# Nextcloud AIO Talk behind Caddy v2 proxy on OPNSense **URL:** \ **Category:** ℹ️ Support\ **Tags:** caddy, talk-hpb, nc32, docker, aio, dns, postgresql\ **Created:** [October 5, 2025, 9:35pm UTC](https://help.nextcloud.com/t/nextcloud-aio-talk-behind-caddy-v2-proxy-on-opnsense/233547 "2025-10-05T21:35:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![programy\_p](https://help.nextcloud.com/letter_avatar/programy_p/32/5_5575768a8748004e209b776fc1b2916d.png) [@programy\_p](https://help.nextcloud.com/u/programy_p)\ **Post date:** [October 5, 2025, 9:35pm UTC](https://help.nextcloud.com/t/nextcloud-aio-talk-behind-caddy-v2-proxy-on-opnsense/233547/1 "2025-10-05T21:35:22Z")
> **Support intro** > > ## Sorry to hear you’re facing problems. 🙁 > > _The community help forum ([help.nextcloud.com](http://help.nextcloud.com)) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are **volunteering their time to help you.** _ > > **If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via [portal.nextcloud.com](http://portal.nextcloud.com) where Nextcloud engineers can help ensure your business keeps running smoothly.** > > ## Getting help > > In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can. > > **Before clicking submit** : Please check if your query is already addressed via the following resources: > > - [Official documentation](https://docs.nextcloud.com) (searchable and regularly updated) > - [How to topics and FAQs](https://help.nextcloud.com/c/how-to-faqs/9) > - [Forum search](https://help.nextcloud.com/search) > > (Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly). Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. ❤ ## The Basics - Nextcloud Server version _(e.g., 29.x.x)_: - Operating system and version _(e.g., Ubuntu 24.04)_: - Web server and version _(e.g, Apache 2.4.25)_: - Reverse proxy and version \_(e.g. nginx 1.27.2) - PHP version _(e.g, 8.3)_: - Is this the first time you’ve seen this error? (Yes / No): - When did this problem seem to first start? - Installation method _(e.g. AlO, NCP, Bare Metal/Archive, etc.)_ ### Summary of the issue you are facing: NC is on server B behind Caddy Proxy Server on OPNSense on server A. Caddy is configured to proxy my domain to internal NC server B on port 11000 as in manual. Port 3478 for Talk is forwarded on OPNSense to NC server, and is open for outgoing traffic as suggested in manual. NC seems to work AIO master container shows all green, even for Talk. But when I logon to NC, and show Talk config in GUI I got Error: Websocket connection failed, Error code invalid\_token and Error message The passed token is invalid. Caddy settings ```auto cloud.com { handle { reverse_proxy 192.168.1.13:11000 { transport http { versions 1.1 } } } } ``` and with extended config as on forum posts and suggestions in manual ```auto cloud.com { handle { reverse_proxy 192.168.1.13:11000 { header_up Host {host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Host {host} header_up X-Forwarded-Proto {scheme} header_up X-Real-IP {remote_host} transport http { versions 1.1 } } } } ``` And even more extended with Websocket ```auto cloud.com { handle { reverse_proxy 192.168.1.13:11000 { header_up Connection "Upgrade" header_up Host {host} header_up Upgrade "websocket" header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Host {host} header_up X-Forwarded-Proto {scheme} header_up X-Real-IP {remote_host} transport http { versions 1.1 } } } } ``` and base Nextcloud AIO compose file: services: nextcloud-aio-mastercontainer: image: nextcloud/all-in-one:latest init: true restart: always container\_name: nextcloud-aio-mastercontainer volumes: - nextcloud\_aio\_mastercontainer:/mnt/docker-aio-config - /var/run/docker.sock:/var/run/docker.sock:ro network\_mode: bridge ports: - 192.168.1.13:11443:8080 #to jest port HTTPS:// dns: #własne koncept na dodanie DNS do konfiguracji - 192.168.1.1 environment: # Is needed when using any of the options below AIO\_DISABLE\_BACKUP\_SECTION: true APACHE\_PORT: 11000 APACHE\_IP\_BINDING: 192.168.1.13 NEXTCLOUD\_DATADIR: /DOCKER/nextcloud-aio-mastercontainer/data/ NEXTCLOUD\_UPLOAD\_LIMIT: 16G NEXTCLOUD\_MAX\_TIME: 3600 NEXTCLOUD\_MEMORY\_LIMIT: 4096M NEXTCLOUD\_ENABLE\_DRI\_DEVICE: true TALK\_PORT: 3478 NEXTCLOUD\_TALK\_RELAY\_IPV4\_ADDR: 192.168.1.13 volumes: nextcloud\_aio\_mastercontainer: name: nextcloud\_aio\_mastercontainer So I can’t get any Talk connections at all, but websocket seems to work. Tested DNS resolution in all nextcloud AIO containers and it works everywhere except Talk container, that gives such log data: ```auto ``` client.go:352: Client from 192.168.1.20 has RTT of 5 ms (5.823792ms) capabilities.go:128: Capabilities expired for [Mission Critical Enterprise Software - Cloud Software Group](https://cloud.com/ocs/v2.php/cloud/capabilities), updating capabilities.go:369: Could not get capabilities for [Mission Critical Enterprise Software - Cloud Software Group](https://cloud.com/:) Get “[Mission Critical Enterprise Software - Cloud Software Group](https://cloud.com/ocs/v2.php/cloud/capabilities)”: dial tcp: lookup [cloud.com](http://cloud.com) on [::1]:53: read udp [::1]:40083-\>[::1]:53: read: connection refused while command docker exec -it nextcloud-aio-talk cat /etc/resolv.conf gives output can’t open ‘/etc/resolv.conf’: Permission denied seems like talk cant use DNS properly, but nextcloud AIO sets everything automaticly ### Steps to replicate it (hint: details matter!): 1. Install Nextcloud AIO in Docker on OpenMediaVault via compose 2. Login to NC 3. Go to Administration settings, Administration section, Talk 4. Try to verify HPB on Talk settings 5. Got Talk error “Websocket connection failed “ ### Log entries #### Nextcloud Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the _Copy raw_ option from _Administration settings-\>Logging_ screen or from your `nextcloud.log` located in your data directory). Feel free to use a pastebin/gist service if necessary. ```auto nextcloud does not log any errors associated with Talk or anything meaningless in time of error ``` #### Web Browser If the problem is related to the Web interface, open your browser inspector _Console_ and _Network_ tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear. Firefox at the same time shows in console such information | scheme | wss | | --- | --- | | host | [cloud.com](http://cloud.com) | | undefined | ---- | | filename | /standalone-signaling/spreed | | undefined | ---- | | Adres | 89.71.121.58:443 | | undefined | ---- | Stan 101 Switching Protocols Wersja HTTP/1.1 Przesłano 430 B (o rozmiarze 0 B) Rozwiązywanie DNS Systemowe - | | | | --- | --- | | Alt-Svc | h3=“:443”; ma=2592000 | | Connection | Upgrade | | --- | --- | | Date | Sun, 05 Oct 2025 16:14:35 GMT | | undefined | ---- | | Sec-WebSocket-Accept | RjvwXSjMbOTjfW1tiGOLZAWXQeM= | | undefined | ---- | | Server | Caddy | | undefined | ---- | | Upgrade | websocket | | --- | --- | | X-Spreed-Signaling-Features | audio-video-permissions, dialout, federation, hello-v2, incall-all, join-features, mcu, offer-codecs, recipient-call, serverinfo, simulcast, switchto, transient-data, update-sdp, welcome | | undefined | ---- | | | | --- | | Accept | | Accept-Encoding | gzip, deflate, br, zstd | | --- | --- | | Accept-Language | en-US,en;q=0.5 | | undefined | ---- | | Cache-Control | no-cache | | undefined | ---- | | Connection | keep-alive, Upgrade | | undefined | ---- | | Cookie | oc\_sessionPassphrase=o4TBbAeHg5OZ0%2Fj6DtxqdORAYDoT3p1ivSaXUl9kVzicQE48MWXm9X0yD6sr38kUZYzkxyBEbn5YmE3XajI08%2BgQ0OwCF%2FUIVXoUfImWtA%2B1EXIDYmp1p0gTSJuu6fny; octdck0c3a9n=b3d0b138a09c51f1c0087dd55f26d34f; \_\_Host-nc\_sameSiteCookielax=true; \_\_Host-nc\_sameSiteCookiestrict=true; oc9bvt1jaxtb=93c619b54dd4e38aae0e17ad8a456614; ocd7nurv7ckb=59818043654a7d3c7306295fefca1349; nc\_username=admin; nc\_token=21BR9rQXqIpKz8mDPUfpXGeDxSpVyjMr; nc\_session\_id=59818043654a7d3c7306295fefca1349 | | undefined | ---- | | Host | [cloud.com](http://cloud.com) | | undefined | ---- | | Origin | [https://cloud.com](https://cloud.wyraj.ddnsfree.com "https://cloud.wyraj.ddnsfree.com") | | undefined | ---- | | Pragma | no-cache | | undefined | ---- | | Sec-Fetch-Dest | empty | | undefined | ---- | | Sec-Fetch-Mode | websocket | | undefined | ---- | | Sec-Fetch-Site | same-origin | | undefined | ---- | | | | | undefined | ---- | | Sec-WebSocket-Extensions | permessage-deflate | | undefined | ---- | | Sec-WebSocket-Key | 9jdXMZY/qeAHH1Pe9HElWg== | | undefined | ---- | | Sec-WebSocket-Version | 13 | | undefined | ---- | | Upgrade | websocket | | undefined | ---- | 1. 2. ```auto PASTE ``` #### Web server / Reverse Proxy The output of your Apache/nginx/system log in `/var/log/ ____ `: 2025-10-05T14:38:31 Error caddy log on OPNSense ```auto "warn","ts":"2025-10-05T12:42:44Z", "logger":"http.handlers.reverse_proxy", "msg":"aborting with incomplete response", "upstream":"192.168.1.13:11000", "duration":0.004418381, "request":"remote_ip":"192.168.1.20", "remote_port":"53959", "client_ip":"192.168.1.20", "proto":"HTTP/2.0", "method":"GET", "host":"cloud.com", "uri":"/apps/text/js/index-6AQ8QgJK.chunk.mjs", "headers":{"Sec-Fetch-Site":["same-origin"], "Dnt":["1"], "X-Forwarded-For":["192.168.1.20"], "Via":["2.0 Caddy"], "User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0"], "Accept-Encoding":["gzip, deflate, br, zstd"], "Sec-Fetch-Dest":["script"], "Sec-Fetch-Mode":["cors"], "Te":["trailers"], "X-Forwarded-Proto":["https"], "X-Forwarded-Host":["cloud.com"], "Accept":["*/*"], "Cookie":["REDACTED"], "Accept-Language":["en-US,en;q=0.5"]}, "tls":"resumed":false, "version":772, "cipher_suite":4865, "proto":"h2", "server_name":"cloud.com"}}, "error":"reading: context canceled"}PASTE HERE ``` ### Configuration #### Nextcloud The output of `occ config:list system` or similar is best, but, if not possible, the contents of your `config.php` file from `/path/to/nextcloud` is fine (make sure to remove any identifiable information!): ```auto occ config:list systemnextcloud-aio-nextcloud:/var/www/html# sudo -E -u www-data php occ config:list system { "system": { "one-click-instance": true, "one-click-instance.user-limit": 100, "memcache.local": "\\OC\\Memcache\\APCu", "apps_paths": [ { "path": "\/var\/www\/html\/apps", "url": "\/apps", "writable": false }, { "path": "\/var\/www\/html\/custom_apps", "url": "\/custom_apps", "writable": true } ], "check_data_directory_permissions": false, "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": " ***REMOVED SENSITIVE VALUE***", "password": " ***REMOVED SENSITIVE VALUE***", "port": 6379 }, "overwritehost": "cloud.com", "overwriteprotocol": "https", "passwordsalt": " ***REMOVED SENSITIVE VALUE***", "secret": " ***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "localhost", "cloud.com" ], "datadirectory": " ***REMOVED SENSITIVE VALUE***", "dbtype": "pgsql", "version": "32.0.0.13", "overwrite.cli.url": "https:\/\/cloud.com\/", "dbname": " ***REMOVED SENSITIVE VALUE***", "dbhost": " ***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": " ***REMOVED SENSITIVE VALUE***", "dbpassword": " ***REMOVED SENSITIVE VALUE***", "installed": true, "instanceid": " ***REMOVED SENSITIVE VALUE***", "maintenance": false, "updatechecker": true, "updatedirectory": "\/nc-updater", "loglevel": 2, "app_install_overwrite": [ "nextcloud-aio" ], "log_type": "file", "logfile": "\/var\/www\/html\/data\/nextcloud.log", "log_rotate_size": 10485760, "log.condition": { "apps": [ "admin_audit" ] }, "preview_max_x": 2048, "preview_max_y": 2048, "jpeg_quality": 60, "enabledPreviewProviders": { "1": "OC\\Preview\\Image", "2": "OC\\Preview\\MarkDown", "3": "OC\\Preview\\MP3", "4": "OC\\Preview\\TXT", "5": "OC\\Preview\\OpenDocument", "6": "OC\\Preview\\Movie", "7": "OC\\Preview\\Krita" }, "enable_previews": true, "upgrade.disable-web": true, "mail_smtpmode": "smtp", "trashbin_retention_obligation": "auto, 30", "versions_retention_obligation": "auto, 30", "activity_expire_days": 30, "simpleSignUpLink.shown": false, "share_folder": "\/Shared", "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/", "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726", "maintenance_window_start": 100, "allow_local_remote_servers": true, "davstorage.request_timeout": 3600, "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425", "htaccess.RewriteBase": "\/", "dbpersistent": false, "auth.bruteforce.protection.enabled": true, "ratelimit.protection.enabled": true, "files_external_allow_create_new_local": false, "trusted_proxies": " ***REMOVED SENSITIVE VALUE***", "DOMAIN": "cloud.com" } } #### Apps The output of `occ app:list` (if possible). Can\`t paste it here but apps are all default except Talk (added during master container setup) ### Tips for increasing the likelihood of a response * Use the `preformatted text` formatting option in the editor for all log entries and configuration output. * If screenshots are useful, feel free to include them. * If possible, also include key error output in text form so it can be searched for. * Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you. ``` ---
**Author:** ![cloudious](https://help.nextcloud.com/letter_avatar/cloudious/32/5_5575768a8748004e209b776fc1b2916d.png) [@cloudious](https://help.nextcloud.com/u/cloudious)\ **Post date:** [November 3, 2025, 6:09am UTC](https://help.nextcloud.com/t/nextcloud-aio-talk-behind-caddy-v2-proxy-on-opnsense/233547/2 "2025-11-03T06:09:59Z")
Same problem here, also AIO and Caddy proxy, and I can’t get Talk to work. The high-performance backend section in the admin settings says: Error: Websocket connection failed, invalid\_token, The passed token is invalid. Were you able to resolve it? ---
**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\ **Post date:** [February 1, 2026, 6:10am UTC](https://help.nextcloud.com/t/nextcloud-aio-talk-behind-caddy-v2-proxy-on-opnsense/233547/3 "2026-02-01T06:10:47Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.