Nextcloud on Tailscale and SSL certs

t3kg33k · February 16, 2023, 11:54am

I’ve already posted on Tailscale this question but I wanted to make sure I cover the basis.
I basically want to know if it is possible to access Nextcloud from two different networks using two different HTTPS site domain names with two separate certificates.
Here is what I have and what I am looking for:

Hopefully someone here can answer my questions from the graphic.

Is it possible to have two different certs on the web server?

https://web.home.lan

https://web.tailxxx.ts.net

Is a reverse proxy required in this scenario?
If a reverse proxy is required, is that a separate server or can it be setup on the Nextcloud web server?

Thanks.

devnull · February 16, 2023, 12:52pm

I think you do not need a reverse proxy as long as you don’t need ports 80 and 443 for other purposes than the web server. I think your webserver can handle two virtual domains to the same Nextcloud path with different SSL certificates. In Nextcloud you can configure.

  'trusted_domains' => 
  array (
    0 => 'web.home.lan',
    1 => 'web.tailxxx.ts.net',
  ),

But i think the biggest problem is the certificate for your local domain.

I would just use the domain web.tailxxx.ts.net for all users (better also for Android clients ). You might want to look at Hairpinning and NAT Traversal. Don’t think there is a security advantage to using an internal domain name web.home.lan from within. Then rather block the access from the outside or use VPN or 2FA without sharing permission, that brings you the greater security gain. Alternatively, you can think about building two separate Nextclouds one for inside and outside and one for inside only. But this is a completely different setting. Your current setting cannot make this distinction between inside and outside.

t3kg33k · February 17, 2023, 9:18am

Thanks for the response.
It would definitely make things a little easier if I just have every client on my LAN use the Tailscale network and not worry about web.home.lan and just use the Tailscale FQDN. It’s definitely a strong consideration.

mattcd216 · November 27, 2023, 8:25pm

Hi. Did you ever succeed getting access to your nextcloud container via tailscale fqdn?
I have started the AIO container, navigated to the fqdn :8080 page and can see the initial password and then the setup pages… however it isn’t liking my tailscale fqdn when I submit it under ‘new aio instance’ saying “dns config is not set for this domain”.
Any advice?
I have the container host on tailscale (with https cert) and a local pihole dns record setup.
Cheers

mattcd216 · November 28, 2023, 3:36pm

I’ve managed to get through the domain check by starting the AIO container including the docker run flag --add-host machinename.tailnet.ts.net:[tailscale IP] and got the containers all up and running, but when clicking through to ‘open your nextcloud’ i get a SSL error “SSL received a record that exceeded the maximum permissible length”