Skip to content

fix(frp): make certificate validity configurable (default 5000 days) #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oleksandr-nc merged 2 commits into from
Jun 2, 2026
Merged

fix(frp): make certificate validity configurable (default 5000 days) #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9d1280c
fix(frp): make certificate validity configurable (default 5000 days)
oleksandr-nc Jun 1, 2026
cc44580
docs(frp): note ExApps need reinstall after cert regeneration
oleksandr-nc Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,6 +399,14 @@ The FRP client-server connections, i.e. the connection from the above FRP client
}
```

> **Note:** These FRP certificates are valid for `HP_FRP_CERT_VALIDITY_DAYS` days (default `5000`, ~13 years) and are
> not renewed automatically. The FRP connection uses mutual TLS, so once a certificate expires the tunnel stops
> working. To renew them, stop HaRP, delete its `/certs/frp` folder, and start HaRP again, then re-copy `client.crt`,
> `client.key`, and `ca.crt` to each external Docker Engine and restart its `frpc`.
>
> ExApps deployed through HaRP embed these certificates at install time, so after regenerating them you must
> **remove and re-install each ExApp** for it to pick up the new certificates (a restart is not enough).

Comment on lines +402 to +409

@kyteinsky kyteinsky Jun 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe ExApps' connection would fail too?
that can be also mentioned here to remove and install the ex-apps for them to use the new certs,
or we can mention bash commands to list all the nc_app_* containers, stop them, copy the new certs to the containers/volumes and then restart them.

@oleksandr-nc oleksandr-nc Jun 1, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can suggest to not over complicate this for now

@kyteinsky kyteinsky Jun 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fair enough
let's at least just say that remove and install of the ex-apps is required.

@oleksandr-nc oleksandr-nc Jun 2, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pushed a commit with your proposal!

## Adapting ExApps to use HaRP

> We strongly recommend starting support for `HaRP` in ExApps from the start of Nextcloud `32`, as the old `DSP` way will be deprecated and marked for removal in Nextcloud `35`.
Expand Down
24 changes: 21 additions & 3 deletions start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ set -e
# - CA key and certificate (ca.key, ca.crt)
# - Server key, CSR, and certificate (server.key, server.csr, server.crt)
# - Client key, CSR, and certificate (client.key, client.csr, client.crt)
# The certificates are valid for HP_FRP_CERT_VALIDITY_DAYS days (default 5000) and are not rotated automatically.
# We do not generate /certs/cert.pem file, as for HaProxy it is admin task to mount generated cert if needed.
# ----------------------------------------------------------------------------

Expand Down Expand Up @@ -199,6 +200,23 @@ if [ "${HP_FRP_DISABLE_TLS}" != "true" ]; then
log "INFO: /certs/frp directory created."
log "INFO: Generating self-signed certificates in /certs/frp..."

# Validity (in days) for the self-signed FRP certificates (CA, server and client). Configurable so
# admins who run their own certificate renewal can shorten it. The long default keeps the CA and the
# client certificate - both copied to external Docker engines (see README) - valid for the lifetime
# of a typical deployment, since HaRP does not rotate them automatically.
HP_FRP_CERT_VALIDITY_DAYS="${HP_FRP_CERT_VALIDITY_DAYS:-5000}"
case "$HP_FRP_CERT_VALIDITY_DAYS" in
''|*[!0-9]*)
echo "ERROR: HP_FRP_CERT_VALIDITY_DAYS must be a positive integer number of days, got '$HP_FRP_CERT_VALIDITY_DAYS'."
exit 1
;;
esac
if [ "$HP_FRP_CERT_VALIDITY_DAYS" -lt 1 ]; then
echo "ERROR: HP_FRP_CERT_VALIDITY_DAYS must be a positive integer number of days, got '$HP_FRP_CERT_VALIDITY_DAYS'."
exit 1
fi
log "INFO: FRP certificates will be valid for ${HP_FRP_CERT_VALIDITY_DAYS} days."

# Write OpenSSL configuration for server to /certs/frp/server-openssl.cnf.
cat > /certs/frp/server-openssl.cnf <<EOF
[ req ]
Expand All @@ -217,15 +235,15 @@ EOF

# Generate CA key and certificate.
openssl genrsa -out /certs/frp/ca.key 2048
openssl req -x509 -new -nodes -key /certs/frp/ca.key -subj "/CN=harp.nc" -days 5000 -out /certs/frp/ca.crt
openssl req -x509 -new -nodes -key /certs/frp/ca.key -subj "/CN=harp.nc" -days "$HP_FRP_CERT_VALIDITY_DAYS" -out /certs/frp/ca.crt

# Generate server key and CSR.
openssl genrsa -out /certs/frp/server.key 2048
openssl req -new -sha256 -key /certs/frp/server.key -subj "/CN=harp.nc" \
-reqexts req_ext -config /certs/frp/server-openssl.cnf -out /certs/frp/server.csr

# Sign the server certificate with the CA.
openssl x509 -req -days 365 -sha256 -in /certs/frp/server.csr \
openssl x509 -req -days "$HP_FRP_CERT_VALIDITY_DAYS" -sha256 -in /certs/frp/server.csr \
-CA /certs/frp/ca.crt -CAkey /certs/frp/ca.key -CAcreateserial \
-extfile /certs/frp/server-openssl.cnf -extensions req_ext -out /certs/frp/server.crt

Expand All @@ -252,7 +270,7 @@ EOF
openssl req -new -sha256 -key /certs/frp/client.key -subj "/CN=harp.client.nc" \
-config /certs/frp/client-openssl.cnf -out /certs/frp/client.csr

openssl x509 -req -days 365 -sha256 -in /certs/frp/client.csr \
openssl x509 -req -days "$HP_FRP_CERT_VALIDITY_DAYS" -sha256 -in /certs/frp/client.csr \
-CA /certs/frp/ca.crt -CAkey /certs/frp/ca.key -CAcreateserial \
-extfile /certs/frp/client-openssl.cnf -extensions req_ext -out /certs/frp/client.crt

Expand Down
Loading