Nextcloud AIO and NGINX reverse proxy installation – Bad Gateway

ℹ️ Support 📦 Appliances (Docker, Snappy, VM, NCP, AIO)
, , ,
1

Nextcloud AIO and NGINX reverse proxy installation – Bad Gateway

Hi everybody,
I have installed Nextcloud AIO on Ubuntu 24.04 LTS Base using docker container with a compose file. As a reverse proxy I installed Nginx 1.24.0 with " apt install nginx " on Ubuntu and not as a container.

docker-compose.yml file:

version: '3.8' 


services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    init: true
    restart: always
    container_name: nextcloud-aio-mastercontainer
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config 
      - /var/run/docker.sock:/var/run/docker.sock
      
    networks:
      - nextcloud_network
    ports:
      - 8080:8080
       environment: 
       APACHE_PORT: 11000 
       APACHE_IP_BINDING: 127.0.0.1 
       TALK_PORT: 3478 
       SKIP_DOMAIN_VALIDATION: false
       
networks:
  nextcloud_network:
    driver: bridge

      
volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

And my Nginx file:

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;           

    if ($scheme = "http") {
        return 301 https://$host$request_uri;
    }
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }

    listen 443 ssl http2;      
    listen [::]:443 ssl http2;
    
        
    proxy_buffering off;
    proxy_request_buffering off;

    client_max_body_size 0;
    client_body_buffer_size 512k;
    proxy_read_timeout 86400s;

    server_name nextcloud.example.com;

    location / {
        proxy_pass http://127.0.0.1:11000$request_uri; 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Early-Data $ssl_early_data;

        # Websocket
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    
    ssl_certificate /etc/letsencrypt/live/nextcloud.example.com/fullchain.pem;   # managed by certbot on host machine
    ssl_certificate_key /etc/letsencrypt/live/nextcloud.example.com/privkey.pem; # managed by certbot on host machine

    
    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve x25519:x448:secp521r1:secp384r1:secp256r1;

    ssl_prefer_server_ciphers on;
    ssl_conf_command Options PrioritizeChaCha;
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
}

I think I did anything according to instructions, but I give Bad Gateway, if I will open https://nextcloud.example.com in browser.

The output of netstat -tulpn:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      629909/docker-proxy
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      626575/nginx: maste
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      626575/nginx: maste
tcp        0      0 127.0.0.54:53           0.0.0.0:*               LISTEN      11791/systemd-resol
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      11791/systemd-resol
tcp6       0      0 :::8080                 :::*                    LISTEN      629917/docker-proxy
tcp6       0      0 :::80                   :::*                    LISTEN      626575/nginx: maste
tcp6       0      0 :::443                  :::*                    LISTEN      626575/nginx: maste
udp        0      0 127.0.0.54:53           0.0.0.0:*                           11791/systemd-resol
udp        0      0 127.0.0.53:53           0.0.0.0:*                           11791/systemd-resol

Summary

  • Operating system and version
    • Ubuntu 24.04
  • Nextcloud Server
    • Nexctcloud AIO
  • Reverse proxy and version
    • 1.24.0
  • Installation method
    • AIO using docker compose
  • Firewall
    • All needed ports on server and Ubuntu are open

Summary of the issue:

Bad Gateway

Log entries

Web server / Reverse Proxy

The output of nginx log in /var/log/____:

[error] 626577#626577: *28 connect() failed (111: Connection refused) while connecting to upstream, client: xx.xx.xx.xx, server: nextcloud.example.com, request: "GET /robots.txt HTTP/1.1", upstream: "http://127.0.0.1:11000/robots.txt", host: "yy.yy.yy.yy"

I’m pretty new to this field, so I’d really appreciate any help you could give me.

3

Thank you for replay!
I did it, but I got the same result.

5

I looked at the default config offered for AIO and it’s really there:
proxy_pass http://127.0.0.1:11000$request_uri;

I’ll assume that the container with APACHE did not start.

If all containers are started correctly, the output: netstat -tulpn should contain port 11000

6

I thought about it, but I didn’t find any other configuration for Apache container or how you can start apache after running AIO container in official documents.
As I wrote here, I’m new in this field :wink: and I don’t know how can I start it separately, if it should be done.
It would be great if you have comment for it.

7

The apache container should start automatically as soon as you log into the AIO interface. See step 4 here: all-in-one/reverse-proxy.md at main · nextcloud/all-in-one · GitHub

Also see all-in-one/reverse-proxy.md at main · nextcloud/all-in-one · GitHub

8

Hi Szaimen,

Thank you for your reply! And thank you for your posts (they could help me as beginner).
I’ve read all your posts in github and as you recomannded I installed at first Caddy as reverse proxy server, but I faced an issue and checked your post here:Caddy Docker Compose Example · nextcloud/all-in-one · Discussion #575 · GitHub
Unfortunately I was not able to open nextcloud.
Hence I decieded to check it with Nginx and again faced “Bad Gateway”.
I checked it with IP and port, but it will be refused, because nginix will only listen to 443 (or 80).
My main purpose is that, I would install Gitlab and Nextcloud in this server using Docker Compose. Obviously I need a revers proxy for this.
AIO without reverse proxy was working fine. A connection between reverse proxy and container will be dropped (I don’t know whay), but I’m sure I’m configuring anything wrong or need more configuration.

As a history, I installed Gitlab and Nextcloud (not AIO) on this server with Nginx and they were working fine, except Talk. I tried to install TURN Server, but I could not make it.
Hence I decided to install an All-In-One solution. But again same problem:No connection between Nginx and Container.
This Ubuntu is installed newly.
I can send you more logs and configuration, if it’s needed.
Thank you in advance.

9

Tell me, after the initial launch of containers, did you go to the address: IP of your server:8080
for the initial setup of the instance?
Port 11000 for Apache is raised only after the initial setup. Perhaps this is the problem.

10

No, after the initial launch of container, I tried open set up page with https://server.ip.address:8080 to begin the setup, but I got Bad Gateway. Nginx is configured to listen 443 and it was normal that I could not open initial set up.
https://domain was not working.
I see other posts, under which Szaimen is written, are working with this configuration and didn’t face Bad Gateway like my case. It’s very peculiar.

11

nginx is not involved at this stage, it needs to be opened by IP address and port 8080

1 Like
12

I checked it again in private mode of firefox (checked with other browsers too) and I get after all: Unable to connect

13

in your output the container is listening on port 8080.
Everything turned out to be simpler, you need to type in the address bar https://ip:8080 the browser will complain about the wrong certificate and everything will work.

14

Hi,
you can check my topic about Nextcloud AIO + Nginx Proxy server setting (as selfhosted solution).
You can find there:

  • my docker-compose.yml file
  • screenshots how to set up subdomain/domain in NGINX Proxy server

Feel free to contact me for other details.

15

image
image1126×743 18.5 KB

16

Sorry, I ran out of options, I installed a fresh copy of Ubuntu 24.04 on a VM and then, following the instructions, everything started up the first time.

image
image1300×747 77.2 KB

1 Like
17

Thank you vawaver for your post!
My config is same as your config, except you used Nginix manager and I’m using Nginx.
From videos in your post, I noticed that I should set up initial set up of nextcloud and then go through the configuring nginx.
I will chech it and update this post.

1 Like
18

I uninstalled nginx und tried to reach initial set up page, it was not accessible and I got the same message.
To isolate my problem I installed a Ubuntu again and configured the compose file, as @szaimen explaind. No nginx or other proxy or webserver are installed, but I can not open this page through server’s public ip. The server is hosted in internet and my Ubunto has no graohical environment, hence I can not reach it locally and I should use public IP of server.
Firewall on server and Ubuntu are open and Container are listening 8080 (via docker-proxy process,).
Output of “docker logs nextcloud-aio-mastercontainer”:

Trying to fix docker.sock permissions internally...
Creating docker group internally with id 988
Could not reach https://auth.docker.io.
Most likely is something blocking access to it.
You should be able to fix this by using https://github.com/nextcloud/all-in-one/tree/main/manual-install
Could not reach https://auth.docker.io.
Most likely is something blocking access to it.
You should be able to fix this by using https://github.com/nextcloud/all-in-one/tree/main/manual-install
Could not reach https://auth.docker.io.
Most likely is something blocking access to it.
You should be able to fix this by using https://github.com/nextcloud/all-in-one/tree/main/manual-install

Would you have any idea, what did I do wrong?

19

Hi Simon @szaimen,
I checked it withot compose file and installed it to the fresh Ubuntu 24.04 acording to the instraction, but the https://ip:8080 was not reachable.
I think it can be a bug. Unfortunately I could not install aio ver. 10.1.0 (which I installed on dec. and it was working fine) to check it on same server, if the last version has a bug.
Ich will check it with a base version.

20

It took me awhile to get everything including nginx working with Docker but chat gippity and I eventually got it all going. I’m running nginx in a container if my memory serves correctly. I also created plenty of certs for everything and made sure my dns had entries for everything. If you’d like my yaml I’d be happy to share. It may reveal something.

21

thanks for your kind reply and the offer!
The problem is without nginx I could not open https://ip:8080/. In this phase, we don’t need certs. I checked it on a new fresh linux with docker, but no answer.
Yes, it would be great to have your config.
Best,

22

Here is my config. Just to note, I remember struggling with getting browsers to connect over https because of things like missing common name in the certificate. Today’s browsers will refuse to connect over plain http for the most part with only something like Firefox allowing you to turn that off. And, of course, you may have to consider the relationship between your DNS / hostname and the name of your SSL (TLS) certificate as well as the full trust chain of the certificate if you are using self-signed certs. I’m sure you know this but wanted to mention it.

Hope this helps you.

version: ‘3’

services:
db:
image: mariadb:10.6
restart: always
command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
volumes:
- /media/HGST4TB/nextcloud/db:/var/lib/mysql
environment:
- MYSQL_ROOT_PASSWORD=whatever
- MYSQL_PASSWORD=whatever2
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud

redis:
container_name: nextcloud-redis
image: redis:alpine
restart: always
volumes:
- rediscache:/data

app:
image: nextcloud:apache
container_name: nextcloud_app
restart: always
volumes:
- /media/HGST4TB/nextcloud/app_data:/var/www/html/data
- /media/HGST4TB/nextcloud/app_html:/var/www/html
- /media/HGST4TB/nextcloud/certs:/usr/local/share/ca-certificates
#entrypoint: /usr/local/bin/start-nextcloud.sh
environment:
- VIRTUAL_HOST=mynextcloud.samdom.myhouse.lan
- MYSQL_PASSWORD=whatever
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nextcloud
- MYSQL_HOST=db
- REDIS_HOST=redis
- PHP_UPLOAD_MAX_FILESIZE=2G
- PHP_UPLOAD_LIMIT=2G
- PHP_POST_MAX_SIZE=2G
- PHP_MEMORY_LIMIT=6G
depends_on:
- db
- redis
networks:
- proxy-tier
- default

#2do- Add cron

proxy:
image: jwilder/nginx-proxy
container_name: proxy
restart: always
ports:
- 80:80
- 443:443
environment:
- DEFAULT_HOST=default.samdom.myhouse.lan
volumes:
- /media/HGST4TB/nextcloud/certs:/etc/nginx/certs:z,ro
- /media/HGST4TB/nextcloud/vhost.d:/etc/nginx/vhost.d:z
- /media/HGST4TB/nextcloud/proxy_html:/usr/share/nginx/html:z
- /var/run/docker.sock:/tmp/docker.sock:z,ro
- ./nginx.tmpl:/etc/nginx/conf.d/nginx.tmpl:ro
networks:
- proxy-tier

#2do investigate omgwtfssl

volumes:
app_data:
db:
certs:
vhost.d:
app_html:
proxy_html:
rediscache:
nginx.tmpl:

networks:
proxy-tier:

1 Like