Official nextcloud docker image does it need more than just proxy pass?


#1

In many reverse proxy setups with nextcloud and Docker, most blogs only have 4 or 5 lines of code in nginx for proxy-pass to work its magic for forwarding nextcloud servers.

However the official nextcloud howto page regarding nginx reverse proxying has a whole page of security config and redirects to make everything safe and functional.

My question is, is just proxy passing nextcloud safe enough (Is the security baked into the official Docker image? ) Or do I need the big nginx config as well?

Currently it loads the login page but the login button doesn’t respond for some reason?

When I just have the 5 or so lines with proxy-pass
everything works but I worry it’s not as secure.

thoughts?


#2

you may test your server: https://www.ssllabs.com/ssltest/ or https://securityheaders.com/
and decide which of the security feature that failed you need/want.

e.g. i you are the only user and you want to access only with device/browser you can control you may want to disable all ssl ciphers except one that you trust and is working on your devices. admins who have a great base of user devices can’t.

p.s.: my setup give you an a+ (of course without any guaranty that this is save for you. :wink: )


#3

That’s not quite what I meant, I have the ssl garb in there and the dhparm for extra security so A+ there.

here’s an example

typical nextcloud nginx config:-
##################################
/etc/nginx/conf.d/default.conf

server {
listen 80;
listen 443;
listen [::]:80;

ssl on;
ssl_certificate /etc/ssl/xxx/xxx.pem;
ssl_certificate_key /etc/ssl/xxx/xxx_priv.key;
proxy_ssl_verify off;
server_name nextcloud.xxx.org;
client_max_body_size 10G ;

location / {

proxy_pass https://nextcloud.xxx.org/;
proxy_redirect default;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}

}
###########################
And that’s it

But the nextcloud howto recommends all this :-

############################

upstream php-handler {
server 127.0.0.1:9000;
#server unix:/var/run/php/php7.0-fpm.sock;
}
server {
listen 80; listen [::]:80; server_name cloud.example.com;

enforce https return 301 https://$server_name$request_uri;

}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2; server_name cloud.example.com;

Use Mozilla’s guidelines for SSL/TLS settings # https://mozilla.github.io/server-side-tls/ssl-config-generator/

NOTE: some settings below might be redundant

ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;

Add headers to serve security related headers # Before enabling Strict-Transport-Security #headers please read into this

topic first.

add_header Strict-Transport-Security

“max-age=15768000;
includeSubDomains; preload;”

# WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option

will add the domain to a hardcoded list that is shipped

in all major browsers and getting removed from this list

could take several months.

add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection “1; mode=block”; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy no-referrer;

Remove X-Powered-By, which is an information leak fastcgi_hide_header X-Powered-By;

Path to the root of your installation root /var/www/nextcloud/;

location = /robots.txt { allow all; log_not_found off; access_log off; }

The following 2 rules are only needed for the user_webfinger app.

Uncomment it if you’re planning to use this app.

#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;

The following rule is only needed for the Social app.

Uncomment it if you’re planning to use this app.

rewrite ^/.well-known/webfinger /public.php?service=webfinger last; location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } # set max upload size client_max_body_size 512M; fastcgi_buffers 64 4K;

Enable gzip but do not remove ETag headers gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;

gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

Uncomment if your server is build with the ngx_pagespeed module

This module is currently not supported. #pagespeed off;

location / { rewrite ^ /index.php$request_uri; } location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { deny all; } location ~ ^/(?:.|autotest|occ|issue|indie|db_|console) { deny all; }
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+).php(?:$|/) { fastcgi_split_path_info ^(.+?.php)(/.*|)$; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS on;
#Avoid sending the security headers twice fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true; fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; }
location ~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/) { try_files $uri/ =404; index index.php; }

Adding the cache control header for js and css files

Make sure it is BELOW the PHP block location ~ .(?:css|js|woff2?|svg|gif)$ { try_files $uri /index.php$request_uri; add_header Cache-Control “public, max-age=15778463”;

Add headers to serve security related headers (It is intended to

have those duplicated to the ones above)

Before enabling Strict-Transport-Security headers please read into # this topic first.

add_header Strict-Transport-Security “max-age=15768000; includeSubDomains; preload;”;

# WARNING: Only add the preload option once you read about

the consequences in https://hstspreload.org/. This option # will add the domain to a hardcoded list that is shipped # in all major browsers and getting removed from this list # could take several months.

add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection “1; mode=block”; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; add_header Referrer-Policy no-referrer;

Optional: Don’t log access to assets access_log off;

}
location ~ .(?:png|html|ttf|ico|jpg|jpeg)$ { try_files $uri /index.php$request_uri;

Optional: Don’t log access to other assets access_log off;

}
}

#############################

And that is what nextcloud recommends.

So you can see the difference, did you add all that to your nginx config, or simply the top example?