High Availability for nginx is not synchronizing removal of settings

[patrickstump]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [ x ] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ x ] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

High availability synchronization for nginx is only synchronizing additions or when there is an addition, but not when there is a deletion.

Example

Two firewalls, fw-a and fw-b, in HA configuration using nginx as a reverse proxy. fw-a is the primary. When configuring nginx on the primary and a setting is added, the HA synchronization pushes the added config over to the secondary firewall, fw-b.

However, if that setting is removed and nothing else added, it will not push that update or removing the setting to fw-b when synchronizing again.

Example
Add a Nginx Credential "test" to fw-a, then synchronize the firewalls. The "test" user is added to fw-b. Then remove the "test" user under nginx credentials on fw-a and synchronize again, the "test" user is gone on fw-a, but still remains on fw-b. Now, on fw-a, and a new user, "test2" (different username) to nginx credentials and synchronize again, fw-b will have removed the original "test" user and have only the "test2" user.

Thus it appears to only by synchronizing sections with an addition or some data at all (i.e. not an empty section).

To Reproduce

Steps to reproduce the behavior:

Add a credential to fw-a

1. On fw-a (primary) click Service->Nginx
2. Select the https dropdown tab, and select credentials
3. Add a credential "test" and make up a password (it will not be used, no need to retain password)
4. Move to high availability status screen: Click System->High Availability->Status
5. Click on the "Synchronize" button under the status label (button has a cloud with an upward facing arrow on it)

Check settings on FW-B

1. On fw-b, click Service->Nginx
2. Select the https dropdown tab, and select credentials
3. The credential for "test" user will be present

Remove nginx credential on fw-a and perform another HA synchronization

1. On fw-a (primary) click Service->Nginx
2. Select the https dropdown tab, and select credentials
3. Delete the "test" user credential
4. Move to high availability status screen: Click System->High Availability->Status
5. Click on the "Synchronize" button under the status label (button has a cloud with an upward facing arrow on it)

Check fw-b nginx credentials

1. Refresh the fw-b nginx credential screen or follow the instructions in "Check settings on FW-B"
2. You will see that the "test" user is still present even though it is not on fw-a.

Add another Credential to fw-a

1. At this point, there are no nginx credentials on fw-a but the "test" user is still on fw-b.
2. On fw-a, follow the "Add credential to fw-a instructions, but change the username to "test2"
3. Synchronize the the HA system from fw-a again.
4. Check fw-b nginx credentials and you will see that "test2" has been synchronized, and the"test" user has been removed.

Expected behavior

When a change is made to the nginx configuration, addition or deletion, it should be synchronized to the backup firewall so that they are always in synchronization.

Describe alternatives you considered

None

Screenshots

Not Applicable

Relevant log files

From fw-a when credential is deleted

audit 94210 - [meta sequenceId="295"] user [email protected] changed configuration to /conf/backup/config-1737032456.5349.xml in /api/nginx/settings/delcredential/0854d875-b8db-4556-aca9-75696bc1ec11 /api/nginx/settings/delcredential/0854d875-b8db-4556-aca9-75696bc1ec11 made changes

on fw-b directly after that log

configd.py 321 - [meta sequenceId="461"] generate template container OPNsense/Nginx
audit 46588 - [meta sequenceId="532"] user [email protected] changed configuration to /conf/backup/config-1737032486.6708.xml in /api/nginx/settings/delcredential/0854d875-b8db-4556-aca9-75696bc1ec11 /api/nginx/settings/delcredential/0854d875-b8db-4556-aca9-75696bc1ec11 made changes

Additional context

Synchronization seems to be working for everything else I am using it with.

Environment

Software version used and hardware type if relevant, e.g.:

Both systems are:

OPNsense 24.7.11_1 (amd64)
Intel(R) Xeon(R) Platinum 8168 CPU @ 2.70GHz (48 cores, 96 threads)

FreeBSD fw-b.umbracorp.io 14.1-RELEASE-p6 FreeBSD 14.1-RELEASE-p6 stable/24.7-n267981-8375762712f SMP amd64