Mac non-https connectivity seems to have been disabled.
For my local machines, i.e. those behind the router, there is no SSL certificate. Setting up a local/intranet certificate is a mess I don’t want to get into.
My local systems have not synced for nearly two weeks.
Now I’m reduced to using the web interface.
The lack of automatic sync has rendered Nextcloud unusable.
Hello, have you edited your web server’s cert configuration, Nextclound conf and cleared the client cache? We run Apache on our test lab so:
etc/apache2/sites-enabled/nextcloud_tls_domain_self_signed.conf
Then comment out the HSTS portion:
Header add Strict-Transport-Security: “max-age=15552000;includeSubdomains”
Disable SSL in the Nextcloud conf:
'overwriteprotocol' => 'http',
'enforce_ssl' => false,
'guzzle.plugins.hsts' => false,
'overwrite.cli.url' => 'http://YOUR.IP.HERE',
Then don’t forget to edit the MacOS client’s cache (delete), edit the .ini & then restart the client:
DELETE CACHE
Cmd+Shift+G go to: ~/Library/Caches/
Delete the Nextcloud cache file (make sure show hidden files is enabled Cmd+Shift+.)
EDIT DESKTOP CLIENT CONFIG
nano ~/Library/Preferences/Nextcloud/nextcloud.cfg
[General]
allowLocalHttp=true
My FreeBSD server is running nginx. As I mentioned I don’t want to mess with internal self-signed certs, as it opens up a whole can of worms with DNS on both the server and the client machines.
I would prefer not to disable https for external connections, only internal ones.
I don’t see a nextcloud.cfg file anywhere on the Macs (neither do I see a Nextcloud folder under Preferences). I moved over from ownCloud years ago, its config file is still in the ~/Library/Preferences folder but it doesn’t reflect the current settings.
If you access NC from external as well I assume you have a properly signed SSL cert installed?
Why do you want to force your clients to use non-ssl connection?
Yes, I have a proper certbot cert for the outside world.
My internal clients cannot resolve my external address, i.e. I have to use the internal IP address, rather the domain name or the external IP address.
using different DNS/ip locally is bad idea.
I recommend 101: Split-Brain DNS (split-horizon) this also eliminates the need of local plain http or handling of self-signed certificates.
That’s exactly what I was trying to avoid: multiple name servers!
The router isn’t an option, as it is hardware provided by the ISP. No way of modifying the routing tables.
My FreeBSD server has an instance of local_unbound running, but that doesn’t accept queries from the LAN, only loopback, and I’d rather not switch to the regular unbound package.
I’ll see if I can configure unbound on one of the Macs.
I’ve got unbound running on a Mac workstation, and properly resolving the local server address from the full domain name. But now I get an error while connecting using https: It is asking me for a SSL certificate, i.e. pkcs12 bundle “This server probably requires a SSL client certificate”. Where do I find this? Do I need to generate this or can I use an existing file? All the cert files on the server are .pem files.
It turns out that I had a stale entry in /etc/hosts. No name server required!
Now I have the situation that I’m logged in on the web browser, using https and the domain name, while the NextCloud client refuses to connect. The error is
I cannot get anything using the copy link button, i.e. nothing is copied into the clipboard. Open browser returns to the dialog after a second without doing anything.
OK. I managed to get logged in with the client! A non-ascii character had slipped into the directory name!
Now more computers to update!
