✏️ v3 Project Status Update

[jc21]

Currently version 2 is no longer actively developed. Important bug fixes and community PR's will be added however.

Why? Because version 3 is being developed.

🟠 Changes

• React frontend instead of Backbone/MarionetteJS frontend
• Golang backend instead of NodeJS
• acme.sh instead of certbot
  • and much better DNS validation support from the UI
• Removing the granular user permissions as they don't seem very popular (comment here if you disagree)
• Removing mysql database support, will be Sqlite database only

🟢 New features

• UI Configurable IP ranges for real_ip determination
• LDAP user authentication
• Compiled UI interface files embedded into golang binary, a single executable for the project means you aren't confined to docker
• A number of github issues logged will be addressed or added to v3
• Admin account 2FA

All this means:

• the docker image will be much smaller
• a compiled binary will be much more efficient on low resource ARMs
• the community can help more easily with PR's

FAQ

Why not certbot?

It's heavily dependent on python, so the docker build process and final image is huge and complicated. By comparison acme.sh is a single bash script and supports almost all of the DNS providers out of the box (no pesky certbot plugins!)

Will it look the same?

Yes and no. Still planning to use the Tabler UI but switching to React opens the door for more functionality. Unfortunately, at the time of writing the react support for Tabler is not well maintained or of a standard I require for this project. This adds to dev time.

Disclaimer

This list of features can change at any time. Can I also ask that you don't ask for a due date for version 3. There's a LOT to do and I don't want to stick to any promises. When I know, you'll know :)

I'll update this issue as things change.

[apainter2]

@jc21 would you be willing to look at implementing 2FA options such as Authy/Google Authenticator for signing into the admin interface, or work with Authelia to get this functionality?

Cheers, and again thanks for NPM, its a fantastic project.

[ArtisanByteCrafter]

Removing mysql database support, will be Sqlite database only

Will there be any required migration steps if we use mariadb in the docker stack currently?

[jc21]

@jc21 would you be willing to look at implementing 2FA options such as Authy/Google Authenticator for signing into the admin interface, or work with Authelia to get this functionality?

Cheers, and again thanks for NPM, its a fantastic project.

Good idea yep, 2FA is super easy to implement.

Will there be any required migration steps if we use mariadb in the docker stack currently?

You can bet that there won't be a migration option - at least at the time of release. Since certbot and acme.sh work entirely differently, it might be easier to set them up manually. For someone who has way too many hosts though, maybe an api2->api3 script could be enough.

[asage-me]

acme.sh will be great

[trackness]

@jc10 I'm actively writing a Terraform provider for the project in order to enable end-to-end definition and reverse-proxying of a domain / subdomain. Are you able to share any intentions to modify the api routes or parameters? E.g.:

• sign-in
• add / query / delete
  • hosts
  • lists
  • certificates

etc.

Cheers!

[RhvsW]

Love the sound of it, would prefer to keep mysql support in if possible though.

[timdonovanuk]

You can bet that there won't be a migration option

Isn't an often asked for feature a import/export functionality (#168)? Appreciate things like certs can't be exported, but an import/export of the proxy hosts would be welcome (and useful for migrations). Thanks :)

[DoTheEvo]

ETA this year, or next or further?

[jc21]

@trackness Awesome to hear that :) You can expect some changes to to the api re routes, but the idea of JWT token auth will be the same. I'll be adding certificate authorities as a list of options to add/edit/use as well. For the most part I'd expect that any plugin you write would be fairly easy to convert to v3.

@RhvsW A lot of issues on here are in regards to support for mysql/maria for non-amd64 systems. Not to say that mysql/postgres couldn't be added after initial release.

@timdonovanuk Yes it's often requested, and if an export/import existed it would only work for software using the same acme software.

[RhvsW]

@trackness Awesome to hear that :) You can expect some changes to to the api re routes, but the idea of JWT token auth will be the same. I'll be adding certificate authorities as a list of options to add/edit/use as well. For the most part I'd expect that any plugin you write would be fairly easy to convert to v3.

@RhvsW A lot of issues on here are in regards to support for mysql/maria for non-amd64 systems. Not to say that mysql/postgres couldn't be added after initial release.

@timdonovanuk Yes it's often requested, and if an export/import existed it would only work for software using the same acme software.

Maria and MySQL (8+) are arm64 compatible as of late so hopefully supporting it won't be too difficult now.

[psharma04]

Acme.SH is switching to ZeroSSL instead of Let's Encrypt. Since NPM uses acme.sh, will you follow suit? I think for the majority of users it doesn't make a difference, but for those who use CAA policies on their domains, it may be something to take note of.

[RhvsW]

Acme.SH is switching to ZeroSSL instead of Let's Encrypt. Since NPM uses acme.sh, will you follow suit? I think for the majority of users it doesn't make a difference, but for those who use CAA policies on their domains, it may be something to take note of.

They're only changing to ZeroSSL by default, acme.sh can be configured to use lets encrypt if wanted with --set-default-ca --server letsencrypt.

[vedatkamer]

@jc21, maybe you can consider to switch from Nginx to Caddy, which is an ACME client too, if you're moving to Golang backend. With MySQL support, NPM can be deployed as cluster but with only SQLite support, it'd be al ot difficult to implement a cluster installation. I also believe Granular User Permissions is one of the best feature of NPM.

Thank you so much for this great work.

[Vitz1988]

Is there a chance this new version will fix the Bad Gateway issue? I managed to get around this problem on an RPI but now that I'm virtualising everything I ran into the same thing, and none of the solutions posted in the dedicated thread do anything.

I appreciate all your work and this is a great utility. I just wish I'd be able to consolidate everything into a single server and eliminate the need for an external device that only runs this.