✏️ v3 Project Status Update

[jc21]

Currently version 2 is no longer actively developed. Important bug fixes and community PR's will be added however.

Why? Because version 3 is being developed.

🟠 Changes

• React frontend instead of Backbone/MarionetteJS frontend
• Golang backend instead of NodeJS
• acme.sh instead of certbot
  • and much better DNS validation support from the UI
• Removing the granular user permissions as they don't seem very popular (comment here if you disagree)
• Removing mysql database support, will be Sqlite database only

🟢 New features

• UI Configurable IP ranges for real_ip determination
• LDAP user authentication
• Compiled UI interface files embedded into golang binary, a single executable for the project means you aren't confined to docker
• A number of github issues logged will be addressed or added to v3
• Admin account 2FA

All this means:

• the docker image will be much smaller
• a compiled binary will be much more efficient on low resource ARMs
• the community can help more easily with PR's

FAQ

Why not certbot?

It's heavily dependent on python, so the docker build process and final image is huge and complicated. By comparison acme.sh is a single bash script and supports almost all of the DNS providers out of the box (no pesky certbot plugins!)

Will it look the same?

Yes and no. Unfortunately, at the time of writing the react support for Tabler is not well maintained or of a standard I require for this project. This adds to dev time. So instead Chakra UI is used. The look of the application should stay similar, but it will not look identical.

Disclaimer

This list of features can change at any time. Can I also ask that you don't ask for a due date for version 3. There's a LOT to do and I don't want to stick to any promises. When I know, you'll know :)

I'll update this issue as things change.

[apainter2]

@jc21 would you be willing to look at implementing 2FA options such as Authy/Google Authenticator for signing into the admin interface, or work with Authelia to get this functionality?

Cheers, and again thanks for NPM, its a fantastic project.

[meichthys]

I'm also looking for this, but for hosts instead or in addition to the admin interface.

[ArtisanByteCrafter]

Removing mysql database support, will be Sqlite database only

Will there be any required migration steps if we use mariadb in the docker stack currently?

[jc21]

Manual migration - it's essentially an entirely new storage schema at this point.

[jc21]

@jc21 would you be willing to look at implementing 2FA options such as Authy/Google Authenticator for signing into the admin interface, or work with Authelia to get this functionality?

Cheers, and again thanks for NPM, its a fantastic project.

Good idea yep, 2FA is super easy to implement.

Will there be any required migration steps if we use mariadb in the docker stack currently?

You can bet that there won't be a migration option - at least at the time of release. Since certbot and acme.sh work entirely differently, it might be easier to set them up manually. For someone who has way too many hosts though, maybe an api2->api3 script could be enough.

[ytzelf]

Authelia native integration would be absolutely bonkers

[JacobCoffee]

how do I upvote this more than once

[second2falcon]

Is FIDO2/Yubikey support planned?

[cswells-wsc]

Can we get ACLs with the ability to change them from Basic to OAuth or Other forms of auth.

IE make a ACL that works with Microsoft Azure Ident.

[atsage]

acme.sh will be great

[trackness]

@jc10 I'm actively writing a Terraform provider for the project in order to enable end-to-end definition and reverse-proxying of a domain / subdomain. Are you able to share any intentions to modify the api routes or parameters? E.g.:

• sign-in
• add / query / delete
  • hosts
  • lists
  • certificates

etc.

Cheers!

[jc21]

Sign in should be the same, though at this stage I am grouping all host types under one CRUD endpoint instead of having them separated as is with v2.

Certificates will have more features, such as setting a certificate authority, but yeah this api is still a living beast.

[TonyWael]

@trackness having a Terraform provider would absolutely be amazing, any update on this?

[RhvsW]

Love the sound of it, would prefer to keep mysql support in if possible though.

[obsidiangroup]

Love the sound of it, would prefer to keep mysql support in if possible though.

I would love to keep the mysql support, maybe as an config option. Even if a new schema.

[timdonovanuk]

You can bet that there won't be a migration option

Isn't an often asked for feature a import/export functionality (#168)? Appreciate things like certs can't be exported, but an import/export of the proxy hosts would be welcome (and useful for migrations). Thanks :)

[DoTheEvo]

ETA this year, or next or further?

[jc21]

@trackness Awesome to hear that :) You can expect some changes to to the api re routes, but the idea of JWT token auth will be the same. I'll be adding certificate authorities as a list of options to add/edit/use as well. For the most part I'd expect that any plugin you write would be fairly easy to convert to v3.

@RhvsW A lot of issues on here are in regards to support for mysql/maria for non-amd64 systems. Not to say that mysql/postgres couldn't be added after initial release.

@timdonovanuk Yes it's often requested, and if an export/import existed it would only work for software using the same acme software.

[RhvsW]

@trackness Awesome to hear that :) You can expect some changes to to the api re routes, but the idea of JWT token auth will be the same. I'll be adding certificate authorities as a list of options to add/edit/use as well. For the most part I'd expect that any plugin you write would be fairly easy to convert to v3.

@RhvsW A lot of issues on here are in regards to support for mysql/maria for non-amd64 systems. Not to say that mysql/postgres couldn't be added after initial release.

@timdonovanuk Yes it's often requested, and if an export/import existed it would only work for software using the same acme software.

Maria and MySQL (8+) are arm64 compatible as of late so hopefully supporting it won't be too difficult now.

[psharma04]

Acme.SH is switching to ZeroSSL instead of Let's Encrypt. Since NPM uses acme.sh, will you follow suit? I think for the majority of users it doesn't make a difference, but for those who use CAA policies on their domains, it may be something to take note of.

[jc21]

Thanks for the heads up. This looks like it only affects the default CA to use, not that it won't support LE at all. v3 will allow you to choose the CA to use when requesting new certs so you should still have control.

[RhvsW]

Acme.SH is switching to ZeroSSL instead of Let's Encrypt. Since NPM uses acme.sh, will you follow suit? I think for the majority of users it doesn't make a difference, but for those who use CAA policies on their domains, it may be something to take note of.

They're only changing to ZeroSSL by default, acme.sh can be configured to use lets encrypt if wanted with --set-default-ca --server letsencrypt.

[vedatkamer]

@jc21, maybe you can consider to switch from Nginx to Caddy, which is an ACME client too, if you're moving to Golang backend. With MySQL support, NPM can be deployed as cluster but with only SQLite support, it'd be al ot difficult to implement a cluster installation. I also believe Granular User Permissions is one of the best feature of NPM.

Thank you so much for this great work.

[jc21]

Creating a caddy wrapper would probably be a completely new project at this point.

Regarding the user permissions, quick survey: how many users do you have configured and what problems does the permissions solve for you?

[caesartcs]

I personally like it, although what I use it for is specific users being able to access (read or write) to specific subdomains only.

[Vitz1988]

Is there a chance this new version will fix the Bad Gateway issue? I managed to get around this problem on an RPI but now that I'm virtualising everything I ran into the same thing, and none of the solutions posted in the dedicated thread do anything.

I appreciate all your work and this is a great utility. I just wish I'd be able to consolidate everything into a single server and eliminate the need for an external device that only runs this.

[jc21]

The majority of "bad gateway" errors are people misconfiguring their mysql database. So in that regard, yes you won't see that again.

[jeremy-chua]

React might too heavy.
I was thinking dart/flutter

[jc21]

You might be right, but I'm not in a position to learn them and I believe the community can contribute more with react.

[fonix232]

I have to agree with @jc21, Dart/Flutter is a much larger change than going from MarionetteJS+Backbone to React.

@jc21 if you separate the frontend and backend into their own "projects", which produce separate binaries, then the whole argument could be solved - you provide a default implementation in React+Tabler, and if someone thinks they can do better, well, they're free to try. And this would also allow integrations into systems with their own UI framework (e.g. Synology NASes, or, and I know you must be tired of hearing it, OpenWrt with LuCI). The point is, it would allow flexibility.

But on the other hand, it would require the creation of an API connecting the frontend and backend, and securing said API, which adds quite some development time...

[norsemangrey]

Really good work you guys are doing. I love NPM and I'm exited to try out version V3 when it is available.

One thing I would like to see in the new version is the possibility to be able to do sorting and filtering of the various columns in the Hosts lists. With a lot of entries it is sometimes difficult to get a good overview with the default Source sorting.

[TheRealGramdalf]

Grouping would be a nice way to do things - you could group different host entries by different tags, such as server name (for multi-server deployments), service name (for services such as pterodactyl), and otherwise

[ilbarone87]

Is there any new update on the v3 project status please? Last one was more than one year and a half ago and can’t see the v3 branch being actively developed.

[ameinild]

Did you actually read all the way through the announcement, particularly this section: "Can I also ask that you don't ask for a due date for version 3."

[ilbarone87]

Where did you see I was asking for a due date? Just asked for a project status update…

[ameinild]

Now you're just arguing, for the sake of arguing...

[ilbarone87]

Are you sure? I’m not the one who replied without even reading correctly what I was asking for…
A CVE has been found in NPM last week, I feel that should be important to understand where this project is going because if the status is on-hold/abandoned users should know if it’s time to start looking around for a more supported alternative. Not blaming or pushing anyone here, just friendly request of update. Peace.

[HeedfulCrayon]

@ilbarone87 you can see the progress being made on v3, by looking at the commits on the v3 branch

[root9191]

anyone can say when this will be released? and will it come for arm64?

[tobih7]

Pretty sure it will be available for arm64 as v2 also is. But no idea when.

[TheRealGramdalf]

arm support is planned, as it can be distributed not only as a docker image, but also a binary (written in go, iirc). Arm (and embedded device) support is one of the main features v3 is designed for.

[casselluu]

Maybe some easy way to manage all or some of the proxys setting at same time, manage default setting is also a good way for easy usage.

[validide]

Is there a list of items that need to be implemented/fixed in v3, and a guide for how people could contribute to the project?

[DarthDensus]

I see, there big improvements in Version 3, also a possibility to connect users to LDAP. So my discussion on the discussion page is obsolete. I would be happy, if there is also possible tu turn UI into dark :) You guys doing an amazing job, keep going on 👍

[blossombuttsold64]

Yes, agreed, dark one would be neat.

[TheRealGramdalf]

In the meantime at the very least there is https://github.com/themepark-dev/theme.park. Not necessarily as integrated (updates to the UI may break things), but it's functional.

But yes, dark mode would be very nice.

[DarthDensus]

For LDAP you thinking about to implement also secure connection with port 636 ldaps?

[ecook2381]

Yes I wonder the same!

[brolifen]

Since its not on the list and received quite a bit of upvotes every time it was mentioned, did support for load balancing services make the cut for v3?

[rmiddle]

If anything, it is less likely. The removal of mysql makes it hard to keep 2 versions in sync.

[TheRealGramdalf]

From what I gather, NPM strives to be a simple option suitable for small deployments - and by small deployments I mean homelabs, personal NAS, and that sort of thing. Proxies like Traefik or Caddy are helpful when you end up deploying multiple services per month, for example - invest the time to set it up and overcome the initial learning curve, and it just works. NPM, on the other hand, allows you to have something simple that just works, and allows you to be up and running without necessarily learning all the inner workings.

In that regard, it makes sense for load balancing to be left to other projects that are more suited to scalable deployments.

[cgmark101]

100% accurate. I had deployed an NPM for reverse proxy on a single server in my organization for the web app, but then we have replicated the virtual machine from the app and required a load balancer. We switched to using pure Nginx on an Ubuntu server instead. It was so dead simple, but all within the command line, also we've implemented some custom https rewrites and production grade rules.

[TropicLegend]

What about load balancing for backend servers?On 7. Aug 2023, at 19:52, Robert Middleswarth ***@***.***> wrote: If anything, it is less likely. The removal of mysql makes it hard to keep 2 versions in sync. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***>

[apainter2]

I wonder if a docker/kubernetes replication process could help with real-time load balancing of the proxy I don't really know, I'm a rocker noob. So I'm just guessing here. Cheers! A.

…

Sent from my iPhone On 7 Aug 2023, at 21:33, Amani Gill ***@***.***> wrote:  What about load balancing for backend servers?On 7. Aug 2023, at 19:52, Robert Middleswarth ***@***.***> wrote: If anything, it is less likely. The removal of mysql makes it hard to keep 2 versions in sync. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***> — Reply to this email directly, view it on GitHub<#1202 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/APZPXG3JIPJ4HSK6H5ZW4E3XUFGKZANCNFSM5ADCDM7Q>. You are receiving this because you commented.Message ID: ***@***.***>

[inmanturbo]

Is V3 still a WIP, or has V3 been abandoned in favor of V2?

[redimongo]

@jc21 Just wondering if multiple servers would be supported. Because Route 53, allows us to redirect traffic to GEO-DNS and ideally would love the ability to manage all our proxy servers under 1 admin UI.

[omerfarukavci]

Hello, is there any improvement for LDAP connection? I used the latest version today. I tried the following settings and I get the "No relevant user found" error. Is the feature not working or am I configuring it wrong?

• LDAP_ENABLED=true
• LDAP_URI=ldap://YOUR_LDAP_SERVER
• LDAP_BIND_DN=YOUR_LDAP_BIND_DN
• LDAP_BIND_PASSWORD=YOUR_LDAP_BIND_PASSWORD
• LDAP_SEARCH_BASE=YOUR_LDAP_SEARCH_BASE
• LDAP_SEARCH_FILTER=(&(objectClass=user)(sAMAccountName=%s))

[lastsamurai26]

i can't get work version 3:-/

[pheiduck]

Any status of version 3?

[phillf]

#2664... wondering if the ability to tweak maxOptions would be introduced in v3.

[davidindra]

Hi @phillf, that is already added into v2, see PR #3581 and if you wish, use the :github-develop Docker tag 🙂

[wedowhateverwewant]

Duo 2FA / Push implementation would be GOATED

[Notorious-Ali]

any updates on v3, after 3 years

[ianalexis]

V3 Branch last update was 6 months ago...

[ewenlau]

I don't think it's happening any time soon, sadly.