Curl from Nextcloud app Container to Collabora Container:
curl -v https://office.domain
* Trying 10.0.0.40:443...
* Connected to office.domain (10.0.0.40) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=office.domain
* start date: Nov 7 06:23:40 2022 GMT
* expire date: Feb 5 06:23:39 2023 GMT
* subjectAltName: host "office.domain" matched cert's "office.domain"
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55645fe7e2c0)
> GET / HTTP/2
> Host: office.domain
> user-agent: curl/7.74.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200
< server: nginx/1.14.2
< date: Wed, 09 Nov 2022 06:18:02 GMT
< content-type: 10
< content-length: 2
< last-modified: Wed, 09 Nov 2022 06:18:02
<
* Connection #0 to host office.domain left intact
Collabora to Cloud:
cool@96120713b535:/$ curl -v https://cloud.domain
* Rebuilt URL to: https://cloud.domain/
* Trying 10.0.0.40...
* TCP_NODELAY set
* Connected to cloud.domain (10.0.0.40) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=cloud.domain
* start date: Oct 9 21:00:07 2022 GMT
* expire date: Jan 7 21:00:06 2023 GMT
* subjectAltName: host "cloud.domain" matched cert's "cloud.domain"
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x561e7064f620)
> GET / HTTP/2
> Host: cloud.domain
> User-Agent: curl/7.58.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200
< server: nginx/1.14.2
< date: Wed, 09 Nov 2022 06:20:16 GMT
< content-type: text/html; charset=utf-8
< content-length: 156
< referrer-policy: no-referrer
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-permitted-cross-domain-policies: none
< x-robots-tag: none
< x-xss-protection: 1; mode=block
< last-modified: Sun, 30 Oct 2022 09:59:22 GMT
< etag: "9c-5ec3d8b94dfde"
< accept-ranges: bytes
< vary: Accept-Encoding
<
<!DOCTYPE html>
<html>
<head>
<script> window.location.href="index.php"; </script>
<meta http-equiv="refresh" content="0; URL=index.php">
</head>
</html>
* Connection #0 to host cloud.domain left intact
The “Extra Hosts” Settings go to my Reverse Proxy at the moment.
10.0.0.40 is my Reverse Proxy
10.0.0.41 is my Docker Server with Nextcloud and Collabora
Compose:
version: '2'
volumes:
nextcloud:
db:
networks:
nextcloud:
services:
db:
image: mariadb:10.5
restart: always
command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
volumes:
- db:/var/lib/mysql
- /opt/portainer/nextcloud/mariaconf:/etc/mysql/conf.d
- /etc/localtime:/etc/localtime:ro
networks:
- nextcloud
environment:
- MYSQL_ROOT_PASSWORD=Secret
- MYSQL_PASSWORD=Secret
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nc
redis:
image: redis
restart: always
command: redis-server --requirepass Secret
networks:
- nextcloud
app:
image: c-lab-nextcloud:latest
restart: always
ports:
- 12003:80
links:
- db
volumes:
- nextcloud:/var/www/html
- /opt/portainer/nextcloud/data:/var/www/html/data
- /etc/localtime:/etc/localtime:ro
networks:
- nextcloud
extra_hosts:
- "office.domain:10.0.0.40"
environment:
- MYSQL_PASSWORD=Secret
- MYSQL_DATABASE=nextcloud
- MYSQL_USER=nc
- MYSQL_HOST=db
- PHP_MEMORY_LIMIT=4G
- PHP_UPLOAD_LIMIT=20G
- REDIS_HOST_PASSWORD=Secret
depends_on:
- db
- redis
collabora:
image: collabora/code
restart: unless-stopped
networks:
- nextcloud
ports:
- "9980:9980"
extra_hosts:
- "cloud.domain:10.0.0.40"
- "office.domain:10.0.0.40"
environment:
- "extra_params=--o:ssl.enable=false --o:ssl.termination=true"
- 'dictionaries=de_DE'
cap_add:
- MKNOD
tty: true
Nginx Settings:
Cloud:
upstream nextcloud {
server 10.0.0.41:12003 max_fails=1 fail_timeout=10;
}
server {
listen 443 ssl http2;
listen [::]:443 http2;
server_name cloud.domain;
ssl_certificate /root/.acme.sh/cloud.domain/fullchain.cer;
ssl_certificate_key /root/.acme.sh/cloud.domain/cloud.domain.key;
# Enable gzip but do not remove ETag headers
gzip on;
gzip_vary on;
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
client_max_body_size 20000m;
fastcgi_buffer_size 4k;
fastcgi_buffers 64 4k;
fastcgi_hide_header X-Powered-By;
access_log /var/log/nginx/cloud-access.log adv;
error_log /var/log/nginx/cloud-error.log notice;
location ~ / {
proxy_pass http://nextcloud;
proxy_set_header Host $server_name;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header User-Agent $http_user_agent;
proxy_hide_header Upgrade;
proxy_ssl_verify off;
#proxy_send_timeout 180s;
#proxy_read_timeout 180s;
proxy_ssl_session_reuse off;
proxy_max_temp_file_size 0;
}
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / {
if ( $http_user_agent ~ ^DavClnt ) {
return 302 /remote.php/webdav/$is_args$args;
}
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ^~ /.well-known {
# The rules in this block are an adaptation of the rules
# in `.htaccess` that concern `/.well-known`.
location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
location = /.well-known/webfinger { return 301 /index.php/webfinger; }
location = /.well-known/nodeinfo { return 301 /index.php/nodeinfo; }
location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
location /.well-known/pki-validation { try_files $uri $uri/ =404; }
}
#location ~ ^(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {}
# Rules borrowed from `.htaccess` to hide certain paths from clients
# location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
# location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
}
Office:
upstream office {
server 10.0.0.41:9980;
}
server {
listen 443 ssl http2;
listen [::]:443 http2;
server_name office.domain;
ssl_certificate /root/.acme.sh/office.domain/fullchain.cer;
ssl_certificate_key /root/.acme.sh/office.domain/office.domain.key;
ssl_protocols TLSv1.2;
# ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
# ssl_prefer_server_ciphers on;
# client_max_body_size 20000m;
# fastcgi_buffer_size 4k;
# fastcgi_buffers 64 4k;
# fastcgi_hide_header X-Powered-By;
access_log /var/log/nginx/office-access.log adv;
error_log /var/log/nginx/office-error.log notice;
location ~ / {
proxy_pass http://office;
# proxy_set_header Host $http_host;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header User-Agent $http_user_agent;
# proxy_hide_header Upgrade;
# proxy_ssl_verify off;
}
}
NonSSL conf of nextcloud and office are identical except the servername, logpath and return 301
server {
listen 80;
listen [::]:80;
server_name office.domain;
client_max_body_size 20m;
access_log /var/log/nginx/office-access.log adv;
error_log /var/log/nginx/office-error.log notice;
location /.well-known {
root /var/www/letsencrypt;
}
location / {
return 301 https://office.domain$request_uri
; }
}
Cloud Office Setting
If i click the save button nginx office log:
site="office.domain" server="office.domainďż˝ dest_port="443" dest_ip="10.0.0.40" src="10.0.0.41" src_ip="10.0.0.41" user="-" time_local="09/Nov/2022:07:31:05 +0100" protocol="HTTP/1.1" status="200" bytes_out="526" http_user_agent="Nextcloud Server Crawler" nginx_version="1.14.2" http_x_forwarded_for="-" http_x_header="-" uri_query="-" uri_path="/hosting/capabilities" http_method="GET" response_time="0.004" cookie="-" request_time="0.000"
No Logentry in collabora container. Last Log 5 o Clock AM:
2022-11-09T05:00:04.277457846Z sh: 1: /usr/bin/coolmount: Operation not permitted
If i want to open a Document:
No logs on cloud, nginx or collabora while opening.
