If the agent fails to connect to the hub via nginx, the server will cause excessive memory usage.

[wujian0327]

ztm version: v0.0.4

os:

step:

1. sudo ./ztm start ca

2. sudo ./ztm start hub

3. ./ztm invite root --bootstrap http://34.84.172.121/hub/ > permit.json (http://34.84.172.121/hub/ is nginx reverse proxy to hub)

4. sudo ./ztm start agent

5. open the agent website and join the hub

6. Wait five minutes, the server's memory will be used up and cause a crash

[naqvis]

Thanks for bringing up this issue. Few questions to get a better understanding of the scenario:

1. Issue is observed only when Hub is behind a reverse proxy (Nginx in this case)?
2. Attempting to connect an agent to this hub causes huge memory consumption on hub? what behavior of agent is observed? i.e. do you observe similar high RAM consumption behavior on agent as well?
3. Are you able to get the agent connected to hub successfully?

[wujian0327]

Thanks for bringing up this issue. Few questions to get a better understanding of the scenario:

1. Issue is observed only when Hub is behind a reverse proxy (Nginx in this case)?
2. Attempting to connect an agent to this hub causes huge memory consumption on hub? what behavior of agent is observed? i.e. do you observe similar high RAM consumption behavior on agent as well?
3. Are you able to get the agent connected to hub successfully?

1. yes, Hub is behind Nginx, here is Nginx config. The hub is listening on port 8888.

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen       80;
        server_name  localhost;

     location ~ /agent/ {
          proxy_pass  http://127.0.0.1:7777;
         }

         location ~ /relay/ {
           proxy_pass  http://127.0.0.1:8001;
          }

          location ~ /proxy/ {
              proxy_pass  http://127.0.0.1:8887;
          }
      location ~/hub/ {
              proxy_pass  http://127.0.0.1:8888;
         }

 }
}

2. I think it's the agent that's taking up too much resources, not the hub. Here are some logs from agent:

3. The agent failed to connect to the hub.

4. I found that it was normal to go through http://34.84.172.121:8888, but it was not successful to go through http://34.84.172.121/hub/

you can try this permit file

permit2.json

[naqvis]

Thanks for the clarification. Please note that:

• Hub can"t and shouldn't be behind a reverse proxy, as hub deals with agent(s) TLS certificates involved with mTLS. Thus putting it behind L7 proxy prohibits its usage.
• bootstrap address should be a pure L4 address (i.e. IP[:PORT})
• ZTM behavior of excessive memory usage (on retry attempts) should be BUG and we will investigate it further to find the RCA and fix where needed.

[wujian0327]

Thank you for your instructions, I will use the hub as suggested.