PatchMon: Breaking Changes

[heinemannj]

✅ Have you read and understood the above guidelines?

yes

🔎 Did you run the script with verbose mode enabled?

Yes, verbose mode was enabled and the output is included below

📜 What is the name of the script you are using?

PatchMon

📂 What was the exact command used to execute the script?

command line in LXC - update

⚙️ What settings are you using?

• Default Settings
• Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 13

📈 Which Proxmox version are you on?

pve-manager/9.1.5/80cf92a64bef6889 (running kernel: 6.17.4-2-pve)

📝 Provide a clear and concise description of the issue.

PatchMon: Update error by update from 1.4.0 -> 1.4.1

🔄 Steps to reproduce the issue.

The following migration(s) have been applied:

migrations/
└─ 20260213000000_v1_4_1_init/
└─ migration.sql
└─ 20260216120000_add_ui_preferences_to_users/
└─ migration.sql

All migrations have been successfully applied.
2026/02/19 13:59:11 [emerg] 1075#1075: unknown directive "000" in /etc/nginx/sites-enabled/patchmon.conf:2
nginx: configuration file /etc/nginx/nginx.conf test failed
✖️ in line 75: exit code 1 (General error / Operation not permitted): while executing command nginx -t

--- Last 20 lines of log ---
[2026-02-19 13:58:39] [INFO] Update Node.js 24
[2026-02-19 13:58:43] [OK] Update Node.js 24
[2026-02-19 13:58:43] [INFO] Checking for update: PatchMon
[2026-02-19 13:58:43] [OK] Update available: PatchMon 1.4.0 → 1.4.1
[2026-02-19 13:58:43] [INFO] Stopping Service
[2026-02-19 13:58:43] [OK] Stopped Service
[2026-02-19 13:58:43] [INFO] Creating Backup
[2026-02-19 13:58:43] [OK] Backup Created
[2026-02-19 13:58:43] [INFO] Fetching GitHub release: PatchMon (1.4.1)
[2026-02-19 13:58:49] [OK] Deployed: PatchMon (1.4.1)
[2026-02-19 13:58:49] [INFO] Updating PatchMon
[2026-02-19 13:59:11] [ERROR] in line 75: exit code 1 (General error / Operation not permitted): while executing command nginx -t

📋 Full log: /tmp/create-lxc-26ec66d0.log
root@patchmon:~#

❌ Paste the full error output (if available).

root@patchmon:~# cat /tmp/create-lxc-26ec66d0.log
[2026-02-19 13:58:39] [INFO] Update Node.js 24
[2026-02-19 13:58:43] [OK] Update Node.js 24
[2026-02-19 13:58:43] [INFO] Checking for update: PatchMon
[2026-02-19 13:58:43] [OK] Update available: PatchMon 1.4.0 → 1.4.1
[2026-02-19 13:58:43] [INFO] Stopping Service
[2026-02-19 13:58:43] [OK] Stopped Service
[2026-02-19 13:58:43] [INFO] Creating Backup
[2026-02-19 13:58:43] [OK] Backup Created
[2026-02-19 13:58:43] [INFO] Fetching GitHub release: PatchMon (1.4.1)
[2026-02-19 13:58:49] [OK] Deployed: PatchMon (1.4.1)
[2026-02-19 13:58:49] [INFO] Updating PatchMon
[2026-02-19 13:59:11] [ERROR] in line 75: exit code 1 (General error / Operation not permitted): while executing command nginx -t
[2026-02-19 13:59:11] Full log: /tmp/create-lxc-26ec66d0.log

🖼️ Additional context (optional).

No response

[heinemannj]

root@patchmon:/etc/nginx/sites-enabled# ls -lisa

total 8
393790 4 drwxr-xr-x 2 root root 4096 Feb 19 13:59 .
393775 4 drwxr-xr-x 8 root root 4096 Feb 16 12:54 ..
394425 0 lrwxrwxrwx 1 root root   40 Feb 19 13:59 patchmon.conf -> /etc/nginx/sites-available/patchmon.conf

root@patchmon:/etc/nginx/sites-enabled# systemctl restart nginx.service 
Job for nginx.service failed because the control process exited with error code.
See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.

root@patchmon:/etc/nginx/sites-enabled# systemctl status nginx.service
× nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Thu 2026-02-19 14:10:12 CET; 18s ago
   Duration: 14min 15.903s
 Invocation: e65ff0d434c64072954b1fc83769b034
       Docs: man:nginx(8)
    Process: 1244 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=1/FAILURE)
   Mem peak: 1.9M
        CPU: 8ms

Feb 19 14:10:12 patchmon systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Feb 19 14:10:12 patchmon nginx[1244]: 2026/02/19 14:10:12 [emerg] 1244#1244: unknown directive "000" in /etc/nginx/sites-enabled/patchmon.conf:2
Feb 19 14:10:12 patchmon nginx[1244]: nginx: configuration file /etc/nginx/nginx.conf test failed
Feb 19 14:10:12 patchmon systemd[1]: nginx.service: Control process exited, code=exited, status=1/FAILURE
Feb 19 14:10:12 patchmon systemd[1]: nginx.service: Failed with result 'exit-code'.
Feb 19 14:10:12 patchmon systemd[1]: Failed to start nginx.service - A high performance web server and a reverse proxy server.
root@patchmon:/etc/nginx/sites-enabled# 

[heinemannj]

root@patchmon:/etc/nginx/sites-enabled# cat /etc/nginx/sites-available/patchmon.conf

server {
    listen 3000;000;
        listen [::]:3000;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

    tcp_nopush on;
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/javascript
        application/xml+rss
        application/json
        application/xml;

    # Security headers
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # Prevent search engine indexing
    add_header X-Robots-Tag "noindex, nofollow, noarchive, nosnippet" always;

    # Bull Board proxy - must come before the root location to avoid conflicts
    location /bullboard {
        proxy_pass http://127.0.0.1:3001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Cookie $http_cookie;  # Forward cookies to backend
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
        
        # Enable cookie passthrough in both directions
        proxy_pass_header Set-Cookie;
        proxy_cookie_path / /;

        # Preserve original client IP through proxy chain
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # CORS headers for Bull Board - let backend handle CORS properly
        # Note: Backend handles CORS with proper origin validation and credentials

        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            return 204;
        }
    }

    # Handle client-side routing
    location / {
        root /opt/patchmon/frontend/dist;
        try_files $uri $uri/ /index.html;
    }

    # API proxy
    location /api/ {
        proxy_pass http://127.0.0.1:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # Allow larger request bodies for logo/branding uploads (base64-encoded)
        # Default nginx limit is 1MB which is too small for image uploads
        client_max_body_size 10m;

        # For the Websocket connection:
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;

        # Preserve original client IP through proxy chain
        proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

        # CORS headers for API calls - let backend handle CORS properly
        # Note: Backend handles CORS with proper origin validation and credentials

        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            return 204;
        }
    }


    # Custom branding assets (logos, favicons) - served from mounted volume
    # This allows logos to persist across container restarts
    location /assets/ {
        alias /opt/patchmon/frontend/dist/assets;
        expires 1h;
        add_header Cache-Control "public, must-revalidate";
        # Allow CORS for assets if needed
        add_header Access-Control-Allow-Origin *;
    }

    # Static assets caching (exclude Bull Board and API assets like Swagger UI)
    location ~* ^/(?!bullboard|api/).*\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        root /opt/patchmon/frontend/dist;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Health check endpoint
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
}

[heinemannj]

Changed to the previous setting as indicated by my backup for yesterday evening:

server {
    listen 3000;
	listen [::]:3000;
    server_name localhost;
    root /usr/share/nginx/html;
    index index.html;

root@patchmon:/etc/nginx/sites-enabled# systemctl start 
Display all 155 possibilities? (y or n)
root@patchmon:/etc/nginx/sites-enabled# systemctl start nginx
root@patchmon:/etc/nginx/sites-enabled# systemctl status nginx
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-02-19 14:19:11 CET; 8s ago
 Invocation: e7ad305c54ec4a0aa3a63c2513d4c615
       Docs: man:nginx(8)
    Process: 1634 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
    Process: 1637 ExecStart=/usr/sbin/nginx -g daemon on; master_process on; (code=exited, status=0/SUCCESS)
   Main PID: 1638 (nginx)
      Tasks: 3 (limit: 73317)
     Memory: 3.1M (peak: 3.6M)
        CPU: 26ms
     CGroup: /system.slice/nginx.service
             ├─1638 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
             ├─1639 "nginx: worker process"
             └─1640 "nginx: worker process"

Feb 19 14:19:11 patchmon systemd[1]: Starting nginx.service - A high performance web server and a reverse proxy server...
Feb 19 14:19:11 patchmon systemd[1]: Started nginx.service - A high performance web server and a reverse proxy server.
root@patchmon:/etc/nginx/sites-enabled#

[vhsdream]

@heinemannj Edit line 2 in your nginx config so it says listen 3000.

Fix is in #12075

[heinemannj]

Even after reboot patchmon GUI is lost

[vhsdream]

Nah, it's still there; it's just hiding.

Post your envs (with any necessary redactions) from /opt/patchmon/backend and /opt/patchmon/frontend

[heinemannj]

root@patchmon:/opt/patchmon/frontend# cat /opt/patchmon/frontend/.env

VITE_API_URL=http ://192.168.178.119 /api/v1
VITE_APP_NAME=PatchMon
VITE_APP_VERSION=1.4.1

root@patchmon:/opt/patchmon/backend# cat /opt/patchmon/backend/.env

# Database Configuration
DATABASE_URL="postgresql://patchmon_usr:cii4dL4f2Alls@localhost:5432/patchmon_db"
PM_DB_CONN_MAX_ATTEMPTS=30
PM_DB_CONN_WAIT_INTERVAL=2

# Database Connection Pool Configuration (Prisma)
DB_CONNECTION_LIMIT=30       # Maximum connections per instance (default: 30)
DB_POOL_TIMEOUT=20          # Seconds to wait for available connection (default: 20)
DB_CONNECT_TIMEOUT=10       # Seconds to wait for initial connection (default: 10)
DB_IDLE_TIMEOUT=300         # Seconds before closing idle connections (default: 300)
DB_MAX_LIFETIME=1800        # Maximum lifetime of a connection in seconds (default: 1800)

# Database Transaction Timeout Configuration
DB_TRANSACTION_MAX_WAIT=10000    # Milliseconds to wait for transaction slot (default: 10000 = 10s)
DB_TRANSACTION_TIMEOUT=30000     # Milliseconds for transaction to complete (default: 30000 = 30s)
DB_TRANSACTION_LONG_TIMEOUT=60000 # Milliseconds for long-running transactions (default: 60000 = 60s)

# JWT Configuration
JWT_SECRET=27cfca142f80029a597785b5f24f247df00aa37d7d3aa98a2cb391f2a234e44cd866807afd4371e07726e2677bb1bdb9049a8f5d7d1ef938b8ffd4e4048c2883
JWT_EXPIRES_IN=1h
JWT_REFRESH_EXPIRES_IN=7d

# Server Configuration
PORT=3001
SERVER_PROTOCOL=http 
    SERVER_HOST=192.168.178.119 
    SERVER_PORT=3000
NODE_ENV=production
TRUST_PROXY=1

# API Configuration
API_VERSION=v1

# CORS Configuration
CORS_ORIGIN=http://192.168.178.119:3000

# Session Configuration
SESSION_INACTIVITY_TIMEOUT_MINUTES=30

# User Configuration
DEFAULT_USER_ROLE=user

# Rate Limiting (times in milliseconds)
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=5000
AUTH_RATE_LIMIT_WINDOW_MS=600000
AUTH_RATE_LIMIT_MAX=500
AGENT_RATE_LIMIT_WINDOW_MS=60000
AGENT_RATE_LIMIT_MAX=1000

# Account Lockout Configuration
MAX_LOGIN_ATTEMPTS=5
LOCKOUT_DURATION_MINUTES=15

# Password Complexity Configuration
PASSWORD_MIN_LENGTH=8
PASSWORD_REQUIRE_UPPERCASE=true
PASSWORD_REQUIRE_LOWERCASE=true
PASSWORD_REQUIRE_NUMBER=true
PASSWORD_REQUIRE_SPECIAL=true

# Redis Configuration
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_DB=0

# Redis Connection Timeouts (milliseconds)
# Increase these if you see "Command timed out" errors, especially with high network latency
# REDIS_CONNECT_TIMEOUT_MS=60000    # Time to wait for initial connection (default: 60s)
# REDIS_COMMAND_TIMEOUT_MS=60000    # Time to wait for Redis commands to complete (default: 60s)

# BullMQ Lock Configuration (milliseconds)
# These settings prevent "Missing lock" or "could not renew lock" errors when Redis is slow.
# lockDuration: How long a job can run before its lock expires (default: 120000 = 120s)
# lockRenewTime: How often to renew the lock to prevent expiration (default: 20000 = 20s)
# Increase lockDuration if you see lock expiration errors with long-running jobs
# Decrease lockRenewTime if lock renewals are timing out (must be < lockDuration and < REDIS_COMMAND_TIMEOUT_MS)
# BULLMQ_LOCK_DURATION_MS=120000
# BULLMQ_LOCK_RENEW_TIME_MS=20000

# Logging
LOG_LEVEL=info
ENABLE_LOGGING=true

# TFA Configuration (optional - used if TFA is enabled)
TFA_REMEMBER_ME_EXPIRES_IN=30d
TFA_MAX_REMEMBER_SESSIONS=5
TFA_SUSPICIOUS_ACTIVITY_THRESHOLD=3

# TFA Rate Limiting (separate from login lockout)
MAX_TFA_ATTEMPTS=5
TFA_LOCKOUT_DURATION_MINUTES=30

# Timezone Configuration
# Set the timezone for timestamps and logs (e.g., 'UTC', 'America/New_York', 'Europe/London')
# Defaults to UTC if not set. This ensures consistent timezone handling across the application.
TZ=UTC

# ===================
# OIDC Configuration
# ===================
# Set to 'true' to enable OIDC authentication
OIDC_ENABLED=false

# OIDC Provider Discovery URL (ends with /.well-known/openid-configuration or the base issuer URL)
# For Authentik: https://auth.example.com/application/o/patchmon/
# For Keycloak: https://keycloak.example.com/realms/myrealm
OIDC_ISSUER_URL=

# Client credentials from your IdP
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# Redirect URI - must match what's configured in your IdP
OIDC_REDIRECT_URI=https://patchmon.example.com/api/v1/auth/oidc/callback

# Scopes to request (space-separated)
# Include 'groups' scope if using group-based role mapping
OIDC_SCOPES=openid email profile groups

# Auto-create users on first OIDC login
OIDC_AUTO_CREATE_USERS=true

# Default role for auto-created users: 'admin' or 'user'
OIDC_DEFAULT_ROLE=user

# Optional: Disable local password authentication entirely
OIDC_DISABLE_LOCAL_AUTH=false

# Optional: Button text for the SSO login button
OIDC_BUTTON_TEXT=Login with SSO

# ===================
# OIDC Group Mapping
# ===================
# Map IdP groups to PatchMon roles
# Users in OIDC_ADMIN_GROUP get 'admin' role
# Users in OIDC_USER_GROUP get 'user' role
# Users in neither get OIDC_DEFAULT_ROLE
OIDC_ADMIN_GROUP=PatchMon Admins
OIDC_USER_GROUP=PatchMon Users

# Sync roles on every login (set to 'true' to update role based on current groups)
# When false, role is only set on first login
OIDC_SYNC_ROLES=true

[vhsdream]

Oh boy so much wrong here. And through no fault of your own. OK so stay with me and do these things:

1. First, stop PatchMon in case it's running: systemctl stop patchmon-server

2. in /opt/patchmon/backend/.env:
   Remove the indentation for SERVER_HOST and SERVER_PORT

PORT=3001
SERVER_PROTOCOL=http 
SERVER_HOST=192.168.178.119 
SERVER_PORT=3000
NODE_ENV=production
TRUST_PROXY=1

3. in /opt/patchmon/frontend/.env:
   Remove the spaces in the value for VITE_API_URL and add the API port - 3001

VITE_API_URL=http://192.168.178.119:3001/api/v1

4. Confirm that your Nginx config (/etc/nginx/sites-available/patchmon.conf) is working (remember that listen on line 2 should say listen 3000;) - run nginx -t and look for success. Restart it for good measure - systemctl restart nginx
5. Go into /opt/patchmon/frontend and delete the dist and node_modules folders - cd /opt/patchmon/frontend && rm -rf ./dist ./node_modules
6. Then re-install dependencies: export NODE_ENV=production && npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev
7. Rebuild the frontend: npm run build
8. If that succeeded, then start Patchmon and tail the journal to ensure it starts up: systemctl start patchmon-server && journalctl -f -u patchmon-server

[heinemannj]

OK - many thanks your your deep dive and your extremely quick support!!!

I've already restored my backup ...

We have now at least two possibilities:

• I will wait for your merge with all of required bug fixes
• Or I will go above painful path and at the end of the day do the reboot and pray ...

Please advice.

[vhsdream]

Well I'm still trying to figure out how your frontend env ended up with those spaces and the port missing. I'm trying to reproduce it but I can't. The only thing I can think of is that it took me some time to make the PR that caused all hell to break loose. Version 1.4.0 was already out, so I suppose you may have updated then, which would not have had my changes. I was working from 1.3.7. Then the changes were merged and from 1.4.0 to 1.4.1 something got messed up.

I think you should (carefully) go through the steps I outlined above instead of waiting for the PR as your install (if the configs indeed do look like you showed before updating) will not be fixable with the script.

[heinemannj]

To be honest:
The update yesterday from 1.3.7 to 1.4.0 has killed me too
=> I have made a fresh LXC build with patchmon 1.4.0 yesterday afternoon ...

OK - I will go your proposed way above
I have also a previous backup for 1.3.7 which I can restore on emergency

[vhsdream]

Well, the PR has been merged. But in your case I think you could vastly increase the chances for success if you implement the things I mentioned in the previous post, but stop after step 4. Then run update and cross your fingers and toes.

[heinemannj]

It end with an error within the GUI:

nano /opt/patchmon/backend/.env

nano /opt/patchmon/frontend/.env

nano /etc/nginx/sites-available/patchmon.conf

nginx -t

systemctl restart nginx && journalctl -f -u nginx

cd /opt/patchmon/frontend && rm -rf ./dist ./node_modules

export NODE_ENV=production && npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev

npm run build

systemctl start patchmon-server && journalctl -f -u patchmon-server

[heinemannj]

OK - I was to quick ...

Same procedure again - restore the working backup for 1.4.0
do the corrections and steps up to step4

update

[heinemannj]

After a reboot and additional 2-3 min and closing the browser window and reopen patchmon again in a new browser window the dashboard was available without authentication ...

[heinemannj]

My final note:

the required correction steps 1-4 are the results of a fresh patchmon LXC installation at yesterday afternoon:

https://community-scripts.github.io/ProxmoxVE/scripts?id=patchmon

[heinemannj]

By cleanup within the new GUI the fucking error is popping up again and again ...

I will open a case at patchmon side ...

[heinemannj]

PatchMon/PatchMon#524

[vhsdream]

Open up Devtools in your web browser and go to the network tab, see what it says there.

Or check the systemd journal logs when this happens: journalctl -f -u patchmon-server

[vhsdream]

You're missing the port for VITE_API_URL, you didn't follow my instructions 🤷🏼‍♂️

[treffNIX9815]

Hello,

I have the same issue. I updated from 1.3.7 to 1.4.0. After the first problems with GLOBAL_IP, I rolled back to 1.3.7; then, after the fix, I updated to 1.4.0 and it worked fine. Today I updated to 1.4.1 and now the web interface shows a network error. I rolled back to 1.3.7 and it works again. After reinstalling 1.4.0 the network error returns. I checked all the fixes listed below but nothing works.

PS: I am using an nginx proxy manager.

If i change fromt http to https in /opt/patchmon/frontend/.env (reboot lxc)
then i get the same error message

[vhsdream]

If anything is changed in /opt/patchmon/frontend/.env then you need to rebuild the frontend. Rebooting the LXC will not work.

If you are using NPM, then I assume you have a TLS cert and a FQDN (patchmon.domain.tld). So in /opt/patchmon/frontend/.env, change VITE_API_URL to your FQDN/api/v1.

Then, in /opt/patchmon/backend/.env, ensure these env vars are present and configured:

# Server Configuration
PORT=3001
NODE_ENV=production
SERVER_PROTOCOL=https
SERVER_HOST=<your fqdn>
SERVER_PORT=443
TRUST_PROXY=2

The last one, TRUST_PROXY, doesn't seem to like if you put an IP address there. However, true, 0, 1 or 2 seems to be allowed. true is the least secure.

Make sure your CORS_ORIGIN in the same env file matches what you have for SERVER_HOST, but add https:// in front of it.

After all that is done, rather than manually building the frontend, you can just edit /root/.patchmon to have a lower version and then run update.

[treffNIX9815]

thx a lot, now the webinterface is working. But all my hosts are now "offline". What can i do ?

the port of API is changed, this must changed in the config.yml too
nano /etc/patchmon/config.yml

[oswaldo-be]

I followed the instructions here
And when trying to get to the GUI it said I have to set up a new admin account.
I won't, because then i am afraid i have to set up also all the clients again.
This software seems to be a new tool and I have to start from the beginning...

[vhsdream]

If you get to the GUI and it asks to setup a new account, it means something is wrong with your config. The database is separate.

Please post your configs - /opt/patchmon/backend/.env, /opt/patchmon/frontend/.env, and confirm that the Nginx config is valid - nginx -t

[oswaldo-be]

nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

cat /opt/patchmon/backend/.env

Database Configuration

DATABASE_URL="postgresql://patchmon_usr:some_password@localhost:5432/patchmon_db"
PY_THRESHOLD=3M_DB_CONN_MAX_ATTEMPTS=30
PM_DB_CONN_WAIT_INTERVAL=2

JWT Configuration

JWT_SECRET="some_secret"
JWT_EXPIRES_IN=1h
JWT_REFRESH_EXPIRES_IN=7d

Server Configuration

PORT=3001
SERVER_PROTOCOL=http
SERVER_HOST=192.168.178.153
SERVER_PORT=3000
NODE_ENV=production
TRUST_PROXY=1

API Configuration

API_VERSION=v1

CORS Configuration

CORS_ORIGIN="http://192.168.178.153"

Session Configuration

SESSION_INACTIVITY_TIMEOUT_MINUTES=30

User Configuration

DEFAULT_USER_ROLE=user

Rate Limiting (times in milliseconds)

RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=5000
AUTH_RATE_LIMIT_WINDOW_MS=600000
AUTH_RATE_LIMIT_MAX=500
AGENT_RATE_LIMIT_WINDOW_MS=60000
AGENT_RATE_LIMIT_MAX=1000

Redis Configuration

REDIS_HOST=localhost
REDIS_PORT=6379

Logging

LOG_LEVEL=info
ENABLE_LOGGING=true

TFA Configuration

TFA_REMEMBER_ME_EXPIRES_IN=30d
TFA_MAX_REMEMBER_SESSIONS=5
TFA_SUSPICIOUS_ACTIVITY_THRESHOLD=3

cat /opt/patchmon/frontend/.env
VITE_API_URL=http://192.168.178.153:3001/api/v1
VITE_APP_NAME=PatchMon
VITE_APP_VERSION=1.4.2

[vhsdream]

Add the port to your CORS_ORIGIN value: http://192.168.178.153:3000

[oswaldo-be]

... and if anybody asks the Homepage Dashboard Integration also needs to change ports in the settings to 3000. Then it works again.

[oswaldo-be]

I took a closer look at my patchmon instance and there is not a single connection to a client...

[vhsdream]

The server doesn't connect to the clients; the agent on the client connects to the server. So, check there. If the IP address or port of the PatchMon server changes, then so does the agent config on each client. The config is located in /etc/patchmon.

[9technologygroup]

GitHub Issue: VITE_API_URL in Community Script Breaks Access When Behind Reverse Proxy

Title: VITE_API_URL in community script breaks access when behind reverse proxy (Nginx/Caddy/Traefik)

---

Hi team,

First of all, many thanks for maintaining the Proxmox community script and dedicating time to it.

We have been getting issues raised on the PatchMon repo where users report that after upgrading via the community script, their server access breaks. After some digging, here is the scenario and what is happening.

---

Background: What is VITE_API_URL?

The PatchMon frontend uses a Vite environment variable VITE_API_URL to determine where the backend API lives. In frontend/src/utils/api.js:

const API_BASE_URL = import.meta.env.VITE_API_URL || "/api/v1";

• If VITE_API_URL is set, Vite bakes it into the built JavaScript at build time. It cannot be changed at runtime.
• If it is unset, the app falls back to the relative path /api/v1.

VITE_API_URL was introduced in PatchMon version 1.3.0. The default in frontend/env.example is http://localhost:3001/api/v1, intended for local development. The mistake on our side was not clearly documenting that this can cause problems when the app is deployed behind a reverse proxy. As we had already handled this in the Docker Compose setup, we never saw the potential issue.

---

What the Community Script Does

Fresh install (install/patchmon-install.sh, lines 36-41):

cd /opt/patchmon/frontend
cat <<EOF >./.env
VITE_API_URL=http://${LOCAL_IP}:3001/api/v1
VITE_APP_NAME=PatchMon
VITE_APP_VERSION=${VERSION}
EOF
$STD npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev
$STD npm run build

Update flow (ct/patchmon.sh, lines 56-61):

PROTO="$(sed -n '/SERVER_PROTOCOL/s/[^=]*=//p' /opt/backend.env)"
HOST="$(sed -n '/SERVER_HOST/s/[^=]*=//p' /opt/backend.env)"
SERVER_PORT="$(sed -n '/SERVER_PORT/s/[^=]*=//p' /opt/backend.env)"
[[ "$PROTO" == "http" ]] && PORT=":3001"
sed -i 's/PORT=3399/PORT=3001/' /opt/backend.env
sed -i -e "s/VERSION=.*/VERSION=$VERSION/" \
  -e "\|VITE_API_URL=|s|http.*|${PROTO:-http}://${HOST:-$LOCAL_IP}${PORT:-}/api/v1|" /opt/frontend.env

The script takes the server URL and port from the backend config and writes that into frontend/.env as VITE_API_URL. When npm run build runs, this URL gets baked into the static files that Nginx serves.

Note: The PORT variable here is :3001 (backend port), not the Nginx port. So the constructed URL is always http://host:3001/api/v1 pointing directly at the backend.

---

Why This Breaks When Behind a Reverse Proxy

The community script also installs and configures Nginx:

• Nginx serves the frontend static files from /opt/patchmon/frontend/dist (typically on port 3000 or 80/443)
• Nginx proxies /api/ requests to http://127.0.0.1:3001 (the backend)

So users access the app through Nginx (e.g. https://patchmon.example.com or http://host:3000), not directly on port 3001.

With VITE_API_URL=http://host:3001/api/v1 baked into the frontend:

1. The browser loads the page from https://patchmon.example.com/ (or http://host:3000)
2. The frontend JavaScript then tries to call http://host:3001/api/v1 (or https://host:3001/...)
3. The browser makes a direct request to port 3001

In typical production setups:

• Only ports 80/443 (or 3000) are exposed to the internet
• Port 3001 is internal and not reachable from the client
• The backend is only reachable via the reverse proxy

Result: API calls fail (connection refused, blocked by firewall, etc.), and the dashboard cannot reach the backend.

---

The Fix: Use a Relative URL

When Nginx (or Caddy/Traefik etc) is in front, the frontend should use a relative path so requests go to the same origin and get proxied correctly:

VITE_API_URL=/api/v1

Or omit the variable entirely so the app uses the default /api/v1.

Then:

• Page loads from: https://patchmon.example.com/
• API requests go to: https://patchmon.example.com/api/v1
• Nginx proxies /api/ to the backend internally

This works regardless of domain, port, or proxy setup.

---

Our Side: PatchMon 1.4.3+ Changes

We are removing VITE_API_URL in PatchMon:

• We will comment it out (or remove it) from env.example in version 1.4.3 onwards
• The frontend will use the default relative /api/v1 when the variable is unset
• This avoids confusion and proxy-related breakage for future users

---

Suggested Fix for the Community Script

Fresh install (install/patchmon-install.sh): Remove the VITE_API_URL line and add a sed to delete it if present. Replace the current block (lines 35-42) with:

cd /opt/patchmon/frontend
cat <<EOF >./.env
VITE_APP_NAME=PatchMon
VITE_APP_VERSION=${VERSION}
EOF
sed -i '/^VITE_API_URL=/d' ./.env
$STD npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev
$STD npm run build

The sed -i '/^VITE_API_URL=/d' ./.env deletes any line starting with VITE_API_URL= so the variable is unset and the app uses the default /api/v1.

Update flow (ct/patchmon.sh): Replace the sed that updates VITE_API_URL with one that removes the line. Change lines 60-61 from:

sed -i -e "s/VERSION=.*/VERSION=$VERSION/" \
  -e "\|VITE_API_URL=|s|http.*|${PROTO:-http}://${HOST:-$LOCAL_IP}${PORT:-}/api/v1|" /opt/frontend.env

To:

sed -i -e "s/VERSION=.*/VERSION=$VERSION/" \
  -e '/^VITE_API_URL=/d' /opt/frontend.env

The -e '/^VITE_API_URL=/d' removes the line that starts with VITE_API_URL=, so the variable is unset and the app uses the default /api/v1.

---

Note on SERVER_PORT and URL Config

The backend uses SERVER_PROTOCOL, SERVER_HOST, and SERVER_PORT to build the server URL stored in the database. This URL appears in the "URL Config" setting in the application settings and is used when adding hosts (the install URL shown to users and agents).

The server URL should be the URL used to access the app, i.e. the URL that reaches Nginx. Since Nginx proxies yourserver.com:3000/api/v1 to the backend, SERVER_PORT should be 3000 (or whatever port the browser uses to access the app), not the backend port 3001.

The fresh install sets SERVER_PORT=3000 correctly (line 51 of patchmon-install.sh).

I've noted this only for clarification purposes.

---

User Report

A user faced this issue after installing via the Proxmox Helper Script. They had VITE_API_URL=http://patchmon:3001/api/v1 in their frontend .env. After removing the VITE_API_URL line and running npm run build in the frontend directory, it worked: PatchMon/PatchMon#564

---

Summary

Scenario	Current script behavior	Result
Direct access to container	VITE_API_URL=http://host:3001/api/v1	Works if port 3001 is reachable
Behind Nginx/Caddy/Traefik	Same absolute URL	Fails: browser cannot reach port 3001
With relative URL or line removed	VITE_API_URL=/api/v1 or unset	Works in all cases

We recommend updating the script to remove VITE_API_URL (or set it to /api/v1). Happy to help with any questions or testing.

[vhsdream]

Thank you so much for the detailed explanation with cause and effect!

I'll implement this right away. Thank you for being so patient with the influx of Issues in your repo.

[9technologygroup]

Thank you so much for the detailed explanation with cause and effect!

I'll implement this right away. Thank you for being so patient with the influx of Issues in your repo.

No need to thank me for I am in need of thanking yourselves and the rest of the community for being patient with me.

Carry on doing the good work you do <3

Iby

[AdMeik]

This working great ;-) Thanks guys 👍
Upgrade from 1.4.0 to 1.4.2
Proxy over a HAproxy on OPNsense (before only WS Connection, now WSS)

[Builder-DE-TH]

I have upgraded to 1.4.2 and remediated all my clients and all existing hosts seem to be working fine however when I try to add a new host the command generated is still has port 3399 and it fails to connect, manually changing it to 3001 doesn't work either and I see nowhere in the configs to change that to what I believe it should now be which is 3001. Anyone know how I fix this?

[Builder-DE-TH]

Hi,

I did as you suggested in the UI and it changed the port in the command to 30090

When I tried the command on the client, it failed to connect, this is the active server congiguration

Server Host | 192.168.1.128 | Database
Server Port | 30090 | Database
Full Server URL | http://192.168.1.128:30090 | Database (Computed)
Backend Configuration (backend/.env)
CORS_ORIGIN | http://192.168.1.128:3000 | backend/.env
CORS_ORIGINS | Not set | backend/.env
PORT | 3001 | backend/.env
NODE_ENV | production

[9technologygroup]

I think either there is a typo or it's a configuration by yourself but in your messages i'm seeing 30090 as opposed to 3000

[Builder-DE-TH]

Yes apologies, fat fingers on my side, all working fine now, thanks for your swift response. Great app. loving it.

[tremor021]

@9technologygroup this app is a godsend for homelabs. Thank you for providing support for our users

[9technologygroup]

I appreciate the kind words @tremor021 and @Builder-DE-TH

The new version I'm going to release will be able to actually patch systems, I have it working and it's really great (outputs, schedules, policies)

So I will be raising a github request when it comes to upgrading to the new version.

Many thanks for your support.