11000 The login is blocked since Nextcloud is running.Please use the automatic login from your Nextcloud

Jace_Zing · August 8, 2024, 7:06am

nextcloud/all-in-one/blob/main/reverse-proxy.md#4-open-the-aio-interface:~:text=1. Configure the reverse proxy

# Reverse Proxy Documentation

**Note:** The maintainers of AIO noticed that this documentation could be improved to make it easier to follow. All contributions that improve this are very welcome!

A [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) is basically a web server that enables computers on the internet to access a service in a [private subnet](https://en.wikipedia.org/wiki/Private_network).

**Please note:** Publishing the AIO interface with a valid certificate to the public internet is **not** the goal of this documentation! Instead, the main goal is to publish Nextcloud with a valid certificate to the public internet which is **not** running inside the mastercontainer but in a different container! If you need a valid certificate for the AIO interface, see [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface).

In order to run Nextcloud behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else), you need to specify the port that AIO's Apache container shall use, add a specific config to your web server or reverse proxy and modify the startup command a bit. All examples below will use port `11000` as example `APACHE_PORT` which will be exposed on the host to receive unencrypted HTTP traffic from the reverse proxy. **Advice:** If you need https between Nextcloud and the reverse proxy because it is running on a different server in the same network, simply add another reverse proxy to the chain that runs on the same server like AIO and takes care of https proxying (most likely via self-signed cert). Another option is to create a VPN between the server that runs AIO and the server that runs the reverse proxy which takes care of encrypting the connection.

**Attention:** The process to run Nextcloud behind a reverse proxy consists of at least steps 1, 2 and 4:
1. **Configure the reverse proxy! See [point 1](#1-configure-the-reverse-proxy)**
1. **Use this startup command! See [point 2](#2-use-this-startup-command)**
1. Optional: If the reverse proxy is installed on the same host and in the host network, you should limit the apache container to only listen on localhost. See [point 3](#3-limit-the-access-to-the-apache-container)
1. **Open the AIO interface. See [point 4](#4-open-the-aio-interface)**
1. Optional: Get a valid certificate for the AIO interface! See [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface)
1. Optional: How to debug things? See [point 6](#6-how-to-debug-things)

**Please note:** Since the Apache container gets created by the mastercontainer, there is **NO** way to provide custom docker labels or custom environmental variables for the Apache container. So please do not attempt to do this because you will fail! Only the documented way will work!

This file has been truncated. show original

I am unsure what to do with port 11000? do I need to allow it in my router (OPNsense) firewall? if so, does the WAN need to access the port, or just the NextCloud container?

What do I need to add to NginX?

I am using this in Unraid with the " nextcloud-aio-mastercontainer "

Apologies for not being super smart.

szaimen · August 8, 2024, 8:05am

Hi, can you follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#6-how-to-debug-things?

Jace_Zing · August 8, 2024, 2:31pm

So I have NginX-Proxy-Manager currently set to 8080, and that is how I got the screenshots in the OP. When I change my entry in NginX-Proxy-Manager to port 11000 it no longer loads.

The other problem I see I have from reading the debug link, is “Make sure that you used the docker run command that is described in this reverse proxy documentation.” I am using unraid, so I will have to look into that, as I’ve just been hitting “start” and not sure how to run it special like its requesting.

Thanks for pointing me in the right direction, I will get back to you when I have time to look into it and try tonight.

Jace_Zing · August 9, 2024, 8:48am

part 2… sorry to bend rules but new users cant post more than 2 media messages, and I have 3 images to assist describing my issue.

and then when I go to the NC IP address:

It just loops on this and refreshes wanting passphrase and going back to that page.

I am still unsure if in NginX-Proxy-Manager if my domain needs to be forwarded with port 8080 like it is now, or 11000, and there is another step to complete after changing the port there?

Jace_Zing · August 9, 2024, 8:48am

Trying different things.
If I stop the Apache docker container, like this page says to:

then in unraid the docker containers look like this:

end part 1.

Jace_Zing · August 9, 2024, 8:48am

This screenshot shows that I have:
1- Apache port 11000 being pointed to.
2- Showing Apache_IP_Binding also pointing to the apache IP address that Unraid has assigned to Apache.

szaimen · August 9, 2024, 8:54am

Can you set APACHE_IP_BINDING to 0.0.0.0 and then restart the stack via the aio interface and check if that helps?

Jace_Zing · August 10, 2024, 2:25am

Okay:

stopped all containers from https://192.168.1.XXX:8080/containers
Went into Unraid and stopped the AIO Master Container
Went into the master container and changed the IP, see image:

unraid apache 00002192×1804 198 KB
Started AIO Master Container. went back to Nextcould local IP. and started the container stack from there.
after a few minutes all containers in the stack are green.
Clicked the blue “open your nextcloud” and got the same trusty screen

NC21007×734 62.1 KB

szaimen · August 10, 2024, 7:52am

Are you using a reverse proxy on your unraid host?

Jace_Zing · August 10, 2024, 1:48pm

I am using NginX-Proxy-Manager to route my domain to my unraid server/containers on my unraid.

But the containers on my unraid have their own private IP that is reachable from any device on the network. WITH THE EXCEPTION of ports that may be blocked by OPNsense, I do have tighter than standard port/traffic blocking.

szaimen · August 10, 2024, 1:50pm

I see. Can you show a screenshot of ehat you’ve configured in npm for aio?

Jace_Zing · August 10, 2024, 2:03pm

Yessir, it will be 6+hours before I am home, I am at work. thanks for your time.

Jace_Zing · August 10, 2024, 7:33pm

When I changed 8080 to 11000 and added the three(?) lines in the advanced tab, like the link you sent in the first response:

Then when I went to NC, the page did not load. So I reverted back to the settings you see in the above screenshots.

Thanks!

Jace_Zing · August 10, 2024, 7:33pm

Jace_Zing · August 10, 2024, 7:34pm

Sorry for many posts… I keep getting limited to two screenshots. a very silly limit if I want to show you everything.

szaimen · August 10, 2024, 8:34pm

I see. You need point at http://ip.address.of.server:11000

Jace_Zing · August 10, 2024, 9:09pm

with the 8080 like the above settings, I get:

And when I change the port in NginX-Proxy-Manager from 8080 to 11000 I get this error:
11000

Thank you

szaimen · August 10, 2024, 10:33pm

Hm… Did you point at http instead of https?

Jace_Zing · August 11, 2024, 2:18am

I have the domain set to auto go to https. so even if I delete the “s” and “enter” to reload, it reloads to https.

szaimen · August 11, 2024, 3:46am

I meant in npm