Version: Cloudron 10.1.5 (box), VPN app installed (WireGuard + OpenVPN)

What I did

1. Installed the VPN app and added a WireGuard device with no custom CIDRs.
2. On an App Proxy entry (Apps > Add app > App Proxy, pointing at an internal service), opened Access Control and turned on "Require VPN" (VPN protection), then saved.

What happens

• The UI shows an error: Assertion: expected 'object' !== 'string', thrown from getContainerIp6 at reverseproxy.js:446. It is reached through getVpnAccessIngressData from writeAppLocationNginxConfig.
• The app's file in /etc/nginx/applications is deleted before the crash, and the new one is never written. Afterwards the app's domain is served by the default nginx server with the wrong certificate.
• The setting does not stick: requiresVpn is still 0 in the database.
• I reproduced this on three different proxy apps.

Recovery

Opening the app's Location and clicking Save rewrites the nginx config, and the app comes back.

Expected

Either the option works for App Proxy apps, or it is hidden or refused up front. In every case a failure should leave the existing nginx config in place.

Why I think it happens

A proxy app has no container, so there is no container IP to look up. getContainerIp6 receives a string where it expects an object, and the failure comes before the vhost is rewritten. I have only read the stack trace, not the code path, so this is a guess.

Also

"Require VPN" turns on without problems for a real (containerised) app, so the failure is specific to App Proxy.

Side effect worth documenting

With no app requiring the VPN, the generated client profile has an empty AllowedIPs =. Some clients (Firewalla) refuse to import or connect with it. This is only a documentation point, since the profile gets entries once an app requires the VPN.

Logs

The box.log lines from the failed save are available; I can attach them (redacted) on request.