Hey Cloud workers 
This error has, contrary to the announcements, not been fixed in v 28.0.3, since 28.0.2 the error is still the same.
This Security & setup warnings look exactly the same in 28.0.3 again.
Please have a look at RC5 of Nextcloud 28.0.2.
–
My Nextcloud installation runs in Docker and has a nginx reverse proxy in front of it:
docker-compose:
version: '3'
volumes:
nextcloud:
db:
networks:
nextcloud_network:
external: false
services:
app:
image: nextcloud:28.0.3
container_name: nextcloud28-app
restart: unless-stopped
hostname: cloud.sieh.org
ports:
- 127.0.0.1:8080:80
healthcheck:
test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:80"]
interval: 60s
timeout: 5s
retries: 3
links:
- db
volumes:
- /root/nextcloud28/html:/var/www/html
- /root/nextcloud28/data:/var/www/html/data
environment:
- MYSQL_PASSWORD=***
- MYSQL_DATABASE=nextcloud28
- MYSQL_USER=nextcloud
- MYSQL_HOST=db
- REDIS_HOST=redis
networks:
- nextcloud_network
db:
image: mariadb:latest
container_name: nextcloud28-mariadb
restart: unless-stopped
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
volumes:
- /root/nextcloud28/mysql:/var/lib/mysql
environment:
- MARIADB_AUTO_UPGRADE=1
- MARIADB_DISABLE_UPGRADE_BACKUP=1
- MYSQL_ROOT_PASSWORD=***
- MYSQL_PASSWORD=***
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
networks:
- nextcloud_network
healthcheck:
test: "/usr/bin/mariadb --user=root --password=*** --version"
interval: 60s
timeout: 5s
retries: 3
redis:
image: redis:alpine
container_name: nextcloud28-redis
volumes:
- /root/nextcloud28/redisdata:/data
networks:
- nextcloud_network
restart: unless-stopped
nginx domain conf:
server {
server_name cloud.sieh.org;
listen [::]:443 ssl;
listen 443 ssl;
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/cloud.sieh.org-0001/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/cloud.sieh.org-0001/privkey.pem; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
client_max_body_size 512M;
location / {
include mime.types;
types {
text/javascript js mjs;
}
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffers 16 4k;
proxy_buffer_size 2k;
proxy_pass http://127.0.0.1:8080/;
}
location /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; }
location /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; }
}
As you see, I have also included the mime.types, as I got this advice from @koelle25:
… but the error still persists, I have no Idea anymore. 
The *curl esm-test.mjs* thing looks like this:
root@vmd104158:~# curl -I https://cloud.sieh.org/apps/settings/js/esm-test.mjs
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 07 Mar 2024 02:20:09 GMT
Content-Type: text/javascript
Content-Length: 109
Connection: keep-alive
Vary: Accept-Encoding
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 07 Mar 2024 01:58:40 GMT
ETag: "6d-613086a1609f2"
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=15778463
Strict-Transport-Security: max-age=15768000; includeSubDomains; preload;
root@vmd104158:~#
I have often read something about “selfsigned certs” in this context, but it’s unpossible, that this problem has anything to do with “selfsigned certs”, because I do not have any “selfsigned certs”.
I only have a letsencrypt cert, which is used by the outer nginx reverse proxy.
The nextcloud DOES NOT KNOW ANYTHING about this SSL.
I still think, js/mjs HAS NOTHING TO DO with ssl encryption, because NO OTHER FILE TYPE has this or even a similar problem.
And…
… I do not understand this solution. What do I have to change in my nginx conf? (see above!)
Please help me to get rid of this anyoing warning!? 
