Https open my other site

grzesiek811 · February 24, 2021, 9:56am

I have a problem with nextcloud with https domain. My domain http works fine, but when I’m triyng open with https then redirect to my other site (Wordpress blog).
I have VPS with Virtualmin panel and four sites, two Wordpress, one Drupal and one Joomla.
I follow bellow guide:

Acces with http work fine, but when I try acces with https, then redirect to my wordpress site.
My nextcloud-le-sll.conf:

<IfModule mod_ssl.c>
SSLStaplingCache shmcb:/var/run/apache2/stapling_cache(128000)
<VirtualHost *:443>
DocumentRoot /var/www/nextcloud/
ServerName files.com
ServerAlias www.files.com
ErrorLog ${APACHE_LOG_DIR}/nextcloud.error
CustomLog ${APACHE_LOG_DIR}/nextcloud.access combined
<Directory /var/www/nextcloud/>
Require all granted
Options FollowSymlinks MultiViews
AllowOverride All
<IfModule mod_dav.c>
Dav off
</IfModule>
SetEnv HOME /var/www/nextcloud/
SetEnv HTTP_HOME /var/www/nextcloud/
Satisfy Any

Include /etc/letsencrypt/options-ssl-apache.conf
SSLUseStapling on
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCertificateFile /etc/letsencrypt/live/pliki.cf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/pliki.cf/privkey.pem
Header always set Strict-Transport-Security “max-age=31536000”

<VirtualHost *:80>
DocumentRoot /var/www/nextcloud/
ServerName files.com
ServerAlias www.files.com
ErrorLog ${APACHE_LOG_DIR}/nextcloud.error
CustomLog ${APACHE_LOG_DIR}/nextcloud.access combined
<Directory /var/www/nextcloud/>
Require all granted
Options FollowSymlinks MultiViews
AllowOverride All

Dav off

SetEnv HOME /var/www/nextcloud/
SetEnv HTTP_HOME /var/www/nextcloud/
Satisfy Any

#RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteCond %{SERVER_NAME} =pliki.cf
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

bb77 · February 24, 2021, 10:51am

If you enter an url in the browser it connects to the first virtualhost with a matching ServerName directive or if there is no matching ServerName directive, it connects to the first virtual host in sites-enabled.

I would use diffrent subdomains, if more than one service is running on one server, e.g. cloud.yourdomain.com, blog.yourdomain.com etc… otherwise you have to run things in subdirectories of the main site, wich I would not recommend. Or you could use diffrent domain names for each virtualhost of course. Either way, every virtualhost must contain a unique ServerName with a matching A or CNAME Record pointed to it. And if you want to enforce the use of https, every virtualhost has to redirect to a matching virtualhost wich then provides the ssl config.

Hope that helps.

grzesiek811 · February 24, 2021, 1:25pm

There are different domain name, for exaple files.com for nextcloud and blog.com for wordpress.
Both are on common VPS with one IP.
How to best redirect domain? Both domain with A record to server IP?

I have te same ServerName and ServerAlias for nextcloud virtualhost port 80 and 443, but http protocol works while https doesn’t work.

When I create new domain with Virtualhost and put nextcloud in public_html folder then nextcloud works with http and https, but it doesn’t works in /var/www/nextcloud

Is my nextcloud-le-ssl.conf file correct?

bb77 · February 24, 2021, 3:52pm

First of all I would split it into two sperated files. This is not mandatory but it makes it a lot easier to manage, imho.
I also noticed that you are using a www subdomain as a server alias. For the subdomain you need a seperate DNS-record.
you need a proper rewrite directive for both files.com and www.files.com if you want to be able to use both. Currently there is only the one for files.com present, and it is commented out.

Here is my recommendation for the two files:

nextcloud.conf:

<VirtualHost *:80>
ServerName files.com

ErrorLog ${APACHE_LOG_DIR}/nextcloud.error
CustomLog ${APACHE_LOG_DIR}/nextcloud.access combined

RewriteEngine on
RewriteCond %{SERVER_NAME} =files.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

nextcloud-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
DocumentRoot /var/www/nextcloud/

ErrorLog ${APACHE_LOG_DIR}/nextcloud.error
CustomLog ${APACHE_LOG_DIR}/nextcloud.access combined

<Directory /var/www/nextcloud/>
Require all granted
Options FollowSymlinks MultiViews
AllowOverride All

<IfModule mod_dav.c>
Dav off
</IfModule>

SetEnv HOME /var/www/nextcloud/
SetEnv HTTP_HOME /var/www/nextcloud/
</Directory>

<IfModule mod_headers.c>
Header always set Strict-Transport-Security “max-age=31536000”
</IfModule>

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/pliki.cf/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/pliki.cf/privkey.pem
</VirtualHost>
</IfModule>

If you can’t get it to work.

Copy the current content of all relevant config files to a file on your pc or do backups on the server.
Disable nextcloud.conf and nextcloud-le-ssl.conf, delete the files and restart apache.
Create an emty nextcloud.conf.
Add only this very basic config to it:

<VirtualHost *:80>
ServerName files.com

ErrorLog ${APACHE_LOG_DIR}/nextcloud.error
CustomLog ${APACHE_LOG_DIR}/nextcloud.access combined
</VirtualHost>

If you absolutely need the www subdomain, add the ServerAlias too. (DNS record has to be active)
Enable the nextcloud.conf and get the certificates for it. If you use certbot, it should automaticly add the correct https rewrite directives to the nextcloud.conf file, generate a nextcloud-le-ssl.conf file and enable it.
Add the missing lines from my example to the nextcloud-le-ssl.conf and restart apache.
If you still have problems with some sites, do the same thing for all of them.

Hope that helps

grzesiek811 · February 25, 2021, 6:37am

Still doesn’t works, and I get warning from browser:
This server cannot prove that it is a files.com file; its security certificate is from blog.com. This could be due to a misconfiguration or an attacker intercepting your connection.

bb77 · February 25, 2021, 7:02am

If I were you I would start over. Like I wrote in my first post… Disable all virtaul hosts like this a2dissite nextcloud-le-ssl.conf etc… and recreate one after another. Try to get one site up and running first and only then go to the next one…

Disable the apache default virtuialhosts, if you not allready have.

Create a minimal config like in my example, get the certificates with certbot for it, choose the option for automatic redirect when it asks and after that make the necessary changes in the associated *-le-ssl.config file, which is automatically created by certboot.

Make sure every application resides in it’s own directory e.g. /var/www/files, /var/www/blog etc… and adjust the DocumentRoot directive accordingly.

Make sure all necessary apache modules are enabled

Other than that I can only say… keep tryin’!

Good luck.

grzesiek811 · February 25, 2021, 12:52pm

Voilà. When I’ve disabled all virtual hosts then nexcloud started to work with SSL.
Virtual hosts created by Virtualmin block my nextcloud. How to solve this?

Bellow is virtualhost file for my site:

bb77 · February 25, 2021, 3:15pm

Hmm, I never used Virtualmin. Is your site running in a diffrent virtual machine than nextcloud on the same host, or is Nextcloud running on the host and your site in a vm on that host?

or asked another way…

Is your blog and nextcloud running on two diffrent apache instances on two diffrent servers or VMs, wich each has a diffrent IP-address? If yes, are both of these IP-addresses public or are they behind a router/NAT and share the same public IP-address?

grzesiek811 · February 25, 2021, 8:44pm

Both, Wordpress and nextcloud is on the same machine. It is VPS with one IP adress.

bb77 · February 26, 2021, 6:39am

I noticed that you added an ip address to your second virtualhost on the config file you posted. Normally this is only necessary if your server has more than one network interface or ip address and you want to assign a virtual host explicitly to a certain interface. But to be honest, I have no idea whether that is causing the problems.

Other than that, I would double-check all ServerName Directives, ServerAlias Directives and their associated DNS records. Make sure that the DocumentRoot Directives points to the correct directory. There may also be something in the main apache config file that prevents everything from working correctly. Other than that, I’m running out of ideas …