php-rewrite

[Zoey2936]

Hello, this is not a new release.
I want to rewrite NPMplus in PHP in the near future, this will unify the backend and frontend, but will remove the API, I will try to make it possible to migrate to the rewrite from the "old" Node.js version (not sure with TLS Certificates). Please write Ideas you want into this discussion. The rewritten version will look different from NPMplus does now, CSS will be done by @DavidCraftDev. No I don't know when I will start working on this and when I will be finished with it / when an alpha/beta version will be published. But you can expect that not all changes listed below will be there with the first release.

What will be added/changed/kept?

• API will be removed
• gravatar will be removed, you can upload profile pictures yourself
• Written in PHP (with some composer deps) and CSS based on Tailwind by @DavidCraftDev
  • will also improve dark mode
• Option to further protect login using MFA and optional hcaptcha support
• I will switch to acme.sh add acme.sh #585 (removal of certbot)
• custom CAs in UI
• export/import option Is there any way we could add a built-in export/import feature to simplify backups/migrations? #628
• Geo-blocking Geolocation Blocking #730
• Client Certificate Authentication  #842
• proxy protocol upstreams for stream add proxy_protocol #619
• easier static/php site support in UI
• everything NPMplus currently supports
• try to move all env options to the UI (https://github.com/ZoeyVid/NPMplus/blob/develop/compose.yaml)
• error/access logs in UI
• Crowdsec BOUNCER config in UI
• coreruleset/crs plugins/modsec in UI
• when cert is deleted, disable tls of all hosts using it
• keep multiuser, but only admin users
• Custom Nginx Configuration #726 (reply in thread) button
• your ideas/more

later:

• Language support Multi language support #693
• something like openid/oauth/ldap or so not sure what the best option is, but I want to support a kind of non-local auth
• readd new API
• readd permission system

Unsure:

• instead of using acme.sh and nginx, use caddy instead? not sure... No...
• change licence? Maybe to MPL 2.0 or later or (L/A)GPL 3.0 or later, or keep MIT... Should be possible because nearly all files not created by me will be removed. Yes, will change the Licence to AGPL 3.0

---

This discussion was created from the release php-rewrite.

[Zoey2936]

(Non PHP based version will still be supported at least until the PHP version will be released)

[tobilektri]

Is there a rough timeline for the PHP-based version?
The question comes from the fact that we are considering migrating from NPM to NPMPlus and are wondering whether we should do this now or rather when the PHP version is released.

[Zoey2936]

The first version will may be released in a month or later, not sure.
I will today next week push dep update on nodejs version and an env option for me to install the latest php commit from the PR I will create. I will start working on the authentication/user system first

[Zoey2936]

I will then work on the config and cert creation and then @DavidCraftDev can work on css

[RedCrafter07]

I'd love to see an API, even though you plan to remove it with the rewrite. A few suggestions:

• Add API Tokens

This will remove the requirement for an additional account in the current NPM as a workaround

• Documentation

I don't have to explain this, do I?

• Access control

Permissions for tokens, basically. No need to have a token which has admin access if you only want to change one domain, for example.

• Optional?

Add an option to enable or disable the API for better security. If a person doesn't need it, there's no reason to expose an API

Thanks for the great work you did so far!

[tokar86a]

Option for caching/configure of caching?

[Zoey2936]

not sure, since caching settings are very diffrent depending on you usecase, can you make some recommendations? since I don't know how to configure caching

[tokar86a]

No i dont have any recommendation as i dont know how to configure it. But the vanilla NPM have some caching support. But i am not sure what it is caching.

[Zoey2936]

I removed this caching function of the vanilla, since it caused vulnerability and caused many other bugs

[tokar86a]

I see but this was only a suggestions from my part. As it is a little bit different about how to configure it together whit NPM advance tab.

[gadget78]

this sound like a move that the original NPM has been doing (NPM v3), and since they announced that,
the demise of NPM v2 started and hence why we are all here ...
whats so bad with this type setup, that it gets abandoned for "newer versions/enviroments ? ..
and also why remove the local API ? is this because its ALL replaced by PHP, so really "needed" ?

[Zoey2936]

Remove the API:

• Since I don't want to use a framework like laravel and instead plain PHP, I could either create just an API and a pure HTML webpage connecting to the API OR write everything in PHP and readd an API later, which is easier to me

Why rewrite:

• because I've never learned nodejs in a way that is required to add new features to this
• updating deps of this project like tabler or webpack would be like a rewrite
• I like PHP
• most things added to this project are just done inside the start.sh via env or are renamed options from vanilla NPM
• see this file as an example: the internal value http2_support enabled brotli.... https://github.com/ZoeyVid/NPMplus/blob/develop/backend/templates/_brotli.conf

[Zoey2936]

if you have more questions just ask

[Joly0]

Hey @Zoey2936 i see you have created a draft pr for this and github-actions did create a docker image for it. Is it already possible to test the php rewrite version as a docker container and what about migrating to it from the current version?

[Zoey2936]

currently you can login and see the php info page. I'm currently working on the migration. The config creation is the easiest part and will be done at the end. So the image runs, but does nothing usefull and throws errors while starting