Nginx, reverse proxy and webfinger - what is the ideal configuration

ℹ️ Support
1

Hi,

I have Nextcloud running on a docker container (not the official one, just one I made with Ubuntu and nginx). I also use nginx as reverse proxy.
I keep getting the (in)famous complaint from Nextcloud:

  • Your web server is not properly set up to resolve “/.well-known/webfinger”. Further information can be found in the documentation :arrow_upper_right:.
  • Your web server is not properly set up to resolve “/.well-known/nodeinfo”. Further information can be found in the documentation :arrow_upper_right:.

On my NGINX proxy I have this configured on my nextcloud.conf:

location /.well-known/webfinger {
    return 301 $scheme://$host/index.php/.well-known/webfinger;
}

On my nginx behind the proxy, I have:

location ^~ /.well-known {
        # The rules in this block are an adaptation of the rules
        # in `.htaccess` that concern `/.well-known`.

        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        # Let Nextcloud's API for `/.well-known` URIs handle all other
        # requests by passing them to the front-end controller.
        return 301 /index.php$request_uri;
    }

I just don’t know what and where should be on the proxy and on the nextcloud-nginx. Does anyone have a similar configuration and is willing to share some tips here?

Best,

Francis

2 Likes
2

I’m facing similar issue. I’m not entirely sure what’s wrong with my configuration.

One minor difference is that I’m using the official nextcloud-fpm docker container. But all the rest looks pretty similar.

3

I found one valid config but it may not work properly in your environments because my nextcloud server deployment is a little speicial.

My Nextcloud version is v24.0.6 and is deployed in docker (linuxserver/nextcloud:lastest). It’s behind another nginx reverse proxy web server running in docker on physic Unraid PC and it needs port forward as the PC is in a NAT network.

The network route to nextcloud container is like:
Internet IP:10000 → Unraid nginx container:18443 → reverse proxy to Unraid:9000 → port forward locally to nextcloud container:80

Here’s the nginx.conf:

location = /.well-known/host-meta {
return 301 $scheme://$http_hostpublic.php?service=host-meta;
}

location = /.well-known/host-meta.json {
return 301 $scheme://$http_host/public.php?service=host-meta-json;
}

location = /.well-known/carddav {
return 301 $scheme://$http_host/remote.php/dav;
}

location = /.well-known/caldav {
return 301 $scheme://$http_host/remote.php/dav;
}

location = /.well-known/webfinger{
return 301 $scheme://$http_host/index.php/.well-known/webfinger;
}

location = /.well-known/nodeinfo{
return 301 $scheme://$http_host/index.php/.well-known/nodeinfo;
}

After adding things above, remember to clean or refresh the web browser cache.

PS：
Because of the special network environment, I added something unusual to the reverse proxy part. (proxy_set_header)

location / {
proxy_pass http://192.168.9.10:9000/;
proxy_set_header Host $host:10000;
}
2 Likes
4

I was having the webfinger issue with a similar setup, and what worked for me was deleting the nginx default.conf and letting it regenerate after restarting nextcloud (/config/nginx/site-confs/default.conf).

I also had to clear cache since the 301 response gets cached and so the warning won’t clear. You need to Open Dev Tools (F12), and while this is open right click on refresh button and select Empty cache and hard reload.

More context here: Your web server is not properly set up to resolve "/.well-known/webfinger". · Issue #189 · linuxserver/docker-nextcloud · GitHub

5

Thanks a lot wyxls. Above config added to “community official ngix” one fixed issue on my side.

My config is basing on dockers: nginx:latest + nextcloud:fpm-alpine.
Might be relevant for issues faced that in my config there is redirection on my router (no DNS servers advertisement on router) to DNS resolution/blocking docker pihole:latest on same server as nextcloud/nginx.

Thanks!

6

Thank you, that worked for me as well.
I have fixed all my warnings with this. Thanks again.