http security warning for nextcloud running in a docker container

ℹ️ Support
, ,
1

Clean build of nextcloud (Hub 10 - 31.0.4) on docker using a portainer stack and traefik (3.3.6) reverse proxy

Docker

  # Nextcloud
  nextcloud:
    image: nextcloud:production-apache
    container_name: nextcloud
    networks:
      t2_proxy:
    ports:
      - "8120:80"
    volumes:
      - /appdata/nexcloud/html:/var/www/html
      - /appdata/nexcloud/custom_apps:/var/www/html/custom_apps
      - /appdata/nexcloud/html/config:/var/www/html/config
      - /media/vol666/ncloud:/var/www/html/data
    environment:
      - MYSQL_PASSWORD_FILE=nc_db_password
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=ncdb
    secrets:
      - nc_db_password

I’ve got traefik running as a reverse proxy and in the yaml i’ve set

routers:
  ncloud-rtr:
    rule: "Host(`fondling.goat-lovers.org`)" #only the brave will visit this
    entryPoints:
      - https
    middlewares:
      - chain-nextcloud
    service: ncloud-svc
services:
  ncloud-svc:
    loadbalancer:
      servers:
        - url: "http://192.168.1.22:8120"

I can access my nextcloud via my browser and using https BUT I get the error below in the Security & Setup Warnings, probably because the container is using port 80

Accessing site insecurely via HTTP. You are strongly advised to set up your server to require HTTPS instead.
Without it some important web functionality like “copy to clipboard” or “service workers” will not work!
For more details see the documentation.

I’ve checked the apache config on the running container, tried changing the port in the docker config from 80 to 443 and then updating the traefik service but that makes the containers web service inaccessible.

Can anyone give me any guidance on clearing this issue?

2

Hello @DarkD67, welcome to the Nextcloud community! :handshake:
please review 101: reverse proxy

3

I’ve gone through the articles on reverse proxy and hardening plus a number of articles on here and tweaked my config.php

  'trusted_proxies' => array ('192.168.1.254',),
  'overwritehost' => 'rprox.goat-fondlers.com',
  'overwriteprotocol' => 'https',
  'overwritecondaddr' => '^192\\.168\\.1\\.254$',
  'overwrite.cli.url' => 'https://cl1.goat-fondlers.com/',
  'trusted_headers' =>
  array (
    'X-Forwarded-For',
    'X-Forwarded-Host',
    'X-Forwarded-Proto',
  ),

I still can’t get rid of the http error or get the docker container to play nicely as https.

5

this one is usually wrong…

IMO traefik uses X-Real-Ip - look at the logs