AiO+tailscale: reverse proxy documentation and variable APACHE_ADDITIONAL_NETWORK

🏷️ General
, , ,
1

I have no support/technical question and have seen the support category. (Be aware that direct support questions will be deleted.)

on

Which general topic do you have

The documentation says that for creating a reverse proxy, you can set the variable APACHE_ADDITIONAL_NETWORK to a shared network (which you then add to your proxy tool (e.g. tailscale)) and then proxy the address nextcloud-aio-apache.nextcloud-aio:$APACHE_PORT.

But with both Tailscale and Pangolin, I find that the actual address that I can proxy is nextcloud-aio-apache:$APACHE_PORT . It literally cost me weeks to make this discovery. So either I am doing it wrong (but it works?), or the documentation is wrong or outdated. If the documentation is wrong, then it really needs to be tweaked so people are constantly being frustrated. If there’s some way to make it work, then it needs more than one paragraph to explain it.

Thanks!

2

so far II understand tailscale is not exactly a "“reverse proxy” but rather a VPN which works similar to a reverse proxy. Likely there are some specialities related to it. there is dedicated discussion around tailscale - did you see it?

maybe this one is of interest as well: Easy setup: Container-less Tailscale as reverse proxy · nextcloud/all-in-one · Discussion #6817 · GitHub

3

Whether it’s exactly a reverse proxy or not is somewhat academic. At some point you have to specify the address your reverse proxy works on inside of Docker. I’ve just been doing this in a completely different context. AFAICT, the actual incantation is always:

http://<container>:<port>

never

http://<container>.<network>:<port>

Or at least I could never get the second incantation to work.

I wanted TS with a container so that everything is safely inside of dockers. I know, maybe that is naive. In any event, the TS people had put together a nice video that showed how to connect almost any docker container to TS, and it was really easy … except for AIO. And partly because I was using the wrong proxy address.

The instruction that NC seemed to be advocating, for some reason, was Tailscale (and Caddy as a sidecar) Reverse Proxy

But … you don’t need Caddy to issue certificates if you’re using TS. Maybe at one time you did, and that’s why the instructions include Caddy. The one thing that I did get eventually out of those instructions was down in the the Caddy file section where they show:

https://{$NC_DOMAIN} {
    reverse_proxy nextcloud-aio-apache:11000 {
        header_up X-Forwarded-Proto "https"
        header_up Host {host}
    }
}

Notice that it says nextcloud-aio-apache:11000, NOT nextcloud-aio-apache.nextcloud-aio:11000, as the reverse proxy instructions would suggest. In other words, you use the container as the domain name, not the network. Then Docker’s internal DNS converts that to the actual address.

That gave me the clue that the proxy instructions I had been trying to follow were wrong.

Thanks!