send() failed (32: Broken pipe) when performing HTTP POST of a large (>1MB) file

[Matthias-vdE]

I have an instance of Immich behind NPMplus and while uploading pictures and videos directly via IP address works fine, I'm having issues when going via the reverse proxy. I see this in the log:

2024-09-27T11:33:13.859502771Z 2024/09/27 13:33:13 [error] 32855#32855: *10529 send() failed (32: Broken pipe), client: MY_IPADDRESS, server: immich.mydomain.org, request: "POST /api/assets HTTP/1.1", host: "immich.mydomain.org"

2024-09-27T11:33:13.859545312Z 2024/09/27 13:33:13 [error] 32855#32855: *10529 [lua] crowdsec.lua:578: AppSecCheck(): Fallback because of err: broken pipe, client: MY_IPADDRESS, server: immich.mydomain.org, request: "POST /api/assets HTTP/1.1", host: "immich.mydomain.org"

2024-09-27T11:33:13.859553917Z 2024/09/27 13:33:13 [error] 32855#32855: *10529 [lua] crowdsec.lua:651: Allow(): AppSec check: broken pipe, client: MY_IPADDRESS, server: immich.mydomain.org, request: "POST /api/assets HTTP/1.1", host: "immich.mydomain.org"

2024-09-27T11:33:13.859564759Z 2024/09/27 13:33:13 [alert] 32855#32855: *10529 [lua] crowdsec.lua:718: Allow(): [Crowdsec] denied 'MY_IPADDRESS' with 'ban' (by appsec), client: MY_IPADDRESS, server: immich.mydomain.org, request: "POST /api/assets HTTP/1.1", host: "immich.mydomain.org"

The first line gives a send() failed (32: Broken pipe) error, which in turn causes Crowdsec to drop the connection.

A broken pipe issue should generally be fixed by setting a larger client_max_body_size and proxy_timeout parameters which I did. Full config here:

(nothing in Custom locations. TLS only forces HTTPS with a certbot certificate)

(Not sure exactly if this an NPMplus or Immich specific issue, but as mentioned, not going via the reverse proxy doesn't give issues. But come to think of it, I'm also running an instance of Paperless which is more than happy accepting 100MB+ PDF files without issue with a similar config...)

[Zoey2936]

See #873

[Matthias-vdE]

Been searching high and low for an answer but completely seem to have missed that post.

Removing these from the crowdsec.conf fixed it...

APPSEC_URL=http://crowdsec:7422
APPSEC_FAILURE_ACTION=deny

Is there a way to disable Appsec for a single host? Modsecurity is not enabled for this host either because it gave some issues.

[Zoey2936]

sorry, but that is not possible, but you could also change deny to allow, but that would mean that allow non cheked request would be allowed.

[Matthias-vdE]

Ok, thanks. Just for my understanding: Does this completely disable Crowdsec and/or Modsecurity, or only the Appsec component?

[Zoey2936]

Only appsec