Hi,
I have some problem to install NextCloud AIO behind a reverse proxy (nginx) with docker network managed and multiple docker-compose projets.
I’ve followed this documentation : all-in-one/reverse-proxy.md at main · nextcloud/all-in-one · GitHub
- First my setup without NextCloud:
The docker-compose of my reverse proxy with a certbot for (sub)domain https certificates:
version: '3.9'
services:
reverseProxy:
container_name: reverseProxy
image: nginx:latest
restart: always
volumes:
- ./nginx.conf/:/etc/nginx/conf.d/:ro
- ./certbot.conf/:/etc/letsencrypt/:ro
- ./certbot.www/:/var/www/certbot/:ro
ports:
- 80:80
- 443:443
networks:
- frontend
certbot:
image: certbot/certbot:latest
container_name: certbot
volumes:
- ./certbot.conf/:/etc/letsencrypt/:rw
- ./certbot.www/:/var/www/certbot/:rw
depends_on:
- reverseProxy
networks:
- frontend
networks:
frontend:
external: true
Beside the reverse proxy I have others docker-compose apps distributed int frontend and backend docker networks. Both network use the internal Docker DNS resolver to resolve IP by container_name
Here is also my Nginx config file:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name <domain.net> <www.domain.net> ... <sub.domain.net> ;
server_tokens off;
location / {
return 301 https://$host$request_uri;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
}
server {
server_name <sub.domain.net>;
listen 443 ssl http2;
listen [::]:443 ssl http2;
<config for internal server proxy passed>
}
.
.
.
- NextCloud AIO configs:
So now I’m trying to add NextCloud AIO as anoter app to my config.
NextCloud AIO docker-compose:
services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
- /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
ports:
- 8080:8080
environment: # Is needed when using any of the options below
- APACHE_PORT=11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- APACHE_IP_BINDING=0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- NEXTCLOUD_DATADIR=/mnt/ncdata # Allows to set the host directory for Nextcloud's datadir. ⚠️⚠️⚠️ Warning: do not set or adjust this value after the initial Nextcloud installation is done! See https://github.com/nextcloud/all-in-one#how-to-change-the-default-location-of-nextclouds-datadir
networks:
- nextcloud-aio
- frontend
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line is not allowed to be changed as otherwise the built-in backup solution will not work
networks:
nextcloud-aio:
name: nextcloud-aio # This line is not allowed to be changed as otherwise the created network will not be used by the other containers of AIO
driver: bridge
frontend:
external: true
the reverse proxy with NextCloud proxy pass:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name <domain.net> <www.domain.net> ... <sub.domain.net> ;
server_tokens off;
location / {
return 301 https://$host$request_uri;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
}
server {
...
}
server {
server_name <nextcloud.domain.net>;
server_tokens off;
# SSL Certificate
ssl_certificate /etc/letsencrypt/live/<nextcloud.domain.net>/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/<nextcloud.domain.net>/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /etc/letsencrypt/live/<nextcloud.domain.net>/chain.pem;
# HTTPS Common Parameters + Mozilla's best practices config file for HTTPS
include /etc/letsencrypt/ssl-config.mozilla.org.conf;
# NextCloud AIO config
http2 on; # uncomment to enable HTTP/2 - supported on nginx v1.25.1+
http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+
listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport
listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6
location / {
proxy_pass http://nextcloud-aio-mastercontainer:11000$request_uri;
# NextCloud AIO recommanded proxy config
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_set_header Host $host;
client_body_buffer_size 512k;
proxy_read_timeout 86400s;
client_max_body_size 0;
# Websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}
SSL Common config (ssl-config.mozilla.org.conf)
# generated 2023-08-25, Mozilla Guideline v5.7, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.7
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
# set Docker internal DNS as DNS resolver
resolver 127.0.0.11 valid=10s;
resolver_timeout 5s;
- First init
With this config I can connect to the initial setup but I get this error message when submit my domain
Domain does not point to this server or the reverse proxy is not configured correctly. See the mastercontainer logs for more details. (‘sudo docker logs -f nextcloud-aio-mastercontainer’)
And the log result:
xxxx@YYYYY:/Docker$ sudo docker logs -f nextcloud-aio-mastercontainer
Trying to fix docker.sock permissions internally...
Creating docker group internally with id 134
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
Storage Driver: vfs
Warning: It seems like the storage driver vfs is used. This will lead to problems with disk space and performance and is disrecommended!
..+.+.....+.+++++++++++<lot of . and +>++++++++++......+.+++++
-----
Initial startup of Nextcloud All-in-One complete!
You should be able to open the Nextcloud AIO Interface now on port 8080 of this server!
E.g. https://internal.ip.of.this.server:8080
If your server has port 80 and 8443 open and you point a domain to your server, you can get a valid certificate automatically by opening the Nextcloud AIO Interface via:
https://your-domain-that-points-to-this-server.tld:8443
[Tue Aug 29 22:13:24 2023] PHP 8.2.8 Development Server (http://127.0.0.1:9876) started
{"level":"info","ts":1693347204.0887535,"msg":"using provided configuration","config_file":"/Caddyfile","config_adapter":""}
[Tue Aug 29 22:13:24.090565 2023] [mpm_event:notice] [pid 114:tid 139720481213256] AH00489: Apache/2.4.57 (Unix) OpenSSL/3.1.2 configured -- resuming normal operations
[Tue Aug 29 22:13:24.090950 2023] [core:notice] [pid 114:tid 139720481213256] AH00094: Command line: 'httpd -D FOREGROUND'
[29-Aug-2023 22:13:24] NOTICE: fpm is running, pid 120
[29-Aug-2023 22:13:24] NOTICE: ready to handle connections
</html>nter>nginx</center>y</h1></center>d>nnection attempt to "https://<nextcloud.domain.net>:443" was: <html>
NOTICE: PHP message: Expected was: ad26c03670c48a573e906df480b739b136cca0522ba071ee
NOTICE: PHP message: The error message was:
Am I missing some point(s) ?