Notify_push with docker compose...cannot figure it out at all

Here’s my current docker compose file with everything working as it should (Nextcloud 34 latest):

services:
  db:
    container_name: nextcloud-db
    image: $MARIADB_IMAGE
    restart: unless-stopped
    volumes:
      - ./db:/var/lib/mysql:Z
      - ./nextcloud-backup:/db_backups:rw
    networks:
      nextcloud-net:
        ipv4_address: ${DB_IP}
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    env_file:
      - db.env

  redis:
    container_name: nextcloud-redis
    image: redis:alpine
    restart: unless-stopped
    networks:
      nextcloud-net:
        ipv4_address: ${REDIS_IP}

  app:
    container_name: nextcloud
    image: $NEXTCLOUD_IMAGE
    hostname: nextcloud
    restart: unless-stopped
    ports:
      - ${NEXTCLOUD_PORT}:80
    volumes:
      - ./app:/var/www/html:z
      - ./logs:/var/log/nextcloud
      - /always-on/nextcloud/data:/data
      - /always-on/www/web-root/files:/www:ro
    networks:
      nextcloud-net:
        ipv4_address: ${APP_IP}
    environment:
      - MYSQL_HOST=db
      - REDIS_HOST=redis
      - PHP_MEMORY_LIMIT=1G
    env_file:
      - app.env
      - db.env
    depends_on:
      - db
      - redis
    labels:
      - "diun.enable=true"
      - "deunhealth.restart.on.unhealthy=true"
  
  signalling:
    container_name: nextcloud-signalling
    image: $SIGNALLING_IMAGE
    restart: unless-stopped
    ports:
      - ${SIGNALLING_PORT}:8081
    networks:
      nextcloud-net:
        ipv4_address: ${SIGNALLING_IP}
    env_file:
      - signalling.env
    depends_on:
      - app
    labels:
      - "diun.enable=true"
      - "deunhealth.restart.on.unhealthy=true"

  cron:
    container_name: nextcloud-cron
    image: $NEXTCLOUD_IMAGE
    restart: unless-stopped
    volumes:
      - ./app:/var/www/html:z
      - ./logs-cron:/var/log/nextcloud
      - /always-on/nextcloud/data:/data
    networks:
      nextcloud-net:
        ipv4_address: ${CRON_IP}
    environment:
      - MYSQL_HOST=db
      - REDIS_HOST=redis
    entrypoint: /cron.sh
    env_file:
      - app.env
      - db.env
    depends_on:
      - app

networks:
  nextcloud-net:
    driver_opts:
      com.docker.network.bridge.name: br-docker-nc
    ipam:
      config:
        - subnet: ${IP_SUBNET}
          gateway: ${GATEWAY_IP}

I’ve installed the “Client Push” app in Nextcloud. I have added the following lines to the appropriate reverse proxy config (Apache):

ProxyPass /push/ws ws://127.0.0.1:7867/ws
ProxyPass /push/ http://127.0.0.1:7867/
ProxyPassReverse /push/ http://127.0.0.1:7867/

I’ve added the following to my docker-compose.yaml:

  notify_push:
    container_name: nextcloud-notify
    image: ghcr.io/nextcloud/notify_push:latest
    restart: unless-stopped
    ports:
      - 7867:7867
    env_file:
      - app.env
      - db.env
    depends_on:
      - db
      - redis
      - app
    networks:
      nextcloud-net:
        ipv4_address: ${NOTIFY_PUSH_IP}
    volumes:
      - ./app:/var/www/html:z
      - /always-on/nextcloud/data:/data:ro
    labels:
      - "diun.enable=true"

If I try to start the new nextcloud-notify container, I get this error repeatedly:

Error: × No nextcloud server is configured

It seems as if it cannot read my Nextcloud config file, even though I’ve mounted /var/www/html in the same way as the app and cron containers. If I try add command: "ls -la /var/www/html" to debug this, I just get told “ls” is an unknown command when trying to start the container. So I have nowhere to go. How do I work out why the container won’t start?

I cannot find an “official” example of how to do this with a docker setup in the docs either, so I’ve had to piece together what is needed from various sources! One source suggested not even using the official container and just running the binary using the normal Nextcloud container like so:

  notify_push:
    container_name: nextcloud-notify
    image: $NEXTCLOUD_IMAGE
    restart: unless-stopped
    ports:
      - 7867:7867
    networks:
      nextcloud-net:
        ipv4_address: ${NOTIFY_PUSH_IP}
    volumes:
      - ./app:/var/www/html:z
      - /always-on/nextcloud/data:/data
    entrypoint: /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php
    env_file:
      - app.env
      - db.env
    depends_on:
      - db
      - app
      - redis

If I do it this way, the container comes up and if I enable debug mode using docker exec -it nextcloud-notify php occ notify_push:log debug I can see debug messages when editing files…but I don’t think anything is actually happening because if I try a test like so:

docker exec -it nextcloud-notify php occ notify_push:self-test

It immediately fails with 🗴 no push server configured!

Couple things:

You’re using an image so your entire config is not in config.php. See Docker - Viewing the Nextcloud configuration (config.php).

IIRC notify_push uses the overwrite.cli.url as the Nextcloud URL by default.

notify_push has an option for loading multiple configs; alternatively you can use environment variable overrrides (NEXTCLOUD_URL, etc). App parameters can also be set directly (which is what AIO does), but I don’t believe those are formally documented anywhere. See Client Push - Configuration.

Even after running notify_push:setup successfully

Yes, that’s totally a reasonable approach many people use.

The docs could probably use an overhaul in this area.

likely you missed setup.. look at How to docker-compose with notify_push (2024) for more details

I have never been able to run docker exec -it nextcloud php occ notify_push:setup successfully. What it prints suggests I need to do “manual” setup instead, which is what I assumed all this docker configuration was doing?:

This setup wizard is intended for use on single server instances
where the nextcloud server, web server/reverse proxy and push daemon all run on the same machine.
If your setup is more complex or involves any kind of load balancing
you should follow the manual setup instruction on the README instead
https://github.com/nextcloud/notify_push
Press enter to continue or ESC to cancel...

🗴 your system doesn't seem to be using systemd.
  You can still use the app without systemd by following the manual setup instructions.
  See the steps in the README for manual setup instructions: https://github.com/nextcloud/notify_push

This same error happens if I run the command in the main app container or the notify one.

If I instead run the command from the link you provided (docker exec -it nextcloud sh -c 'php occ notify_push:setup https://my.domain/push'), I get this error:

✓ redis is configured
🗴 can't connect to push server: Client error: `GET https://my.domain/push/test/cookie` resulted in a `404 Not Found` response:
<!DOCTYPE html>
<html class="ng-csp" data-placeholder-focus="false" lang="en" data-locale="en" translate="no" >
        <head
  (truncated...)

(where my.domain is the domain configured as overwrite.cli.url in the config.php). I can see in the notify container’s debug logs something is happening at least:

DEBUG [notify_push] src/lib.rs:456: Received test cookie 457213535

Forcefully setting env var NEXTCLOUD_URL=https://my.domain/ or NEXTCLOUD_URL=http://app (as suggested in the linked post) doesn’t make any difference either way.

Interestingly, if I run docker exec -it nextcloud sh -c 'php occ notify_push:setup http://{NOTIFY_PUSH_IP}/push' , i.e. using the internal docker IP instead of reverse proxy domain, it gets further:

✓ redis is configured
🗴 using unencrypted http for push server is strongly discouraged
✓ push server is receiving redis messages
✓ push server can load mount info from database
✓ push server can connect to the Nextcloud server
🗴 push server is not a trusted proxy by Nextcloud or another proxy in the chain.
  Nextcloud resolved the following client address for the test request: "172.20.0.7" instead of the expected "1.2.3.4" test value.
  The following trusted proxies are currently configured: "192.168.1.89", "172.20.0.1"
  The following x-forwarded-for header was received by Nextcloud: "1.2.3.4"
    from the following remote: 172.20.0.7

  172.20.0.7 is not trusted as a reverse proxy by Nextcloud
  See https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/reverse_proxy_configuration.html#defining-trusted-proxies for how to add trusted proxies.

  If you're having issues getting the trusted proxy setup working, you can try bypassing any existing reverse proxy
  in your setup by setting the `NEXTCLOUD_URL` environment variable to point directly to the internal Nextcloud webserver url
  (You will still need the ip address of the push server added as trusted proxy)

If I then add my apache server’s docker gateway IP to the list of trusted IPs, I can get it to pass:

> docker exec -it nextcloud sh -c 'php occ notify_push:setup http://172.20.0.7:7867/push'
✓ redis is configured
🗴 using unencrypted http for push server is strongly discouraged
✓ push server is receiving redis messages
✓ push server can load mount info from database
✓ push server can connect to the Nextcloud server
✓ push server is a trusted proxy
✓ push server is running the same version as the app
  configuration saved

but I’m assuming it’s bad practice to use a local IP here and something isn’t right with my reverse proxy setup?

notify_push requests must arrive to the cloud from a trusted_proxies so you either force the connection through your external domain and reverse proxy or your allow the internal IP.. your IP looks like a Docker internal IP if you have direct connection between the two containers..

if you completely follow the guide you will find

which likely solves the problem.. if not and the traffic flows through another reverseproxy this one must trust http headers from notify_push (similar config as for Nextcloud)

I don’t think something is wrong with your reverse proxy.. likely it works as expected and doesn’t trust incoming http headers from notify_push.. but it must. it depends on your setup and intention if it’s right or wrong..

please use search and educate yourself.. e.g. read and understand

Yes, I edited my previous post to say I can get it working (supposedly) with the local container IP in my trusted proxies list. Are you saying I should ignore the warning that using unencrypted local IPs is “strongly discouraged” and just go with that?

If I really should be using my domain through the reverse proxy then I’ll need to figure that out. As I stated before, I have the exact lines in my config as in that guide and it doesn’t work:

ProxyPass /push/ws ws://127.0.0.1:7867/ws
ProxyPass /push/ http://127.0.0.1:7867/
ProxyPassReverse /push/ http://127.0.0.1:7867/

I’ve also tried replacing 127.0.0.1 with my container host’s IP, neither works for getting setup working with my domain.

EDIT: Right, fixed the reverse proxy. I had the ProxyPass lines below the more generic ones (e.g. ProxyPass / "http://my.domain:8498/") so they weren’t doing anything! Now that’s re-ordered, I can successfully configure using docker exec -it nextcloud sh -c 'php occ notify_push:setup https://my.domain/push'

Thanks for all the tips, got there in the end!