Agent fails with TLS configured NetPulse host

[crowedavid]

currently running v2.28.34, netpulse-agent v3.0.0

this evening i tried a fresh install of the netpulse-agent again on one of my APs and it didn't start.

logread -e netpulse gives: (many repetitions until i commented out the crontab watchdog entry)

Fri Sep 25 00:12:20 2026 daemon.err netpulse-agent[8228]: time=2026-09-25T07:12:20.656Z level=ERROR msg="[netpulse-agent] error fatal" err="HTTPS requiere NETPULSE_SERVER_FP (pinning SPKI, sin InsecureSkipVerify)"
Fri Sep 25 00:12:25 2026 daemon.err netpulse-agent[8259]: time=2026-09-25T07:12:25.716Z level=ERROR msg="[netpulse-agent] error fatal" err="HTTPS requiere NETPULSE_SERVER_FP (pinning SPKI, sin InsecureSkipVerify)"
Fri Sep 25 00:12:25 2026 daemon.info procd: Instance netpulse-agent::netpulse-agent s in a crash loop 6 crashes, 0 seconds since last crash

/etc/netpulse-agent.env shows:

# netpulse-agent — config (generado por reinstall)
NETPULSE_SERVER=https://netpulse-server-hostname.org:3443
NETPULSE_SLUG=netgear-wax220-2
NETPULSE_TOKEN=6

the server cert is valid and clean from my browser with no special modifications.

let me know if you need additional information.

[crowedavid]

i'm not sure of your workflow for closed issues that the fix didn't quite work for - will comment here but if it gets missed will open a new issue. let me know what you prefer.

currently running v2.28.35

tried "reinstall agent" from the netpulse console and it looks like the fix didn't quite hit the mark - here are the log lines right after it starts the netpulse-agent:

Fri Sep 25 21:20:21 2026 daemon.err netpulse-agent[22527]: time=2026-09-26T04:20:21.241Z level=ERROR msg="[netpulse-agent] error fatal" err="HTTPS requiere NETPULSE_SERVER_FP (pinning SPKI, sin InsecureSkipVerify); consíguelo con install-agent.sh (lo deriva del certificado automáticamente) o con: openssl s_client -connect netpulse-server-hostname.org:3443 </dev/null 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum"
Fri Sep 25 21:20:26 2026 daemon.err netpulse-agent[22563]: time=2026-09-26T04:20:26.311Z level=ERROR msg="[netpulse-agent] error fatal" err="HTTPS requiere NETPULSE_SERVER_FP (pinning SPKI, sin InsecureSkipVerify); consíguelo con install-agent.sh (lo deriva del certificado automáticamente) o con: openssl s_client -connect netpulse-server-hostname.org:3443 </dev/null 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum"

i took the offered openssl command and pushed the FP into the /etc/netpulse-agent.env file and it does start up (and v3.0.1 shows in netpulse console) and is running now. however, it looks like install.sh isn't quite working the way intended.

[gnacho]

Found it - the first fix covered install-agent.sh but missed the console reinstall path, which builds the env file itself, and the token rotation script was also dropping the FP on rewrite. Fixed in #870: the server now derives the pin on its own (TLS handshake against its own public URL) and both the reinstall and token-rotation scripts carry NETPULSE_SERVER_FP. Will be in the next release; your manual workaround is the right interim fix.

[gnacho]

v2.28.36 is out with the fix. You can drop the manual NETPULSE_SERVER_FP from /etc/netpulse-agent.env and hit "reinstall agent" from the console - the generated env should now include it automatically.

[crowedavid]

ok, the "reinstall agent" fixed the FP issue.

however, it appears to rewrite the netpulse-agent.env file blindly and doesn't respect the added "NETPULSE_SCAN_INTERVAL=0" line added to control scanning.

so, new asks:

• respect the current setting (if there)
• consider adding commented lines with all of the available env options set to their default values so it is readily apparent what is available soon after first setup

also, i would ask to consider removing the watchdog crontab entry from the entire setup - if the agent is crashing it will take some intervention from the user to fix so blindly restarting it seems non-productive. your setup that notices the agent is down from the netpulse console and alerting on it (especially when push notifications are working) will be the most effective.

sorry, this closed issue is getting beat up. :-)

[gnacho]

All three points addressed in #872:

• Reinstall and token rotation now preserve any NETPULSE_* lines they don't manage, so your NETPULSE_SCAN_INTERVAL=0 survives.
• The generated env ships the available options as commented defaults.
• The watchdog cron is dropped from new installs. Same reasoning you gave: a blind restart doesn't fix a crash loop, it just spams the log. procd respawn still covers one-shot crashes, the binary self-heal after sysupgrade moves into the init script, and upgrading cleans the old cron entry and watchdog file.

Leaving this open until you've had a chance to verify. And thanks for the thorough testing - reports like this are exactly what the beta needs, keep them coming.

[crowedavid]

note: a sysupgrade shouldn't cleanup the crontab entry. the crontab sits in /etc/crontabs/root so should be restored in a normal sysupgrade. the watchdog file will definitely get cleaned out though.

i had missed the binary self-heal addition - good work to keep that contained. i had thought the process might be more along the lines of doing a reinstall after upgrade from the netpulse console.

otherwise, looks like a good plan and i'll report results.

[gnacho]

Good catch - you're right, /etc survives sysupgrade so the cron line itself lingers (the cleanup I mentioned runs when the package defaults or a reinstall execute, not on sysupgrade). The leftover line points at a deleted file, so cron will log a missing-command error every 2 min until something cleans it - not harmful, just noisy. Tracked that edge separately; the reinstall path already removes it.

[crowedavid]

just upgraded to v2.28.37 and performed a couple variations of agent upgrades.

• after upgrade to v2.28.37
  • alert appeared in the log reporting "agent outdated"
  • log message not sent to push notification - which is fine, just not sure what messages to expect there yet
  • pushed the upgrade to the device and it preserved settings as expected with no changes in netpulse-agent.env or crontab
  • uninstalled that agent from the device and checked that it cleared everything and it does, crontab cleaned on uninstall
  • added a dummy crontab entry for netpulse-watchdog to test crontab cleanup
  • perform new install of agent on device
    • new /etc/netpulse-agent.env file with full complement of env options appears, commented as needed
    • startup cleaned up the crontab as expected
    • agent started and connected to netpulse server cleanly as expected

definite progress but one lingering issue - after editing NETPULSE_SCAN_INTERVAL to set it to 0, the log shows:

Sun Sep 27 10:48:39 2026 daemon.err netpulse-agent[25776]: time=2026-09-27T17:48:39.132Z level=WARN msg="[netpulse-agent] NETPULSE_SCAN_INTERVAL inválido, usando 30m" value="0     # min entre scans de vecinos; \"0\" = sin scans periódicos"
Sun Sep 27 10:48:39 2026 daemon.err netpulse-agent[25776]: time=2026-09-27T17:48:39.136Z level=INFO msg="[netpulse-agent] agente iniciado" version=3.0.2 slug=netgear-wax220-2 server=https://netpulse-server.org:3443 interval=30s scan_interval=30m0s
Sun Sep 27 10:48:39 2026 daemon.err netpulse-agent[25776]: time=2026-09-27T17:48:39.136Z level=INFO msg="[netpulse-agent] iw detectado: suscribiendo a eventos nl80211"

after trying a few variations of setting the value it is apparent that the env file parser doesn't like trailing comments - removing the trailing comment allowed it to startup normally with the expected value:

Sun Sep 27 10:52:42 2026 daemon.err netpulse-agent[27484]: time=2026-09-27T17:52:42.836Z level=INFO msg="[netpulse-agent] agente iniciado" version=3.0.2 slug=netgear-wax220-2 server=https://netpulse-server.org:3443 interval=30s scan_interval=-1s
Sun Sep 27 10:52:42 2026 daemon.err netpulse-agent[27484]: time=2026-09-27T17:52:42.836Z level=INFO msg="[netpulse-agent] iw detectado: suscribiendo a eventos nl80211"