WAF log maintenance cron job fails daily with "404 Not Found" on 127.0.0.1

1Panel
1

Description

A scheduled warning appears in the 1Panel system logs exactly at 00:00:00 every day. The 1panel-agent attempts to trigger the WAF log maintenance task by sending an HTTP request to http://127.0.0.1:80/log_maintenance, but the OpenResty server returns a 404 Not Found HTML page instead of executing the maintenance script.

This issue has been verified on multiple independent servers running 1Panel.

Error Logs

[2026-08-28 00:00:00] [WARNING] finish WAF log maintenance failed: WAF API http://127.0.0.1:80/log_maintenance returned 404 Not Found: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>

Steps to Reproduce

  1. Enable the WAF (Web Application Firewall) feature in 1Panel (verified on environments using the xpack module).
  2. Wait for the daily cron job at midnight (00:00:00), or manually trigger a POST request to the local API: curl -X POST http://127.0.0.1:80/log_maintenance.
  3. Check the 1Panel.log or the curl output, which will show a 404 error page generated by OpenResty.

Technical Analysis
After conducting a deep investigation into the server, we ruled out system firewalls and custom WAF block pages as the cause. The issue appears to stem from the OpenResty/WAF configuration generated by 1Panel:

  1. Missing Route/Interception: The default Nginx configuration (default.conf) lacks a specific location /log_maintenance block. Furthermore, the Lua script (waf.lua) fails to intercept this local request, causing the request to fall through to Nginx’s default 404 handler.

  2. Empty Token: Checking the WAF global configuration at /usr/local/openresty/1pwaf/data/conf/global.json, the internal API token is entirely empty (“token”:“”). It seems the WAF initialization process fails to populate the credentials required for this internal API route to function properly.

Expected Behavior

The WAF API on 127.0.0.1:80 should correctly intercept the /log_maintenance request, validate the internal token, execute the log cleanup task, and return a 200 OK status.

Impact

This bug does not affect normal website traffic, nor does it affect the WAF’s ability to block malicious requests. However, it prevents old WAF logs from being cleaned up automatically, which may slowly consume disk space over a long period.

1Panel ：2.2.5
Ubuntu26LTS