Anyway, I don’t understand what the domain verification expects.
Now I left only the nextcloud nginx configuration:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
listen [::]:80; # comment to disable IPv6
if ($scheme = "http") {
return 301 https://$host$request_uri;
}
if ($http_x_forwarded_proto = "http") {
return 301 https://$host$request_uri;
}
listen 443 ssl http2; # for nginx versions below v1.25.1
listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6
# listen 443 ssl; # for nginx v1.25.1+
# listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6
# http2 on; # uncomment to enable HTTP/2 - supported on nginx v1.25.1+
# listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
# listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
# http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
# quic_gso on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
# quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
# quic_bpf on; # improves HTTP/3 / QUIC - supported on nginx v1.25.0+, if nginx runs as a docker container you need to give it privileged permission to use this option
# add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
proxy_buffering off;
proxy_request_buffering off;
client_max_body_size 0;
client_body_buffer_size 512k;
# http3_stream_buffer_size 512k; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
proxy_read_timeout 86400s;
server_name app.example.org;
location / {
proxy_pass http://localhost:11000$request_uri; # Adjust to match APACHE_PORT and APACHE_IP_BINDING. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#adapting-the-sample-web-server-configurations-below
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header Early-Data $ssl_early_data;
# Websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
# If running nginx on a subdomain (eg. nextcloud.example.com) of a domain that already has an wildcard ssl certificate from certbot on this machine,
# the <your-nc-domain> in the below lines should be replaced with just the domain (eg. example.com), not the subdomain.
# In this case the subdomain should already be secured without additional actions
ssl_certificate /etc/letsencrypt/live/app.example.org/fullchain.pem; # managed by certbot on host machine
ssl_certificate_key /etc/letsencrypt/live/app.example.org/privkey.pem; # managed by certbot on host machine
#ssl_dhparam /etc/dhparam; # curl -L https://ssl-config.mozilla.org/ffdhe2048.txt -o /etc/dhparam
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
#ssl_early_data on;
#ssl_session_timeout 1d;
#ssl_session_cache shared:SSL:10m;
#ssl_protocols TLSv1.2 TLSv1.3;
#ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;
#ssl_prefer_server_ciphers on;
#ssl_conf_command Options PrioritizeChaCha;
#ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}
and I checked nothing answers on app.example.org.
Still the domain verification fails:
NOTICE: PHP message: Expected was: e9b9803de193f63289f7feab231c78574eddda2cb1a3e04f
NOTICE: PHP message: The error message was:
Here the docker command:
sudo docker run \
--init \
--sig-proxy=false \
--name nextcloud-aio-mastercontainer \
--restart always \
--publish 8080:8080 \
--env APACHE_PORT=11000 \
--env APACHE_IP_BINDING=127.0.0.1 \
--env APACHE_ADDITIONAL_NETWORK="" \
--env SKIP_DOMAIN_VALIDATION=false \
--env NEXTCLOUD_DATADIR="/home/user/nextcloud-data" \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
ghcr.io/nextcloud-releases/all-in-one:latest
I tried to follow the debug steps but I didn’t find the culprit:
- done, two times
APACHE_PORT seems correctAPACHE_IP_BINDING should be correct since I’m not reaching the container elsewhere than localhost- this is above and seems correct
- done
- here the logs:
[Sat May 17 13:31:13.029758 2025] [mpm_event:notice] [pid 125:tid 125] AH00489: Apache/2.4.62 (Unix) OpenSSL/3.3.3 configured -- resuming normal operations
[Sat May 17 13:31:13.029860 2025] [core:notice] [pid 125:tid 125] AH00094: Command line: 'httpd -D FOREGROUND'
[17-May-2025 13:31:13] NOTICE: fpm is running, pid 131
[17-May-2025 13:31:13] NOTICE: ready to handle connections
{"level":"info","ts":1747488673.1197202,"msg":"maxprocs: Leaving GOMAXPROCS=1: CPU quota undefined"}
{"level":"info","ts":1747488673.120049,"msg":"GOMEMLIMIT is updated","package":"github.com/KimMachineGun/automemlimit/memlimit","GOMEMLIMIT":907477401,"previous":9223372036854775807}
{"level":"info","ts":1747488673.1201324,"msg":"using config from file","file":"/Caddyfile"}
{"level":"info","ts":1747488673.1232712,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"info","ts":1747488673.126566,"msg":"serving initial configuration"}
</html>nter>nginx/1.24.0 (Ubuntu)</center>>nnection attempt to "https://app.example.org:443" was: <html>
NOTICE: PHP message: Expected was: e9b9803de193f63289f7feab231c78574eddda2cb1a3e04f
NOTICE: PHP message: The error message was:
NOTICE: PHP message: Please follow https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#6-how-to-debug-things in order to debug things!
- result is
0
- I’m not behind CGNAT
- I’m not using Cloudflare
- firewall ports are opened:
$ sudo ufw status
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
80/tcp ALLOW Anywhere
Nginx Full ALLOW Anywhere
3000 ALLOW Anywhere
3001 ALLOW Anywhere
443 ALLOW Anywhere
8443 ALLOW Anywhere
8080 ALLOW Anywhere
3478 ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
Nginx Full (v6) ALLOW Anywhere (v6)
3000 (v6) ALLOW Anywhere (v6)
3001 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
8443 (v6) ALLOW Anywhere (v6)
8080 (v6) ALLOW Anywhere (v6)
3478 (v6) ALLOW Anywhere (v6)
- yes, I have a public ipv4 address
- I’m not able to do this
- done, three times
- I don’t want to disable the domain validation… I just want to learn how to fix it!
Thanks for the patience!
GitHub README – “Can I run Nextcloud in a subdirectory on my domain?”
My shared setup was focused on performance and large file sync behind a reverse proxy.
It was not meant to demonstrate AIO running under a path like 