I have installed Nextcloud using docker following this example:
I have an existing instance of Nginx I am already using reverse proxy other applications. I am trying to set it to reverse proxy the docker Nextcloud install. When I check the “Security & setup warnings” I have the following:
• The reverse proxy header configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If not, this is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud. Further information can be found in the documentation.
• The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
• The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
I have tried a few things but I can’t seem to resolve them, any suggestions? Also, I am still just testing the installation of Nextcloud, so I am fine blowing it away and staring again.
Thank you,
Here is my Nginx config:
server {
server_name domain.tld;
client_max_body_size 10G;
# security headers
add_header X-Frame-Options SAMEORIGIN;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Strict-Transport-Security "max-age=63072000" always;
# . files
location ~ /\.(?!well-known) {
deny all;
}
# favicon.ico
location = /favicon.ico {
log_not_found off;
access_log off;
}
# robots.txt
location = /robots.txt {
log_not_found off;
access_log off;
}
# gzip
gzip on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;
# reverse proxies
location / {
proxy_pass http://192.168.0.16:8080;
proxy_http_version 1.1;
proxy_cache_bypass $http_upgrade;
proxy_request_buffering off;
# Proxy headers
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
# Proxy timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
location /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = domain.tld) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name domain.tld;
return 404; # managed by Certbot
}
And my config.php:
<?php
$CONFIG = array (
'htaccess.RewriteBase' => '/',
'memcache.local' => '\\OC\\Memcache\\APCu',
'apps_paths' =>
array (
0 =>
array (
'path' => '/var/www/html/apps',
'url' => '/apps',
'writable' => false,
),
1 =>
array (
'path' => '/var/www/html/custom_apps',
'url' => '/custom_apps',
'writable' => true,
),
),
'instanceid' => 'ocm5bdhufslw',
'passwordsalt' => 'J2tzB1IyXYQNzPTAQ/lg0ZO6hEPQCH',
'secret' => 'hSxQkuBFSgPT/H4zlV3MOFlEyQMUG4lYAlhpzpOdoqwr9EbC',
'trusted_domains' =>
array (
0 => '192.168.0.16:8080',
1 => 'domain.tld',
),
'datadirectory' => '/var/www/html/data',
'dbtype' => 'mysql',
'version' => '20.0.2.2',
'overwrite.cli.url' => 'http://192.168.0.16:8080',
'dbname' => 'nextcloud',
'dbhost' => 'db',
'dbport' => '',
'dbtableprefix' => 'oc_',
'mysql.utf8mb4' => true,
'dbuser' => 'nextcloud',
'dbpassword' => 'xUDAPByJaR6ajP4D',
'installed' => true,
);
