The Basics
- Nextcloud Server version (e.g., 29.x.x):
33.0.5.1
- Operating system and version (e.g., Ubuntu 24.04):
Debian 1:6.12.75-1+rpt1~bookworm (2026-03-11) aarch64
- Web server and version (e.g, Apache 2.4.25):
Apache/2.4.66 (Debian)
- Reverse proxy and version _(e.g. nginx 1.27.2)
Nginx 1.30.1
- PHP version (e.g, 8.3):
8.4
- Is this the first time you’ve seen this error? (Yes / No):
No
- When did this problem seem to first start?
Unknown
- Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
Binary install
- Are you using CloudfIare, mod_security, or similar? (Yes / No)
No
Summary of the issue you are facing:
So as of now I am getting logs and for some reason a IP Address which has been used by Docker for a Network Bridge (which I created recently) and now deleted is showing up. What this means: in the logs I get sometimes the IP is “172.25.0.1” whereas this IP no longer exists in the device Nextcloud is located in.
Steps to replicate it (hint: details matter!):
- Have Nextcloud running
- Create a Docker Network Bridge
- Check the logs/system information
Log entries
Nextcloud
Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.
{
"reqId": "rj7o3KHUGPGPlKVvii9r",
"level": 1,
"time": "2026-06-23T01:55:48+02:00",
"remoteAddr": "172.25.0.1",
"user": "Maxim",
"app": "core",
"method": "GET",
"url": "/ocs/v2.php/apps/end_to_end_encryption/api/v2/public-key?format=json",
"scriptName": "/ocs/v2.php",
"message": "Bruteforce attempt from \"172.25.0.1\" detected for action \"e2ee\".",
"userAgent": "Mozilla/5.0 (Macintosh) mirall/33.0.5 (Nextcloud, macos-25.5.0 ClientArchitecture: arm64 OsArchitecture: arm64)",
"version": "33.0.5.1",
"clientReqId": "4a2c5e25-69ce-4738-8a4b-0dae52135981",
"data": {
"app": "core"
}
}
Configuration
Nextcloud
The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):
{
"system": {
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"serverid": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"***REMOVED SENSITIVE VALUE***",
"***REMOVED SENSITIVE VALUE***",
"***REMOVED SENSITIVE VALUE***",
"***REMOVED SENSITIVE VALUE***",
"***REMOVED SENSITIVE VALUE***",
"localhost"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "33.0.5.1",
"overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
"overwriteprotocol": "https",
"overwritehost": "***REMOVED SENSITIVE VALUE***",
"overwritecondaddr": "^192\\.168\\.178\\.188$",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"default_phone_region": "DE",
"filelocking.enabled": true,
"memcache.local": "\\OC\\Memcache\\APCu",
"memcache.locking": "\\OC\\Memcache\\Redis",
"memcache.distributed": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 0,
"timeout": 0
},
"mail_smtpmode": "smtp",
"mail_sendmailmode": "pipe",
"maintenance_window_start": 2,
"trashbin_retention_obligation": "30, 60",
"versions_retention_obligation": "180, auto",
"activity_expire_days": 730,
"maintenance": false,
"default_timezone": "Europe\/Berlin",
"logtimezone": "Europe\/Berlin",
"logtype": "file",
"logfile": "\/mnt\/raid\/\/nextcloud\/nextcloud.log",
"loglevel": 1,
"allow_user_to_change_display_name": true,
"upload_max_filesize": "100G",
"mail_smtpsecure": "ssl",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "465",
"mail_smtpauth": true,
"mail_smtpname": "***REMOVED SENSITIVE VALUE***",
"mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
"twofactor_enforced": "true",
"twofactor_enforced_groups": [],
"twofactor_enforced_excluded_groups": [],
"enable_previews": true,
"preview_ffmpeg_path": "\/usr\/bin\/ffmpeg",
"preview_concurrency_all": 4,
"preview_concurrency_new": 2,
"enabledPreviewProviders": [
"OC\\Preview\\BMP",
"OC\\Preview\\GIF",
"OC\\Preview\\JPEG",
"OC\\Preview\\Image",
"OC\\Preview\\PNG",
"OC\\Preview\\TXT",
"OC\\Preview\\MarkDown",
"OC\\Preview\\MP3",
"OC\\Preview\\PDF",
"OC\\Preview\\TIFF",
"OC\\Preview\\SVG",
"OC\\Preview\\ZIP",
"OC\\Preview\\HEIC",
"OC\\Preview\\Movie",
"OC\\Preview\\OpenDocument",
"OC\\Preview\\Krita",
"OC\\Preview\\MOV",
"OC\\Preview\\Imaginary"
],
"preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
"preview_max_memory": 512,
"preview_max_x": 1024,
"preview_max_y": 1024,
"dot_files": true,
"theme": "",
"music.lastfm_api_key": "***REMOVED SENSITIVE VALUE***",
"music.lastfm_api_secret": "***REMOVED SENSITIVE VALUE***",
"app_install_overwrite": [
"camerarawpreviews",
"workflow_media_converter"
],
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"forwarded_for_headers": [
"HTTP_X_FORWARDED_FOR",
"HTTP_X_REAL_IP"
],
"push_server_url": "***REMOVED SENSITIVE VALUE***",
"defaultapp": "dashboard,announcementcenter,calendar,files,spreed,mail,photos,music,notes,deck,passwords",
"wopi_allowlist": [
"***REMOVED SENSITIVE VALUE***"
]
}
}
Apps
Enabled:
- activity: 6.0.0
- admin_audit: 1.23.0
- announcementbanner: 2.4.2
- announcementcenter: 7.4.1
- app_api: 33.0.0
- audiocoverpreview: 0.12.1
- bruteforcesettings: 6.0.0
- calendar: 6.5.0
- camerarawpreviews: 1.1.1
- circles: 33.0.0
- cloud_federation_api: 1.17.0
- comments: 1.23.0
- contacts: 8.7.1
- contactsinteraction: 1.14.1
- dashboard: 7.13.0
- dav: 1.36.0
- deck: 1.17.4
- end_to_end_encryption: 2.1.1
- federatedfilesharing: 1.23.0
- federation: 1.23.0
- files: 2.5.0
- files_autorename: 2.4.1
- files_downloadlimit: 5.1.0
- files_pdfviewer: 6.0.0
- files_reminders: 1.6.0
- files_retention: 4.0.1
- files_sharing: 1.25.2
- files_trashbin: 1.23.0
- files_versions: 1.26.0
- firstrunwizard: 6.0.0
- imageconverter: 2.2.0
- logcleaner: 1.5.5
- logreader: 6.0.0
- lookup_server_connector: 1.21.0
- mail: 5.10.1
- music: 3.1.0
- nextcloud_announcements: 5.0.0
- notes: 6.0.0
- notifications: 6.0.0
- notify_push: 1.3.3
- oauth2: 1.21.0
- password_policy: 5.0.0
- photos: 6.0.0
- previewgenerator: 5.13.0
- privacy: 5.0.0
- profile: 1.2.0
- provisioning_api: 1.23.0
- quota_warning: 1.24.0
- recommendations: 6.0.0
- related_resources: 4.0.0
- richdocuments: 10.2.0
- serverinfo: 5.0.0
- settings: 1.16.0
- sharebymail: 1.23.0
- spreed: 23.0.6
- support: 5.0.0
- survey_client: 5.0.0
- suspicious_login: 11.0.0
- systemtags: 1.23.0
- text: 7.0.1
- theming: 2.8.0
- twofactor_backupcodes: 1.22.0
- twofactor_nextcloud_notification: 7.0.0
- twofactor_totp: 15.0.0
- updatenotification: 1.23.0
- user_status: 1.13.0
- viewer: 6.0.0
- weather_status: 1.13.0
- webhook_listeners: 1.5.0
- workflow_media_converter: 3.0.1
- workflowengine: 2.15.0
Disabled: - encryption: 2.21.0 (installed 2.19.0)
- files_external: 1.25.1
- integration_google: 4.4.0 (installed 4.4.0)
- user_ldap: 1.24.0
Tips for increasing the likelihood of a response
- Use the
preformatted textformatting option in the editor for all log entries and configuration output. - If screenshots are useful, feel free to include them.
- If possible, also include key error output in text form so it can be searched for.
- Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.