Nextcloud server, Cloudflare tunnel, Docker

next_newb · December 24, 2023, 5:19pm

I’m playing around on an old computer with a fresh install of openSUSE and thought I’d try creating a Nextcloud server. I’ve got it installed and accessible using my computer’s IP and using DDNS but I’m having difficulty setting it up with a Cloudflare tunnel. I’ve had all sorts of things pop up in the browser, usually ‘Bad Gateway’. There’s lots of youtube videos and websites describing how to do it but I’ve found they’re making it more complicated than necessary, at least I feel they are! I’m trying to stick to the instructions on the Nextcloud website/github.

I’ve been following…

github.com

nextcloud/all-in-one/blob/main/reverse-proxy.md

# Reverse Proxy Documentation

A [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) is basically a web server that enables computers on the internet to access a service in a [private subnet](https://en.wikipedia.org/wiki/Private_network).

**Please note:** Publishing the AIO interface with a valid certificate to the public internet is **not** the goal of this documentation! Instead, the main goal is to publish Nextcloud with a valid certificate to the public internet which is **not** running inside the mastercontainer but in a different container! If you need a valid certificate for the AIO interface, see [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface).

In order to run Nextcloud behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else), you need to specify the port that AIO's Apache container shall use, add a specific config to your web server or reverse proxy and modify the startup command a bit. All examples below will use port `11000` as example `APACHE_PORT` which will be exposed on the host to receive unencrypted HTTP traffic from the reverse proxy. **Advice:** If you need https between Nextcloud and the reverse proxy because it is running on a different server in the same network, simply add another reverse proxy to the chain that runs on the same server like AIO and takes care of https proxying (most likely via self-signed cert). Another option is to create a VPN between the server that runs AIO and the server that runs the reverse proxy which takes care of encrypting the connection.

**Attention:** The process to run Nextcloud behind a reverse proxy consists of at least steps 1, 2 and 4:
1. **Configure the reverse proxy! See [point 1](#1-configure-the-reverse-proxy)**
1. **Use this startup command! See [point 2](#2-use-this-startup-command)**
1. Optional: If the reverse proxy is installed on the same host and in the host network, you should limit the apache container to only listen on localhost. See [point 3](#3-limit-the-access-to-the-apache-container)
1. **Open the AIO interface. See [point 4](#4-open-the-aio-interface)**
1. Optional: Get a valid certificate for the AIO interface! See [point 5](#5-optional-get-a-valid-certificate-for-the-aio-interface)
1. Optional: How to debug things? See [point 6](#6-how-to-debug-things)

**Please note:** Since the Apache container gets created by the mastercontainer, there is **NO** way to provide custom docker labels or custom environmental variables for the Apache container. So please do not attempt to do this because you will fail! Only the documented way will work!

## 1. Configure the reverse proxy

This file has been truncated. show original

For me to list off all the things I’ve tried would make for a very long and boring read but I’ve spent all day on it! I’m probably tripping up on step 1 in the link above so it’s probably best to iron out that first!

I’m setting up the tunnel using the docker command generated by Cloudflare. I’m not entirely sure where my tunnel should point? Step 1 in the link above seems to suggest “host.docker.internal:$APACHE_PORT” provided I add “–add-host=host.docker.internal:host-gateway” to the docker command generated by Cloudflare.

Is this correct or am I understanding it wrong?

It also says I need to disable Cloudflare’s Rocket Loader feature, which I have done. I have also added “–env SKIP_DOMAIN_VALIDATION=true” to the Nextcloud command.

Thank you for any help!

jtr · December 24, 2023, 8:34pm

That sounds accurate. APACHE_PORT should be 11000 unless you’ve changed it from the default.