NginX - Your web server is not properly set up to resolve "/ocm-provider/", "/ocs-provider/"

ℹ️ Support
, , , ,
1

Hey there.

I am receiving the following warning in the admin section of Nextcloud (version 30.0.4)

Your web server is not properly set up to resolve “/ocm-provider/”, “/ocs-provider/”

I am running Nextcloud on Centos 8 with Nginx.

Nextcloud is installed in “/usr/share/nginx/html/nextcloud”

My nextcloud.conf is below:-

upstream php-handler {
    server 127.0.0.1:9000;
    #server unix:/var/run/php/php7.4-fpm.sock;
}

# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
    "" "";
    default "immutable";
}


server {
    listen 80;
    listen [::]:80;
    server_name 10.0.50.222;

    # Prevent nginx HTTP Server Detection
    server_tokens off;

    # Enforce HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name 10.0.50.222;

    ssl_certificate /etc/nginx/cert/owncloud.crt;
    ssl_certificate_key /etc/nginx/cert/owncloud.key;

    add_header Strict-Transport-Security "max-age=15768000;
    includeSubDomains; preload;";
  #   add_header X-Content-Type-Options nosniff;
  #   add_header Referrer-Policy no-referrer always;
  #   add_header X-Frame-Options SAMEORIGIN always;
  #   add_header X-XSS-Protection "1; mode=block";
  #   add_header X-Robots-Tag noindex,nofollow always;
  #   add_header X-Download-Options noopen;
  #   add_header X-Permitted-Cross-Domain-Policies none;

    # Path to the root of your installation
      root /usr/share/nginx/html/nextcloud/;

    # Use Mozilla's guidelines for SSL/TLS settings
    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
#    ssl_certificate     /etc/ssl/nginx/cloud.example.com.crt;
#    ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;

    # Prevent nginx HTTP Server Detection
    server_tokens off;

    # HSTS settings
    # WARNING: Only add the preload option once you read about
    # the consequences in https://hstspreload.org/. This option
    # will add the domain to a hardcoded list that is shipped
    # in all major browsers and getting removed from this list
    # could take several months.
    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;

    # set max upload size and increase upload timeout:
    client_max_body_size 512M;
    client_body_timeout 300s;
    fastcgi_buffers 64 4K;

    # Enable gzip but do not remove ETag headers
#    gzip on;
#    gzip_vary on;
#    gzip_comp_level 4;
#    gzip_min_length 256;
#    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
#    gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

    # Pagespeed is not supported by Nextcloud, so if your server is built
    # with the `ngx_pagespeed` module, uncomment this line to disable it.
    #pagespeed off;

    # The settings allows you to optimize the HTTP2 bandwitdth.
    # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
    # for tunning hints
    client_body_buffer_size 512k;

    # HTTP response headers borrowed from Nextcloud `.htaccess`
     add_header Referrer-Policy                   "no-referrer"       always;
     add_header X-Content-Type-Options            "nosniff"           always;
     add_header X-Download-Options                "noopen"            always;
     add_header X-Frame-Options                   "SAMEORIGIN"        always;
     add_header X-Permitted-Cross-Domain-Policies "none"              always;
     add_header X-Robots-Tag                      "noindex, nofollow" always;
     add_header X-XSS-Protection                  "1; mode=block"     always;

    # Remove X-Powered-By, which is an information leak
    fastcgi_hide_header X-Powered-By;

    # Add .mjs as a file extension for javascript
    # Either include it in the default mime.types list
    # or include you can include that list explicitly and add the file extension
    # only for Nextcloud like below:
    include mime.types;
    types {
        text/javascript js mjs;
    }

    # Specify how to handle directories -- specifying `/index.php$request_uri`
    # here as the fallback means that Nginx always exhibits the desired behaviour
    # when a client requests a path that corresponds to a directory that exists
    # on the server. In particular, if that directory contains an index.php file,
    # that file is correctly served; if it doesn't, then the request is passed to
    # the front-end controller. This consistent behaviour means that we don't need
    # to specify custom rules for certain paths (e.g. images and other assets,
    # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
    # `try_files $uri $uri/ /index.php$request_uri`
    # always provides the desired behaviour.
    index index.php index.html /index.php$request_uri;

    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    # Make a regex exception for `/.well-known` so that clients can still
    # access it despite the existence of the regex rule
    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
    # for `/.well-known`.
    location ^~ /.well-known {
        # The rules in this block are an adaptation of the rules
        # in `.htaccess` that concern `/.well-known`.

        location = /.well-known/carddav { return 301 /remote.php/dav/; }
        location = /.well-known/caldav  { return 301 /remote.php/dav/; }

        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }

        # Let Nextcloud's API for `/.well-known` URIs handle all other
        # requests by passing them to the front-end controller.
        return 301 /index.php$request_uri;
    }

    # Rules borrowed from `.htaccess` to hide certain paths from clients
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
    location =/ocm-provider/{return 301 /index.php/ocm-provider;}
    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
    # which handle static assets (as seen below). If this block is not declared first,
    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
    # to the URI, resulting in a HTTP 500 error response.
    location ~ \.php(?:$|/) {
        # Required for legacy support
        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;

        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files $fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;

        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
        fastcgi_param front_controller_active true;     # Enable pretty urls
        fastcgi_pass php-handler;

        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;

        fastcgi_max_temp_file_size 0;
    }
      
    # Serve static files
    location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463, $asset_immutable";
        access_log off;     # Optional: Don't log access to assets

        location ~ \.wasm$ {
            default_type application/wasm;
        }
    }

    location ~ \.woff2?$ {
        try_files $uri /index.php$request_uri;
        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
        access_log off;     # Optional: Don't log access to assets
    }

    # Rule borrowed from `.htaccess`
    location /remote {
        return 301 /remote.php$request_uri;
    }

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }
}

Please advise any changes I need to make to remove the warning.

Thank you

2

Your Nginx config should match the documented one and be kept up to date with it unless you have a compelling reason to do something different:

https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html

If you compare your config you’ll see various differences.

3

With all due respect, if I could understand the documentation (which I have read), I wouldn’t be asking the question.

I concede that I am not as gifted as you in this subject.

Further to this, if my config file matches the one that is in the documentation, the software doesn’t run at all.

4

At least you need to delete or comment out this line:

1 Like
5

Thank you Bernie_O

I will give this a try.

6

Fair enough. Though probably all the more reason to consider switching to the suggested config. :wink:

Otherwise every time you run into a problem, ask here for assistance, or need to integrate required changes to the Nginx config it’ll be more challenging for everyone involved (including yourself).

The required Nginx config for Nextcloud does change fairly regularly (it did throughout the v28-v30 development cycle). Without those changes, things break in Nextcloud.

Further to this, if my config file matches the one that is in the documentation, the software doesn’t run at all.

From a quick look through your existing config, the only necessary changes from the one in the manual for you should be the specific file/folder paths and URLs: namely the server_name, root, and ssl_certificate* parameters.

If you switch over and run into challenges, the forum here can help you out. I’m not saying you have to do it now. Just consider it for a rainy day. :slight_smile:

7

Thanks so much Josh. I really appreciate the advice.

I wasn’t aware of how often the Nginx config requirements were changing.

I will have another go with the documented config file with the obvious customization settings to try and get up to date.

8

Hi Bernie_O

Unfortunately your suggestion of commenting out that line did not work. the warnings were still there.

9

Hi Josh.

Your suggestions were spot on!!

I tried the default .conf file with a few custom changes for my server env and it is now working great!!

I enabled HSTS and now no warnings in the admin console!!!

Thank you so much for your help.

2 Likes
10

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.