Can't connect local Nextcloud in iOS

Guys,

In a Truenas scale Dragonfish 24.04.2, I’ve running a Nextcloud 29.0.4, in that installation I can see three other pods, nginx:1.25.4, postgres:13.1 and redis:7.0.11.

The Truenas uses the default certificate.

The Nextcloud installation has most of the default settings, the only to mention is that I created 4 different Data sets for
Nextcloud AppData Storage (HTML, Custom Themes, Apps, etc.)
Nextcloud User Data Storage
Nextcloud Postgres Data Storage
Nextcloud Postgres Backup Storage

I cannot connect to the server using the Nextcloud client in any iOS devices, iPads 9th Gen OS 17.05, iPhone 15+ same version.

I can connect to the server in all those iOS devices by using Safari and Chrome. In Safari shows the warning about the certificate but when i click in the link it shows the web interface.

I can connect to the server using the Nextcloud client in the all the Android devices, also using any browser.

The web interface Url is https://192.168.0.117:9001

In the iOS devices, the very first time I enter the Url, i get the following prompts:

1.- “Nextcloud” would like to find and connect the devices on your local network. I select “Allow”.

2.- After i get “Connection error” The internet connection appears to be offline, and the only option is “OK”.

3.- And finally, when i press the right arrow in the client application it shows: The certificate for this server is invalid. Do you want to connect to the server anyway? I select “Yes”.

Afterward, it does not matter if i press the right arrow in the client to connect to the server, it does nothing. so i delete the app in the iOS device and reinstall it again.

I’ve been reading and doing several changes based on this forum, with no luck.

BTW in the iOS devices i can’t install certificates, or anything like that, i do not have that option under Certificate Trust Settings nor VPN & Device Management.

config.php

<?php
$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => 'nextcloud-redis',
    'password' => '****',
    'port' => 6379,
  ),
  'upgrade.disable-web' => true,
  'passwordsalt' => '****',
  'secret' => '****',
  'trusted_domains' => 
  array (
    0 => '192.168.0.117',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'pgsql',
  'version' => '29.0.4.1',
  'overwrite.cli.url' => 'https://192.168.0.117',
  'dbname' => 'nextcloud',
  'dbhost' => 'nextcloud-postgres:5432',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'oc_admin',
  'dbpassword' => '****',
  'installed' => true,
  'instanceid' => 'ocvlte3u187r',
  'overwritehost' => '192.168.0.117:9001',
  'overwriteprotocol' => 'https',
  'trusted_proxies' =>
  array (
    0 => '192.168.0.117',
  ),
  'mail_configuration_removed' => 'removed ',
  'loglevel' => 1,
  'default_phone_region' => 'XX',
  'maintenance_window_start' => '6',
);

nginx.conf

events {}
http {
  server {
    listen 9001 ssl http2;
    listen [::]:9001 ssl http2;

    # Redirect HTTP to HTTPS
    error_page 497 301 =307 https://$host$request_uri;

    ssl_certificate '/etc/nginx-certs/public.crt';
    ssl_certificate_key '/etc/nginx-certs/private.key';

    client_max_body_size 3G;

    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always;

    location = /robots.txt {
      allow all;
      log_not_found off;
      access_log off;
    }

    location = /.well-known/carddav {
      return 301 $scheme://$host/remote.php/dav;
    }

    location = /.well-known/caldav {
      return 301 $scheme://$host/remote.php/dav;
    }

    location / {
      proxy_pass http://nextcloud:80;
      proxy_http_version                 1.1;
      proxy_cache_bypass                 $http_upgrade;
      proxy_request_buffering            off;

      # Proxy headers
      proxy_set_header Upgrade           $http_upgrade;
      proxy_set_header Connection        "upgrade";
      proxy_set_header Host              $http_host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Port  443;

      # Proxy timeouts
      proxy_connect_timeout              120s;
      proxy_send_timeout                 120s;
      proxy_read_timeout                 120s;
    }
  }
}

I’ve read something about “proxy_hide_header Upgrade;” but i did not want to try, bec I cannot find any real editor nano, vi, etc in the nginx pod, I only have cat.

Please can you tell me what to do.

hello @carloscmd welcome to the forum :handshake:

I think the problem is related to the invalid certificate. One can not have public TLS cert for an IP address and you likely use self-signed cert. iOS is very restrictive in terms of certificates (Android as well in regards of in-app browser components - webview).

I would recommend you always use public DNS with valid public TLS certificate to access your cloud instance. splitbraindns helps to keep the traffic local. If you still want to use local IP than better use plain http:// (but it doesn’t always work e.g. Passwords app and Office require https://)

Topics tagged with local_network splitbraindns and rebind_protection could help to find similar issues.

wwe,

Thanks for the fast response.

I was reading other of your posts related to split-brain dns but for sure i will need much more than that. :slight_smile:

In the mean time, I was looking at the nginx.conf file because in the docs say it should have the setting “server_name”, I tried to modify that file but it says [ File ‘nginx.conf’ is unwritable ] it is a rea only file system.

I tried several ways in that pod but it does not allow me to add that setting. Any idea how i can do that?.

BTW, I will appreciate how to splitbraindns more for dummies :slight_smile:

Thanks in advance.

I’m not familiar with truenas and can not help you with it. better you reach out to the respective community.

for split brain DNS you will find pretty detailed descriptions already but till now I didn’t found the motivation to write a detailed guide…