From 52e85cfc532b58800dcea593798a7bc9831b65d3 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Wed, 1 Jul 2026 14:16:15 +0000
Subject: [PATCH] Fix NPM API: correct /api/nginx/proxy-hosts endpoint; drop
 brittle advanced_config

---
 install-stack.sh | 55 ++++++++++++++++++------------------------------
 1 file changed, 20 insertions(+), 35 deletions(-)

diff --git a/install-stack.sh b/install-stack.sh
index 6284964..7e41577 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -792,9 +792,11 @@ configure_npm_proxy_hosts() {
 
   msg_ok "NPM API authenticated"
 
+  # NPM's proxy-host endpoint is /api/nginx/proxy-hosts (NOT /api/proxy-hosts).
+  # NPM already sets X-Real-IP / X-Forwarded-For by default, so no advanced_config.
   create_proxy_host() {
-    local name=$1 forward_host=$2 forward_port=$3 locations_json=${4:-'[]'}
-    curl -sf -X POST "http://${NPM_LAN_IP}:81/api/proxy-hosts" \
+    local forward_host=$1 forward_port=$2 locations_json=${3:-'[]'}
+    curl -sf -X POST "http://${NPM_LAN_IP}:81/api/nginx/proxy-hosts" \
       -H "Authorization: Bearer ${token}" \
       -H "Content-Type: application/json" \
       -d "{
@@ -802,47 +804,30 @@ configure_npm_proxy_hosts() {
         \"forward_scheme\": \"http\",
         \"forward_host\": \"${forward_host}\",
         \"forward_port\": ${forward_port},
+        \"access_list_id\": 0,
+        \"certificate_id\": 0,
         \"ssl_forced\": false,
-        \"locations\": ${locations_json},
+        \"caching_enabled\": false,
         \"block_exploits\": true,
         \"allow_websocket_upgrade\": true,
         \"http2_support\": false,
-        \"advanced_config\": \"proxy_set_header X-Real-IP \$remote_addr;\nproxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;\"
+        \"hsts_enabled\": false,
+        \"hsts_subdomains\": false,
+        \"advanced_config\": \"\",
+        \"meta\": {\"letsencrypt_agree\": false, \"dns_challenge\": false},
+        \"locations\": ${locations_json}
       }" &>/dev/null && echo "created" || echo "failed"
   }
 
-  # Single proxy host for the domain routing everything through portal,
-  # with custom locations per app path.
-  # NPM "custom locations" feature handles path-based routing.
-  local locations
-  locations=$(cat <<LOCS
-[
-  {
-    "path": "/api/auth/",
-    "forward_scheme": "http",
-    "forward_host": "10.10.10.101",
-    "forward_port": 3001,
-    "advanced_config": "proxy_set_header X-Real-IP \$remote_addr;\nproxy_set_header Host \$host;"
-  },
-  {
-    "path": "/notices/",
-    "forward_scheme": "http",
-    "forward_host": "10.10.10.112",
-    "forward_port": 3080,
-    "advanced_config": "proxy_set_header X-Real-IP \$remote_addr;\nproxy_set_header Host \$host;"
-  },
-  {
-    "path": "/monitor/",
-    "forward_scheme": "http",
-    "forward_host": "10.10.10.105",
-    "forward_port": 3002,
-    "advanced_config": "proxy_set_header X-Real-IP \$remote_addr;\nproxy_set_header Host \$host;"
-  }
-]
-LOCS
-)
+  # Single proxy host for the domain routed to the portal, with custom
+  # locations per app path (NPM's "custom locations" feature).
+  local locations='[
+    {"path":"/api/auth/","forward_scheme":"http","forward_host":"10.10.10.101","forward_port":3001,"advanced_config":""},
+    {"path":"/notices/","forward_scheme":"http","forward_host":"10.10.10.112","forward_port":3080,"advanced_config":""},
+    {"path":"/monitor/","forward_scheme":"http","forward_host":"10.10.10.105","forward_port":3002,"advanced_config":""}
+  ]'
 
-  local result; result=$(create_proxy_host "${DOMAIN}" "10.10.10.102" 3000 "$locations")
+  local result; result=$(create_proxy_host "10.10.10.102" 3000 "$locations")
   if [[ "$result" == "created" ]]; then
     msg_ok "NPM proxy host created for ${DOMAIN}"
     msg_warn "SSL certificate: configure in NPM admin UI after DNS is pointed at ${NPM_LAN_IP}"