but theoretically it should still work, and it does seem like others have gotten it to work. FWIW the City db includes everything in the Country db but not the other way around. https://dev.maxmind.com/geoip/docs/databases/city-and-country#locations-files
Make sure your bind mounts are correct as well (e.g. the file on the host system is where you say it is).
I would suggest trying with my exact configuration first to see if that works and then tweaking it from there.

@nbently
I do it now exactly like you:
[root@docker-a256c6b611ca:/app]# ls -ltr /data/
total 516
-rw-r--r-- 1 root root   2190 Feb  9 20:30 keys.json
drwxr-xr-x 1 root root     22 Feb 15 10:04 letsencrypt-acme-challenge
drwxr-xr-x 1 root root    136 Feb 15 10:04 nginx
drwxr-xr-x 1 root root      0 Feb 18 22:31 access
drwxr-xr-x 1 root root    120 Feb 24 15:23 custom_ssl
-rw-r--r-- 1 root root 524288 Jun  2 07:19 database.sqlite
drwxr-xr-x 1 root root  12584 Jun  2 07:19 logs
drwxr-x--- 1 root root     60 Jun  8 07:28 custom
drwxr-x--- 1 root root     78 Jun  8 07:33 geoip2db

[root@docker-a256c6b611ca:/app]# ls -ltr /data/custom/
total 8
-rw-r----- 1 root root  39 May 29 07:26 server_proxy.conf
-rw-r----- 1 root root 437 Jun  8 07:23 http_top.conf

[root@docker-a256c6b611ca:/app]# ls -ltr /data/geoip2db/
total 55284
-rw-r----- 1 root root  6511625 May 28 16:28 GeoLite2-Country.mmdb
-rw-r----- 1 root root 50097859 Jun  7 15:49 GeoLite2-City.mmdb

[root@docker-a256c6b611ca:/app]# ls -ltr /data
total 516
-rw-r--r-- 1 root root   2190 Feb  9 20:30 keys.json
drwxr-xr-x 1 root root     22 Feb 15 10:04 letsencrypt-acme-challenge
drwxr-xr-x 1 root root    136 Feb 15 10:04 nginx
drwxr-xr-x 1 root root      0 Feb 18 22:31 access
drwxr-xr-x 1 root root    120 Feb 24 15:23 custom_ssl
-rw-r--r-- 1 root root 524288 Jun  2 07:19 database.sqlite
drwxr-xr-x 1 root root  12584 Jun  2 07:19 logs
drwxr-x--- 1 root root     60 Jun  8 07:28 custom
drwxr-x--- 1 root root     78 Jun  8 07:33 geoip2db

[root@docker-a256c6b611ca:/app]# cat /data/custom/server_proxy.conf
access_log /data/logs/geoip.log geoip;

[root@docker-a256c6b611ca:/app]# cat /data/custom/http_top.conf
geoip2 /data/geoip2db/GeoLite2-City.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
$geoip2_data_city_name city names en;
}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

[root@docker-a256c6b611ca:/app]# ls -ltr /data/geoip2db/
total 55284
-rw-r----- 1 root root 50097859 Jun  7 15:49 GeoLite2-City.mmdb

[root@docker-a256c6b611ca:/app]# cat /etc/nginx/modules/enable_ngx_http_geoip2_module.conf
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;

I have now started Docker. How can I now check whether the module is loaded or working?

@maboxx if you're in the container you should now see a new log in /data/logs called geoip.log. That file will contain all of the new log data with the location data in each line. Make sure you have at least one proxy host set up and configured as well (otherwise there won't be any logs).

@nbently
I am sad, there is no log :-(
[root@docker-a256c6b611ca:/data/logs]# ls -ltr geoip.log
ls: cannot access 'geoip.log': No such file or directory
[root@docker-a256c6b611ca:/data/logs]#

I don't understand it. I do exactly what you do.

@maboxx
I don't have much time at the moment. Will try to make you a noob-friendly HowTo till the weekend.
Basically I installed GeoIP like here: https://dev.maxmind.com/geoip/updating-databases
I changed the DatabaseDirectory in /etc/GeoIP.conf:
DatabaseDirectory /home/_USER_/_NPM_DOCKER_FOLDER_/GeoIP
Also you need to insert your account-details here.
Then created a crontab for updating database.
I created the files
NPM_DOCKER_FOLDER/modules/enable_ngx_http_geoip2_module.conf
NPM_DOCKER_FOLDER/data/nginx/custom/http_top.conf
NPM_DOCKER_FOLDER/data/nginx/custom/server_proxy.conf
My files look like this:
enable_ngx_http_geoip2_module.conf:
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
http_top.conf:
geoip2 /data/geoip2db/GeoLite2-Country.mmdb {
auto_reload 5m;
$geoip2_data_country_iso_code country iso_code;
}

map $geoip2_data_country_iso_code $allowed_country {
    default no;
    10.0.0.0/8 yes;
    192.168.0.0/16 yes;
    DE yes;

}

log_format geoip '$remote_addr - $remote_user [$time_local]'
           '"$request" $status $body_bytes_sent'
           '"$http_referer" $host "$http_user_agent"'
           '"$request_time" "$upstream_connect_time"'
           '"$geoip2_data_country_iso_code" "$allowed_country"';
           #'"$geoip2_data_city_name" "$geoip2_data_country_iso_code"';

server_proxy.conf:
if ($allowed_country = no) {
        return 444;
}
access_log /data/logs/geoip.log geoip;

Then I added the volume mounts to the docker-compose.yml:
version: "3"
services:
  app:
    image: jc21/nginx-proxy-manager:latest
    restart: always
    ports:
      - 80:80
      - 81:81
      - 443:443
    volumes:
      - ./config.json:/app/config/production.json
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
      - ./modules:/etc/nginx/modules
      - ./GeoIP:/data/geoip2db
    depends_on:
      - db
    environment:
    # if you want pretty colors in your docker logs:
    - FORCE_COLOR=1
  db:
    image: mariadb:latest
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: "_PRIVATE_"
      MYSQL_DATABASE: "_PRIVATE_"
      MYSQL_USER: "_PRIVATE_"
      MYSQL_PASSWORD: "_PRIVATE_"
    volumes:
      - ./data/mysql:/var/lib/mysql

Notice that I added the
if ($allowed_country = no) {
        return 444;
}

part inside the server_proxy.conf, since I couldn't get it worked with adding these lines in the webUI. But it worked pretty well. I tested accessing my proxy hosts via VPN from different countries, and only Germany got a response. :)

Thank you very much for your patience and effort, I will check again point by point as soon as I have time.

Thank you very much @cruunnerr @nbently @phyte22 for your patience and effort, I will check again point by point as soon as I have time.

You're very welcome. Please keep in mind, that GeoIP-Blocking is a nice thing to have, but doesn't free your server from getting attacked.
It is good for blocking bots and crawlers and surely prevents your proxy hosts from being inspected from several countries. But attackers often use bot nets and have several bots in different countries. So it kind of protects you from getting attacked from "everywhere".
But I would definitely recommend you to also install crowdsec (or at least fail2ban) on your bare NPM-Server. Since crowdsec detects basically even before the packets reaches your NPM-Docker instance and can effectively protect against many kinds of attacks on vulnerabilities or exploits. Just imagine NPM or your OS has a vulnerability which can be attacked even before packets reach your Hosts or your NPM Docker instance.
For example my crowdsec instance detected around 25 scenarios and blocked the IP's, just for today! For the hole June I have actually 473 blocked scenarios (85 of them from Germany, which even wouldn't have been blocked via GeoIP).
Just think about it ;)

@maboxx can you show us where you have the bind mounts configured?

I probably won't have time to go through the whole thing again until the weekend.
@cruunnerr
Thank you very much for the tips.
My constellation is such that my NPM runs on a virtual machine with hardened archlinux. Docker runs rootless there. NPM is my entrance to the network and then forwards to another virtual machine with my Nextcloud. This VM is also hardened and fail2ban is also running there. I may still have to take care of fail2ban on my NPM VM.
@nbently
I don't quite understand what you mean because my mounts work otherwise I couldn't access them from inside the container? Here is my stack that I deploy via Portainer.
version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy
    restart: always
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
      - '993:993'
      #- '587:587'
    volumes:
      - nginx-proxy-data:/data
      - nginx-proxy-letsencrypt:/etc/letsencrypt
      - nginx-proxy-modules:/etc/nginx/modules

volumes:
  nginx-proxy-data:
    name: nginx-proxy-data
  nginx-proxy-letsencrypt:
    name: nginx-proxy-letsencrpyt
  nginx-proxy-modules:
    name: nginx-proxy-modules

@maboxx that's what I was wondering, I see you're using volumes and not bind mounts. Theoretically that should work no problem but I bet that's where the issue is. Probably something permission related if I had to guess.
What happens if you create the geoip.log file manually (just an empty file)? I'd also check to make sure all the files you created have the same permissions as everything else & that the user running nginx has access to them.

Ok but when I compare the permissions from my files with the permissions of your file which seen above in your thread they are the same. What can be different between using bind mounts or volumes? What is exactly the difference and how can I set bind mounts?
I think another difference to your configuration is that my docker runs "rootless" but this should normally also not a problem....

Have a look at bunkerweb. Has geoblock included and other waf rules.

Great Alternative.

@XDark187  Thanks for the tip. I still have no idea what exactly Bunkerweb is. I have heard of it but despite research I don't understand it exactly. Bunkweb is probably much more than "just" a proxy manager.

@XDark187  Thanks for the tip. I still have no idea what exactly Bunkerweb is. I have heard of it but despite research I don't understand it exactly. Bunkweb is probably much more than "just" a proxy manager.

Bunkerweb is a reverse proxy but with a lot of security features to protect your services by default, one of these security features is geoIP blocking and stopping brute force attacks and stopping bots, all security features are just toggles that you can enable or disable if you don't need them.
NPM requires so much work just to enable geoip blocking.
NPM is easier but less secure and bunkerweb is more secure but requires a bit of time to get it fully setup. IMO it's 100% worth it.
If you don't want to bother with NPM or Bunkerweb the easiest way is to  use geoIP blocking with Cloudflare.

I think this issue is fixed: https://nginxproxymanager.com/advanced-config/#enabling-the-geoip2-module

Many thanks for the tip. Does this need to be configured in addition to the things above or instead?

Many thanks for the tip. Does this need to be configured in addition to the things above or instead?

Add also the database of geoip /data/GeoLite2-Country.mmdb on http_top.conf:
geoip2 /data/GeoLite2-Country.mmdb {
    $geoip2_data_country_iso_code country iso_code;
}

After you can create map on server block:
map $geoip2_data_country_iso_code $allowed_countries {
  default 0;
  BE 1;
  CA 1;
  AR 1;
  FI 1;
  NL 1;
  PT 1;
  US 1;
  DE 1;
}

map $geoip2_data_country_iso_code $allowed_brazil {
  default 0;
  BR 1;
}

map $geoip2_data_country_iso_code $allowed_italy {
  default 0;
  IT 1;
}

Thank you very much @cruunnerr @nbently @phyte22 for your patience and effort, I will check again point by point as soon as I have time.

You're very welcome. Please keep in mind, that GeoIP-Blocking is a nice thing to have, but doesn't free your server from getting attacked. It is good for blocking bots and crawlers and surely prevents your proxy hosts from being inspected from several countries. But attackers often use bot nets and have several bots in different countries. So it kind of protects you from getting attacked from "everywhere". But I would definitely recommend you to also install crowdsec (or at least fail2ban) on your bare NPM-Server. Since crowdsec detects basically even before the packets reaches your NPM-Docker instance and can effectively protect against many kinds of attacks on vulnerabilities or exploits. Just imagine NPM or your OS has a vulnerability which can be attacked even before packets reach your Hosts or your NPM Docker instance. For example my crowdsec instance detected around 25 scenarios and blocked the IP's, just for today! For the hole June I have actually 473 blocked scenarios (85 of them from Germany, which even wouldn't have been blocked via GeoIP).
Just think about it ;)

Good point, just to add some on this. The main point of using geoip is about reduce the attack surface. The big takes about security is more about this:

Keep a SYN-flood (DoS) protection on router
Block on firewall of router or before any reverse proxy the bogons and firehol level 1
If there no host with worldwide need, keep the geoip in firewall and not in reverse proxy
Any exposed host keep exploit protection and SSO like authelia
Never use DMZ, block all and enable by need in firewall

Thank you very much for all the information. I haven't had time yet, but I'm going to try the topic again soon and hopefully I'll get it right and working.

Hi there, i also tried the comment as per @phyte22 here https://github.com/NginxProxyManager/nginx-proxy-manager/issues/46#issuecomment-2130372959 , and setup everything according to the same volume mounts.
The geoip.log file appears, and it shows the correct iso country code and whether or not it is allowed. The only issue i have is when I put the following in the advanced configuration of the proxy_host:
if ($allowed_countries = 0) {
        return 444;
}

My proxy host goes offline. Moreover, the logs from the npm container show the following:
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:52:59 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -s reload
[10/15/2024] [3:53:56 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf.err
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Could not delete file: {
  "errno": -2,
  "code": "ENOENT",
  "syscall": "unlink",
  "path": "/data/nginx/proxy_host/8.conf.err"
}
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -s reload

(the last logs, where 8.conf.err is being deleted is after updating the server block in the Advanced tab of proxy_host)

When I then go to /data/nginx/proxy_host on my local machine, the 8.conf proxy_host file itself is gone. When I revert the changes in the Advanced block, the 8.conf proxy_host file comes back.
The fallback_error.log shows the followign:
2024/10/15 15:56:17 [error] 234#234: *1055 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 127.0.0.1, server: localhost-nginx-proxy-manager, request: "GET /favicon.ico HTTP/1.1", upstream: "http://127.0.0.1:80/favicon.ico", host: "xxx.xxx.xxx.xxx"

The proxy-host-8_error.log shows nothing to point me in the right direction. Anyone know how to resolve this?

Hi there, i also tried the comment as per @phyte22 here #46 (comment) , and setup everything according to the same volume mounts.
The geoip.log file appears, and it shows the correct iso country code and whether or not it is allowed. The only issue i have is when I put the following in the advanced configuration of the proxy_host:
if ($allowed_countries = 0) {
        return 444;
}

My proxy host goes offline. Moreover, the logs from the npm container show the following:
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:52:59 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[10/15/2024] [3:52:59 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -s reload
[10/15/2024] [3:53:56 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Deleting file: /data/nginx/proxy_host/8.conf.err
[10/15/2024] [3:53:57 PM] [Nginx    ] › ⬤  debug     Could not delete file: {
  "errno": -2,
  "code": "ENOENT",
  "syscall": "unlink",
  "path": "/data/nginx/proxy_host/8.conf.err"
}
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"
[10/15/2024] [3:53:57 PM] [Nginx    ] › ℹ  info      Reloading Nginx
[10/15/2024] [3:53:57 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -s reload

(the last logs, where 8.conf.err is being deleted is after updating the server block in the Advanced tab of proxy_host)

When I then go to /data/nginx/proxy_host on my local machine, the 8.conf proxy_host file itself is gone. When I revert the changes in the Advanced block, the 8.conf proxy_host file comes back.
The fallback_error.log shows the followign:
2024/10/15 15:56:17 [error] 234#234: *1055 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 127.0.0.1, server: localhost-nginx-proxy-manager, request: "GET /favicon.ico HTTP/1.1", upstream: "http://127.0.0.1:80/favicon.ico", host: "xxx.xxx.xxx.xxx"

The proxy-host-8_error.log shows nothing to point me in the right direction. Anyone know how to resolve this?

You have created in some how a loop condition that make you network going in a bock state and reset.

load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
load_module /usr/lib/nginx/modules/ngx_stream_geoip2_module.so;

After some trial and error I have been able to make geoip working for proxy hosts. Anyway the fact that docs say that there is also this module
load_module /usr/lib/nginx/modules/ngx_stream_geoip2_module.so
seems to suggest that this approach can also be used for streams (am I wrong?). Anyway I'm struggling because in streams conf files generated by NPM, if something like
if ($allowed_countries = 0) {
        return 444;
}

is added then an error like
nginx: [emerg] "if" directive is not allowed here in /data/nginx/stream/14.conf:11
is returned. If conditionals/if cannot be used there, how the same as proxy hosts can be achieved?
Thanks in advance

Thanks in advance

I did not find a solution within NPM, but I possibly found one that seems to work and that must be applied on the host. I'm not by any mean an expert of NPM and UFW/IPTABLE, so please be kind if the following has something that is wrong. Suggestions and corrections are welcome.
First I installed the geoip module on the host, I used this guide https://www.seenlyst.com/blog/geo-blocking-ufw-iptables/ which I followed with success in other cases not involving NPM.
Then I also installed ufw-docker https://github.com/chaifeng/ufw-docker so to be able to define firewall rules on the host that also apply to the NPM container.
Then:
start UFW on the host, be careful to add a rule beforehand that will not cut you off from SSH, something like
ufw allow 22
ufw enable

Then
ufw-docker allow npm-app-1 443
this allows httpS traffic for the proxy hosts. Then:
sudo iptables -A ufw-user-forward -p tcp -m geoip --src-cc IT --dport 1234 -j ACCEPT
to allow (or deny, if you use "DROP" instead of "ACCEPT") IPs from a whatever country code to reach your stream port.
This rule is not persistent to reboots (and probably also UFW restarts/reloads(, I'm not sure what is the best way to make it persistent but for now I'm happy applying it with a script after the host reboot.
I have also added NPM as a proxy host in itself, so to be able reach it with its domain I had to add this rules too:
ufw-docker allow npm-app-1 81
sudo ufw allow from 172.18.0.0/16 to 65.21.179.35 port 81
sudo ufw allow from 172.18.0.0/16 to 65.21.179.35 port 443

The first one is necessary also to allow reach the NPM GUI with the host IP on port 81.

authors: Br3b GamerClassN7 Nuke142 OuticNZ Pacerino Pl1997 TehloWasTaken ThatCoffeeGuy XDark187 andyshutak benisai bohemtucsok chaptergy coltography corvy cruunnerr danner26 eggplanting firebowl ghallford gioman hellcry37 jc21 jgramling17 joggs lavinir maboxx mgutt mixpc mouseron nbently nfacciolo phrogg phyte22 rh535 risiman sbe-arg scyto spiezmaestro tanmaychimurkar teodorch85 webysther wuast94


text:
Harmony.js

All configs of harmony.js with custom ip list are timeout or unavailable

Harmony only takes information from you and configures with them, it does not have anything of its own. If your configurations are not working, it is because of your own mistake. Now I do not know if you entered the wrong UUID or you made a mistake in one of the 6 sections where you were supposed to replace the hostname, please check again.

repo: NiREvil/Harmony


text:
Dropdown_direction stop working

Hi @NicholasAzar, i think dropdown direction plugin stop working. I tested in your example page and it's not working too.

Hi @BenevidesLecontes, please pardon my delay in responding... I just tried the example page and haven't been able to provoke an issue, is there are particular scenario in which it wasn't working?

@NicholasAzar don't worry for the delay, i can't make the dropdown direction work, tried your version of selectizejs but i not working too. But it was working before.
Off topic: Do you have slack or gitter? I need some help publishing an ng cli app as library on npm could you help me with this one?

I've checked that dropdown_direction plugin not found in selectize.js originally taken from https://github.com/selectize/selectize.js. So I switched to selectize.standalone.js taken from this repository.

authors: BenevidesLecontes NicholasAzar bezigon

repo: NicholasAzar/ng-selectize


text:
Component ble_adv_handler cannot be used together with component esp32_ble_tracker

Component ble_adv_handler cannot be used together with component esp32_ble_tracker.
I'm getting this error trying to follow the steps in https://github.com/NicoIIT/esphome-components/tree/main/components/ble_adv_controller#setup-without-pairing
Any advice? The code is directly copy-pasted from the docs

Hello @jdgiddings, this one is quite easy to solve 😄: you are using the dev branch software but referring to the main branch documentation. Try the dev doc for the setup without pairing, or the dev doc entry point.

Well... that's embarrassing. Thanks @NicoIIT !

authors: NicoIIT jdgiddings

repo: NicoIIT/esphome-components


text:
🛑 cedro is down

In 87d0d22, cedro (https://www.cedro.org) was down:

HTTP code: 0
Response time: 0 ms

Resolved: cedro is back up in b8e952f.

repo: NicolasAbihaggle/serviciosestados


text:
🛑 cedro is down

In fa2dd3d, cedro (https://www.cedro.org) was down:

HTTP code: 0
Response time: 0 ms

Resolved: cedro is back up in 6a0d02a after 13 hours, 8 minutes.


text:
Implement Rating Display Logic Based on Reviews

Description
This PR implements the logic for displaying the overall rating based on user reviews. The average rating is calculated from all submitted reviews and displayed accordingly on the dynamic page.
Type of Change

[x] New feature (non-breaking change which adds functionality)
[x] Logic enhancement (non-breaking change that improves functionality)

Checklist

[x] The rating display logic is tested and calculates ratings accurately
[x] Code is properly documented and follows project standards
[x] The overall rating updates dynamically when new reviews are submitted

Related Issues
N/A
Additional Information
In future updates, more advanced rating filters or visual enhancements (e.g., star icons) can be added to improve the user experience.

:tada: This PR is included in version 1.53.0 :tada:
The release is available on GitHub release
Your semantic-release bot :package::rocket:

repo: NikDoe/livo


text:
NisAI Release 0.3.0

Current releases:

.github - 0.0.3 - https://github.com/NipunSahAIyak/.github/releases/tag/untagged-6cc668527835bd231dbd
ingestor - 0.2.1 - https://github.com/NipunSahAIyak/ingestor/releases/tag/v0.2.1
data-service - 0.2.1 - https://github.com/NipunSahAIyak/data-service/releases/tag/v0.2.1
core-service - v0.2.1
Web executor - v0.2.1
Android executor - v0.2.0
Devops - v0.0.2
https://github.com/NipunSahAIyak/android-gra-assessment-player - ?
https://github.com/NipunSahAIyak/generation-ms - ?
https://github.com/NipunSahAIyak/workflow - ?
https://github.com/NipunSahAIyak/web-bstt-player - ?
https://github.com/NipunSahAIyak/assessment-agent - ?
https://github.com/NipunSahAIyak/android-odk-assessment-player - ?
https://github.com/NipunSahAIyak/android-bstt-assessment-player - ?

New release:
Target date: 20th September
Owner - @dhruv-1001
Web

Architecture revamp - BSTT player, ODK Player, Creation of Protocol, Web Orchestrator creation, Reference app
Test cases - 95% coverage of all modules
CI Integration on Github
Telemetry enhancements in BSTT Player
Bug fixes

INP:

Stencil migration
Offline BSTT player

Android

Telemetry enhancements in android-orchestrator, protocol and bstt.
BSTT player enhancements
Bug fixes

Stencil Repo:

Stencil mobile

BE

User and cycle management CRUD development
assessment-agent

About

Test cases - 80% code coverage (DS + CS)
Telemetry enhancements in Nipun ASR Service (TBN - @dhruv-1001)
Upgraded devops to support minio
Bug fixes in DS

INP:

User and cycle management Client API development
Database audit logs
Server Migration scripts for User and cycle management

Data science

BSTT API enhancements (v4) - Time warping for scope, Postprocessors - purnviram, - & encoding fixes, bhashini initial API call enhancements (when required - time bound & when new model shared), telemetry, logs, configurable model name, etc..

Product Release Notes

BSTT enhancements only

Tech Release Notes
Collaterals

Will be freezing development on master branch for all repositories at the end of first Half on Friday (20th September)

Will pickup it on 19th Sept'24

Decision on BSTT:

Structure to remain the same. Nipun ASR > BSTT API > Bhashini and back.
BSTT Service to have 2 APIs:

/api/asr - Gives asr for an input language
api/asr/verify - Creates ASR for an input language and checks if audio matches a pre-defined text.

Suggested structures below:
/api/asr/
Request:
{
  "input_language": "hi",
  "model": "{optional}",
  "audio_file": "audio.wav"
}

Response:
{
  "language": "hi",
  "model": "{optional}",
  "transcription": "Hello world. My name is slim shady.",
  "telemetry": {}
}

apl/asr/verify
Request:
{
  "language": "hi",
  "model": "{optional}",
  "text_read": "",
  "match_status": {},
  "fuzz_match": "",
  "distance_cutoff": "",
  "audio_file": "audio.wav"
}

Response:
{
  "language": "hi",
  "model": "{optional}",
  "match_status": {},
  "telemetry": {}
}

@karntrehan We can have versions as well as part of BSTT Service 2 API's
For example

/api/asr. --> /api/asr/v1 or /api/asr/v2
/api/asr/verify  --> /api/asr/verify/v2 or /api/asr/verify/v4
cc: @dhruv-1001 @GautamR-Samagra

Release tracker.
Web @amit-s19

[x] web-orchestrator
[ ] web-bstt-player
[ ] workflow

BE @dhruv-1001

[x] data-service
[x] core-service
[x] nisai-asr-service
[x] generation-ms
[x] devops-v2
[x] assessment-agent
[x] ingestor

Android @charanpreet-s

[x] android-nisai-orchestrator
[x] android-odk-assessment-player
[x] android-gra-assessment-player
[x] android-bstt-assessment-player
[x] android-assessment-player-protocol

Release sent out. Documentation update to follow: #24.

authors: VargishChauhan dhruv-1001 karntrehan sukh-ai


text:
manual: How to link to a NixOS option with a star / asterisk?

I want to write a release notes entry linking to an option like
networking.wireguard.interfaces.<name>.peers.*.publicKey

How do I do that?
I kow that <name> becomes _name, e.g. in
<link linkend="opt-networking.interfaces._name_.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link>

but how to do it for .*.?
The current manual at https://nixos.org/manual/nixos/stable/ does not seem to have any existing occurrence.

If you go to https://nixos.org/manual/nixos/stable/options.html, find the relevant option, and click on it, you’ll see the relevant fragment appear in your browser’s URL bar. In this case: https://nixos.org/manual/nixos/stable/options.html#opt-networking.wireguard.interfaces.name.peers._.publicKey

So * translates to _.
Thanks!

repo: NixOS/nixpkgs